Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
iDentalSoftBridgeSetup_12.2.0_x86 (1).exe

Overview

General Information

Sample name:iDentalSoftBridgeSetup_12.2.0_x86 (1).exe
Analysis ID:1525215
MD5:4eb785583966bc768c79a867a68a73ec
SHA1:6cbcb89f3a3b44861007c31d90731d76e357cdc3
SHA256:6c9e522203f8b8f4a020c991c2703e1787a49ca281bf56d0bfcf09ca98b6811b
Infos:

Detection

Score:32
Range:0 - 100
Whitelisted:false
Confidence:20%

Compliance

Score:47
Range:0 - 100

Signatures

Detected unpacking (changes PE section rights)
Contains functionality to prevent local Windows debugging
Installs new ROOT certificates
Registers a new ROOT certificate
Sigma detected: System File Execution Location Anomaly
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to communicate with device drivers
Contains functionality to detect virtual machines (SLDT)
Contains functionality to dynamically determine API calls
Contains functionality to launch a program with higher privileges
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query locales information (e.g. system language)
Contains functionality to shutdown / reboot the system
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Detected potential crypto function
Drops PE files
Drops certificate files (DER)
Enables debug privileges
Entry point lies outside standard sections
Extensive use of GetProcAddress (often used to hide API calls)
Found dropped PE file which has not been started or loaded
Found evasive API chain (date check)
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
PE file contains executable resources (Code or Archives)
PE file contains sections with non-standard names
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification
Stores files to the Windows start menu directory
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses cacls to modify the permissions of files
Uses code obfuscation techniques (call, push, ret)
Uses taskkill to terminate processes
Uses the system / local time for branch decision (may execute only at specific dates)

Classification

Process Tree

  • System is w10x64
  • iDentalSoftBridgeSetup_12.2.0_x86 (1).exe (PID: 2992 cmdline: "C:\Users\user\Desktop\iDentalSoftBridgeSetup_12.2.0_x86 (1).exe" MD5: 4EB785583966BC768C79A867A68A73EC)
    • iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp (PID: 6196 cmdline: "C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp" /SL5="$2040C,76918457,64512,C:\Users\user\Desktop\iDentalSoftBridgeSetup_12.2.0_x86 (1).exe" MD5: 3461AE6D7441C2E5698CA4B4177C962F)
      • iDentalSoft-Bridge.exe (PID: 5440 cmdline: "C:\Program Files (x86)\iDentalSoft Bridge\bin\iDentalSoft-Bridge.exe" MD5: 3A8BD34A555D3F6AE3EE8D35168A5A48)
        • conhost.exe (PID: 6864 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • cmd.exe (PID: 5060 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\3F88.tmp\iDental-Agent.bat"" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
          • iDSBridgeJ.exe (PID: 7048 cmdline: "C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ" -Xss1m -Xms512M -Xmx512M -XX:MaxPermSize=256M -cp "C:\Program Files (x86)\iDentalSoft Bridge\iDentalSoftBridge.jar";etc\ com.iss.idental.bridge.main.BridgeApplicationMain MD5: 9F8C5EAF561629D9323720ED6A80E9F8)
            • icacls.exe (PID: 2664 cmdline: icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M MD5: 2E49585E4E08565F52090B144062F97E)
              • conhost.exe (PID: 2716 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
            • icacls.exe (PID: 5676 cmdline: icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage\bf02f2a4d931bd0.timestamp /grant "everyone":(OI)(CI)M MD5: 2E49585E4E08565F52090B144062F97E)
              • conhost.exe (PID: 2632 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
            • taskkill.exe (PID: 3648 cmdline: taskkill /F /IM iDSBridgeNative.exe MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)
              • conhost.exe (PID: 5348 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
            • tasklist.exe (PID: 880 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)
              • conhost.exe (PID: 6948 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
            • iDSBridgeNative.exe (PID: 3780 cmdline: "C:\Program Files (x86)\iDentalSoft Bridge\iDSBridgeNative.exe" MD5: 1ED16F2085B9AEB0455D4152C4C08E2F)
      • certutil.exe (PID: 5072 cmdline: "C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exe" -delstore Root localgateway.iDentalSoft MD5: 711DB2EF10B6C2AB2080698AEC6C6D08)
        • conhost.exe (PID: 4048 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • certutil.exe (PID: 948 cmdline: "C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exe" -addstore Root "C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\BridgeSelfCertificate.cer" MD5: 711DB2EF10B6C2AB2080698AEC6C6D08)
        • conhost.exe (PID: 2144 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • iDentalSoft-Bridge.exe (PID: 6648 cmdline: "C:\Program Files (x86)\iDentalSoft Bridge\bin\iDentalSoft-Bridge.exe" MD5: 3A8BD34A555D3F6AE3EE8D35168A5A48)
  • iDentalSoft-Bridge.exe (PID: 5784 cmdline: "C:\Program Files (x86)\iDentalSoft Bridge\bin\iDentalSoft-Bridge.exe" MD5: 3A8BD34A555D3F6AE3EE8D35168A5A48)
    • conhost.exe (PID: 4600 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • cmd.exe (PID: 3940 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\5504.tmp\iDental-Agent.bat"" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • iDSBridgeJ.exe (PID: 3804 cmdline: "C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ" -Xss1m -Xms512M -Xmx512M -XX:MaxPermSize=256M -cp "C:\Program Files (x86)\iDentalSoft Bridge\iDentalSoftBridge.jar";etc\ com.iss.idental.bridge.main.BridgeApplicationMain MD5: 9F8C5EAF561629D9323720ED6A80E9F8)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

System Summary

barindex
Sigma detected: System File Execution Location Anomaly
Source: Process startedAuthor: Florian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali: Data: Command: "C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exe" -delstore Root localgateway.iDentalSoft, CommandLine: "C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exe" -delstore Root localgateway.iDentalSoft, CommandLine|base64offset|contains: )^, Image: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exe, NewProcessName: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exe, OriginalFileName: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp" /SL5="$2040C,76918457,64512,C:\Users\user\Desktop\iDentalSoftBridgeSetup_12.2.0_x86 (1).exe" , ParentImage: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp, ParentProcessId: 6196, ParentProcessName: iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp, ProcessCommandLine: "C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exe" -delstore Root localgateway.iDentalSoft, ProcessId: 5072, ProcessName: certutil.exe
Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification
Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\Program Files (x86)\iDentalSoft Bridge\iDentalSoft Bridge.lnk", EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp, ProcessId: 6196, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\iDentalSoft-Bridge

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_0106765A CryptDecodeObjectEx,SetLastError,10_2_0106765A
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_0104C916 CertGetPublicKeyLength,SetCursor,SetCursor,#225,wcslen,#223,#223,DialogBoxParamW,SysStringByteLen,CryptReleaseContext,LocalFree,LocalFree,LocalFree,LocalFree,CertFreeCTLContext,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,SysFreeString,10_2_0104C916
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_01028914 LocalFree,CryptMsgGetAndVerifySigner,CryptMsgGetAndVerifySigner,CertFreeCTLContext,CryptMsgControl,CryptMsgGetParam,LocalFree,LocalFree,CertFreeCTLContext,10_2_01028914
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_0102B91E CryptVerifyCertificateSignature,LocalFree,LocalFree,10_2_0102B91E
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_01020139 CertFindExtension,CryptDecodeObject,10_2_01020139
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_0102713D LocalFree,CryptDecodeObject,LocalFree,LocalFree,CryptDecodeObject,IsThreadDesktopComposited,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,10_2_0102713D
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_01035151 CryptGetProvParam,CryptGetProvParam,LocalAlloc,CryptGetProvParam,LocalFree,10_2_01035151
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_0103A15E lstrcmpW,LocalFree,LocalFree,CryptReleaseContext,LocalFree,LocalFree,LocalFree,LocalFree,10_2_0103A15E
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_0104C167 CryptExportPublicKeyInfo,CryptExportPublicKeyInfo,LocalAlloc,CryptExportPublicKeyInfo,CertFindExtension,LocalAlloc,CAFindCertTypeByName,CAGetCertTypeExtensions,LocalAlloc,CertFindExtension,CertFindExtension,CryptSignAndEncodeCertificate,CryptSignAndEncodeCertificate,LocalAlloc,IsThreadDesktopComposited,CryptSignAndEncodeCertificate,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,CAFreeCertTypeExtensions,CACloseCertType,10_2_0104C167
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_0101696D CryptMsgClose,CertCloseStore,LocalFree,10_2_0101696D
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_01052171 CryptFindOIDInfo,CryptEncryptMessage,LocalAlloc,CryptEncryptMessage,LocalFree,10_2_01052171
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_010399A3 CryptAcquireContextW,CryptGetUserKey,CryptGetUserKey,CryptGetUserKey,CryptImportKey,CertFreeCTLContext,CryptReleaseContext,LocalFree,LocalFree,LocalFree,CryptDestroyKey,10_2_010399A3
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_010671B5 CryptSignCertificate,SetLastError,10_2_010671B5
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_010679CA CryptDecodeObject,wcslen,wcslen,wcslen,LocalAlloc,wcscpy,wcslen,wcscpy,wcslen,wcscpy,wcslen,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,10_2_010679CA
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_010411EF LocalFree,LocalFree,LocalFree,CryptReleaseContext,10_2_010411EF
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_0103E9EF CryptVerifyCertificateSignature,CertVerifyTimeValidity,CertOpenStore,CertVerifyRevocation,CertCloseStore,10_2_0103E9EF
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_01067001 CryptExportPublicKeyInfo,SetLastError,10_2_01067001
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_0103A01F CryptGetUserKey,LocalFree,CryptDestroyKey,10_2_0103A01F
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_0104F824 CryptAcquireContextW,CryptCreateHash,CryptHashData,CryptGetHashParam,LocalAlloc,wcscpy,CryptDestroyHash,CryptReleaseContext,10_2_0104F824
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_01038030 CryptDecodeObject,LocalAlloc,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,10_2_01038030
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_0102C055 _strnicmp,CryptDecodeObject,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,10_2_0102C055
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_01035872 SCardListCardsW,SCardGetCardTypeProviderNameW,swprintf,CryptAcquireContextW,SCardFreeMemory,SCardFreeMemory,CryptReleaseContext,10_2_01035872
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_01036081 CryptAcquireCertificatePrivateKey,LocalFree,LocalFree,CryptFindCertificateKeyProvInfo,LocalFree,LocalFree,CryptReleaseContext,10_2_01036081
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_0101A887 CryptRetrieveObjectByUrlW,CertEnumCRLsInStore,CertFreeCTLContext,CertCloseStore,10_2_0101A887
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_0105488D CryptImportPublicKeyInfo,CryptGenKey,CryptGenRandom,CryptDestroyKey,CryptGetUserKey,CryptImportKey,CryptDestroyKey,CryptDestroyKey,CryptDestroyKey,LocalFree,LocalFree,LocalFree,LocalFree,10_2_0105488D
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_0102F09D fprintf,lstrcmpW,CryptMsgControl,CertFreeCTLContext,CertFreeCTLContext,LocalFree,LocalFree,SysFreeString,LocalFree,10_2_0102F09D
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_010678B6 CryptMsgGetParam,CryptMsgGetParam,CryptMsgGetParam,LocalFree,10_2_010678B6
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_010280CA LocalFree,LocalFree,LocalFree,CryptDecodeObject,LocalFree,LocalFree,LocalFree,LocalFree,10_2_010280CA
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_010430CD #223,CryptVerifyCertificateSignature,LocalFree,LocalFree,LocalFree,10_2_010430CD
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_010180D0 #223,CertFindCertificateInStore,LocalFree,CryptMsgClose,CertFreeCTLContext,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,CertCloseStore,CryptMsgClose,10_2_010180D0
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_010390D0 LocalAlloc,CryptSetKeyParam,GetLastError,LocalAlloc,CryptDecrypt,GetLastError,LocalFree,LocalFree,LocalFree,LocalFree,10_2_010390D0
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_010520D1 LocalAlloc,IsThreadDesktopComposited,CryptDecrypt,LocalFree,10_2_010520D1
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_010530DF CertFindExtension,CryptDecodeObject,10_2_010530DF
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_010428F8 CertCompareCertificateName,CertCompareCertificateName,GetSystemTime,SystemTimeToFileTime,CompareFileTime,CompareFileTime,CompareFileTime,CompareFileTime,CompareFileTime,CryptVerifyCertificateSignature,CertCompareCertificateName,CertCompareCertificateName,10_2_010428F8
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_0103E30E CryptUIDlgViewCertificateW,10_2_0103E30E
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_0102CB10 CryptAcquireCertificatePrivateKey,CryptGetUserKey,LocalFree,LocalFree,LocalFree,CryptDestroyKey,CryptReleaseContext,10_2_0102CB10
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_0104D316 CryptGetProvParam,CryptGetProvParam,LocalAlloc,CryptGetProvParam,LocalFree,CryptReleaseContext,LocalAlloc,CryptGetProvParam,wcscmp,CryptReleaseContext,LocalFree,10_2_0104D316
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_0103E345 CryptUIDlgViewCRLW,10_2_0103E345
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_0102F358 LocalFree,LocalFree,lstrcmpW,CryptAcquireContextW,#256,CryptGenRandom,fopen,fopen,fopen,fprintf,fprintf,fprintf,fprintf,fprintf,fprintf,fprintf,fprintf,fprintf,fprintf,fprintf,fprintf,LocalAlloc,fprintf,fprintf,wsprintfW,fprintf,fprintf,wsprintfW,fprintf,wsprintfW,wsprintfW,fprintf,fprintf,fprintf,fprintf,fprintf,CertOpenStore,CertSaveStore,LocalAlloc,CertSaveStore,fprintf,wsprintfW,fprintf,fflush,CertCloseStore,CertFreeCTLContext,CertFreeCTLContext,CertFreeCTLContext,fclose,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,CryptDestroyKey,CryptReleaseContext,CryptReleaseContext,CryptReleaseContext,10_2_0102F358
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_0103EB58 CertFindExtension,CryptDecodeObject,10_2_0103EB58
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_01052B5B CryptHashData,10_2_01052B5B
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_01015360 #246,CertFindExtension,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,CryptReleaseContext,CryptAcquireContextW,LocalFree,10_2_01015360
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_01052B93 CryptDuplicateHash,CryptGetHashParam,#203,CryptDestroyHash,10_2_01052B93
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_0102339D CryptDecodeObject,SysFreeString,10_2_0102339D
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_0103EBBD CryptGetObjectUrl,CryptGetObjectUrl,LocalAlloc,CryptGetObjectUrl,LocalFree,10_2_0103EBBD
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_01029BCD CryptDuplicateKey,CryptEncrypt,CryptEncrypt,CryptEncrypt,CryptDestroyKey,10_2_01029BCD
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_01039BF3 CryptAcquireContextW,CryptGetUserKey,LocalFree,LocalFree,CryptReleaseContext,LocalFree,10_2_01039BF3
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_01052A06 CryptAcquireContextW,CryptCreateHash,CryptReleaseContext,10_2_01052A06
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_01035206 CryptGetKeyParam,CryptGetKeyParam,LocalAlloc,CryptGetKeyParam,CertCreateCertificateContext,CryptExportPublicKeyInfo,CryptExportPublicKeyInfo,LocalAlloc,CryptExportPublicKeyInfo,CertComparePublicKeyInfo,CertSetCertificateContextProperty,LocalFree,LocalFree,LocalFree,LocalFree,CertFreeCTLContext,10_2_01035206
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_01053A08 GetEnvironmentVariableW,_wtoi,#203,CryptDestroyHash,CryptReleaseContext,#203,#203,#207,#203,#203,LocalFree,#203,CryptDestroyHash,CryptReleaseContext,10_2_01053A08
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_0104DA10 LoadCursorW,LoadCursorW,SetCursor,SetCursor,#210,LoadCursorW,SetCursor,EnableWindow,SetWindowLongW,SetWindowLongW,SetWindowLongW,SetWindowLongW,GetDlgItem,GetDlgItem,SetWindowTextW,GetDlgItem,ShowWindow,CryptUIDlgFreeCAContext,10_2_0104DA10
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_0102DA27 CryptAcquireContextW,wsprintfW,LocalFree,LocalFree,wsprintfW,wsprintfW,wsprintfW,wsprintfW,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,CryptDestroyKey,CryptReleaseContext,DeleteFileW,LocalFree,10_2_0102DA27
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_0105422D CryptAcquireContextW,SetLastError,10_2_0105422D
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_0102BA31 CryptGenRandom,10_2_0102BA31
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_01052246 CryptDecryptMessage,CryptDecryptMessage,10_2_01052246
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_01029A45 LocalAlloc,CryptHashData,CryptCreateHash,CryptHashData,CryptHashData,CryptGetHashParam,CryptDestroyHash,LocalFree,CryptDestroyHash,10_2_01029A45
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_0104D266 CryptGetProvParam,LocalAlloc,LocalFree,SetLastError,10_2_0104D266
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_01054A82 CryptReleaseContext,10_2_01054A82
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_01038A97 CryptAcquireContextW,CryptCreateHash,CryptHashData,CryptHashData,CryptHashData,CryptImportPublicKeyInfo,CryptVerifySignatureW,CertCreateCertificateContext,LocalFree,LocalFree,LocalFree,CryptDestroyKey,CryptDestroyHash,CryptReleaseContext,10_2_01038A97
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_01022AF3 CryptFormatObject,wcscspn,10_2_01022AF3
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_0102BAF4 GetSystemTime,SystemTimeToFileTime,CertCreateCertificateContext,CryptReleaseContext,LocalFree,LocalFree,LocalFree,LocalFree,10_2_0102BAF4
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_01053512 CryptSetProvParam,10_2_01053512
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_01024D4E CryptHashPublicKeyInfo,LocalFree,10_2_01024D4E
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_01053555 CryptGetProvParam,CryptGetUserKey,CryptGetKeyParam,CryptDestroyKey,10_2_01053555
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_0102D55A LocalAlloc,CryptCreateHash,CryptHashData,CryptGetHashParam,CryptImportKey,CryptSetKeyParam,CryptSetKeyParam,CryptSetKeyParam,CryptCreateHash,CryptHashData,CryptHashData,CryptHashData,CryptGetHashParam,CryptSetKeyParam,LocalFree,LocalFree,LocalFree,LocalFree,CryptDestroyHash,CryptDestroyHash,CryptDestroyHash,10_2_0102D55A
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_0102BD68 fprintf,CryptReleaseContext,CryptReleaseContext,CryptReleaseContext,CertFreeCTLContext,CertFreeCTLContext,CertFreeCTLContext,10_2_0102BD68
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_01037D91 CryptGetDefaultProviderW,LocalAlloc,CryptGetDefaultProviderW,10_2_01037D91
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_01022598 CertFindExtension,CryptFormatObject,CryptFormatObject,LocalAlloc,CryptFormatObject,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,10_2_01022598
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_0105159E CryptAcquireContextW,CryptAcquireContextW,CryptReleaseContext,CryptAcquireContextW,CryptAcquireContextW,CryptGenKey,CryptDestroyKey,10_2_0105159E
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_01055DA6 SetCursor,LocalAlloc,CertOpenStore,#246,CryptUIDlgSelectCertificateW,CertCloseStore,SysFreeString,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,10_2_01055DA6
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_010545CE CryptGetProvParam,CryptGetProvParam,CryptFindOIDInfo,CryptReleaseContext,10_2_010545CE
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_01037DFF CertFindExtension,CryptDecodeObject,10_2_01037DFF
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_010675F8 CryptEncodeObjectEx,SetLastError,10_2_010675F8
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_0102D40A CertOpenStore,CertFindCertificateInStore,CertFindCertificateInStore,CryptVerifyCertificateSignature,LocalFree,CertFreeCTLContext,CertCloseStore,10_2_0102D40A
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_0103BC0A CryptAcquireContextW,CryptImportKey,CryptImportKey,CryptImportKey,CertSetCertificateContextProperty,CertAddCertificateContextToStore,LocalFree,LocalFree,CryptDestroyKey,CryptReleaseContext,LocalFree,10_2_0103BC0A
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_0104140A CryptReleaseContext,LocalFree,10_2_0104140A
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_01051C24 CryptDecodeObject,wcslen,wcslen,LocalAlloc,wcscpy,wcslen,LocalFree,LocalFree,LocalFree,LocalFree,10_2_01051C24
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_01066C35 CertOpenStore,CryptMsgOpenToDecode,CryptMsgUpdate,CryptMsgGetParam,CryptMsgGetParam,CryptMsgGetParam,CryptMsgGetParam,CryptMsgClose,CertCloseStore,LocalFree,LocalFree,LocalFree,10_2_01066C35
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_01024447 CryptMsgGetAndVerifySigner,CertEnumCertificatesInStore,CertFreeCTLContext,10_2_01024447
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_01023C4C CertEnumCertificatesInStore,CryptAcquireCertificatePrivateKey,CryptGetUserKey,LocalFree,LocalFree,CryptDestroyKey,CryptReleaseContext,10_2_01023C4C
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_0102644C CryptFormatObject,CryptFormatObject,LocalAlloc,CryptFormatObject,LocalFree,LocalFree,LocalFree,10_2_0102644C
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_01054C5F CryptAcquireContextW,10_2_01054C5F
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_0101945E CryptAcquireContextW,CryptGenRandom,CryptGenRandom,CryptGenRandom,CryptReleaseContext,10_2_0101945E
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_0101A465 CryptRetrieveObjectByUrlW,InternetQueryDataAvailable,InternetReadFile,InternetReadFile,LocalAlloc,CertCloseStore,LocalFree,LocalFree,LocalFree,10_2_0101A465
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_01028C6A CryptMsgGetParam,CryptMsgGetParam,CertEnumCertificatesInStore,CertEnumCertificatesInStore,CertEnumCRLsInStore,CertEnumCRLsInStore,CertEnumCRLsInStore,LocalFree,LocalFree,CryptMsgClose,CertFreeCTLContext,CertFreeCTLContext,CertCloseStore,LocalFree,10_2_01028C6A
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_0101D470 #140,iswdigit,wcslen,CryptDecodeObject,wcslen,#224,10_2_0101D470
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_0104B473 CryptReleaseContext,CertComparePublicKeyInfo,LocalFree,LocalFree,CryptReleaseContext,LocalFree,CertFreeCTLContext,LocalFree,LocalFree,CryptReleaseContext,LocalFree,CertFreeCTLContext,10_2_0104B473
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_01054C84 CryptAcquireContextW,CryptImportKey,CryptDestroyKey,CryptGetUserKey,CryptGetUserKey,CryptGetUserKey,CryptDestroyKey,CryptReleaseContext,CryptAcquireContextW,CryptDestroyKey,CryptReleaseContext,LocalFree,10_2_01054C84
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_01024C8B CertFindExtension,CryptDecodeObject,10_2_01024C8B
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_0103EF13 CryptVerifyCertificateSignature,CertVerifyCRLTimeValidity,CertCompareCertificateName,CertCompareCertificateName,CertCompareCertificateName,10_2_0103EF13
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_01050F13 GetSystemInfo,CreateFileW,GetFileSize,CreateFileMappingW,CryptAcquireContextW,CryptCreateHash,MapViewOfFile,CryptHashData,UnmapViewOfFile,CryptGetHashParam,UnmapViewOfFile,CloseHandle,CloseHandle,CryptDestroyHash,CryptReleaseContext,10_2_01050F13
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_01067742 CryptHashPublicKeyInfo,LocalAlloc,LocalFree,10_2_01067742
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_01051F4C CryptExportKey,CryptExportKey,LocalAlloc,CryptExportKey,LocalFree,10_2_01051F4C
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_01043756 CryptVerifyCertificateSignature,CryptVerifyCertificateSignatureEx,10_2_01043756
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_0104DF68 #210,SetWindowTextW,SetFocus,SendMessageW,LocalFree,LocalFree,LocalFree,CryptUIDlgFreeCAContext,CoUninitialize,SendMessageW,wcslen,LocalAlloc,wcscpy,LocalFree,UpdateWindow,CoInitialize,LoadCursorW,LoadCursorW,SetCursor,LoadCursorW,SetCursor,SetFocus,wcslen,SetWindowTextW,10_2_0104DF68
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_01053770 CryptAcquireCertificatePrivateKey,CryptReleaseContext,10_2_01053770
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_01041F71 CertFindExtension,CryptDecodeObject,10_2_01041F71
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_01037F94 CryptDecodeObject,10_2_01037F94
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_01029F9E CryptDuplicateKey,CryptEncrypt,LocalAlloc,CryptEncrypt,LocalAlloc,CryptDestroyKey,LocalFree,10_2_01029F9E
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_0102AFB5 CertAddEncodedCertificateToStore,StringFromCLSID,CryptAcquireContextW,CryptImportKey,CertSetCertificateContextProperty,CryptDestroyKey,CryptReleaseContext,CoTaskMemFree,CertFreeCTLContext,10_2_0102AFB5
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_010527CE CertFindExtension,CryptDecodeObject,10_2_010527CE
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_0105A7CE CryptGetUserKey,CryptReleaseContext,CryptImportKey,LocalFree,CryptDestroyKey,CryptDestroyKey,CryptReleaseContext,CryptDestroyKey,CryptReleaseContext,10_2_0105A7CE
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_01051FE4 LocalAlloc,CryptEncrypt,LocalFree,LocalAlloc,LocalFree,10_2_01051FE4
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_01049FE3 CryptReleaseContext,10_2_01049FE3
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_01054FED CertFindCertificateInStore,CryptAcquireCertificatePrivateKey,CertFindCertificateInStore,CertFreeCTLContext,10_2_01054FED
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_0102BFF5 CryptDecodeObject,10_2_0102BFF5
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_0105261D CryptFindOIDInfo,CryptFindOIDInfo,CryptFindOIDInfo,10_2_0105261D
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_01029E1E LocalAlloc,CryptDuplicateKey,CryptDecrypt,CryptDestroyKey,LocalFree,10_2_01029E1E
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_0102B61D CryptAcquireContextW,CryptGenKey,CryptDestroyKey,10_2_0102B61D
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_01065E25 CryptSetProvParam,LocalFree,10_2_01065E25
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_01049E2D CryptAcquireContextW,CryptAcquireContextW,CryptReleaseContext,CryptAcquireContextW,CryptAcquireContextW,CryptGenKey,CryptGenKey,CryptGenKey,CryptDestroyKey,10_2_01049E2D
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_01024E29 CryptHashPublicKeyInfo,10_2_01024E29
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_01031633 CryptReleaseContext,10_2_01031633
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_01024653 GetTickCount,CertOpenStore,CertAddEncodedCertificateToStore,CryptAcquireCertificatePrivateKey,CryptFindCertificateKeyProvInfo,LocalFree,CryptAcquireContextW,CertSetCertificateContextProperty,LocalFree,CertFreeCTLContext,CertCloseStore,CryptReleaseContext,10_2_01024653
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_01048677 CertFindExtension,CryptDecodeObject,10_2_01048677
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_01015675 LocalFree,LocalFree,LocalFree,SysFreeString,CertFreeCTLContext,CryptReleaseContext,10_2_01015675
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_01051673 CryptExportKey,CryptExportKey,LocalAlloc,CryptExportKey,LocalFree,10_2_01051673
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_01039E79 CreateFileW,GetFileSize,SetFilePointer,CertFreeCTLContext,CertFreeCTLContext,CertFreeCTLContext,CryptDestroyKey,CryptReleaseContext,CloseHandle,10_2_01039E79
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_01023688 CryptDecodeObject,LocalFree,10_2_01023688
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_0102B693 CryptCreateHash,CryptHashData,CryptGetHashParam,CryptGetUserKey,CryptGetUserKey,CryptGetUserKey,CryptImportKey,CryptDecrypt,CryptDestroyKey,CryptDestroyKey,CryptDestroyHash,LocalFree,CryptDestroyKey,10_2_0102B693
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_0103569F CryptGetUserKey,wcslen,wcslen,wcslen,LocalAlloc,swprintf,CryptUIDlgViewCertificateW,CertFreeCTLContext,LocalFree,CryptDestroyKey,10_2_0103569F
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_010386A0 CertCreateCertificateContext,CryptAcquireContextW,CryptImportKey,CertFreeCTLContext,LocalFree,CryptDestroyKey,CryptReleaseContext,10_2_010386A0
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_01050EB8 CryptGetProvParam,LocalAlloc,10_2_01050EB8
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_010266C3 CryptDecodeObject,LocalFree,CryptDecodeObject,CryptDecodeObject,CryptDecodeObject,CryptDecodeObject,CryptDecodeObject,CryptDecodeObject,LocalFree,CryptDecodeObject,10_2_010266C3
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_01054EC8 CryptEnumProvidersA,LocalAlloc,CryptEnumProvidersA,LocalFree,10_2_01054EC8
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_010206D7 CertFindExtension,CryptDecodeObject,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,10_2_010206D7
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_01017EDB CryptAcquireContextW,10_2_01017EDB
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_010546E1 CryptCreateHash,CryptGenRandom,CryptHashData,CryptSignHashW,CryptSignHashW,LocalAlloc,CryptSignHashW,CryptImportPublicKeyInfo,CryptGetUserKey,CryptVerifySignatureW,CryptDestroyHash,CryptDestroyKey,LocalFree,10_2_010546E1
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_010396EC CryptImportKey,CryptSetKeyParam,LocalFree,CertFreeCTLContext,CryptDestroyKey,10_2_010396EC
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_6F33F9C6 CryptDecodeObjectEx,SetLastError,10_2_6F33F9C6
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_77BB374D CertOpenStore,CryptMsgOpenToDecode,CryptMsgUpdate,CryptMsgGetParam,CryptMsgGetParam,CryptMsgGetParam,CryptMsgGetParam,CryptMsgClose,CertCloseStore,LocalFree,LocalFree,LocalFree,10_2_77BB374D
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_77BA2EB5 #258,wcslen,wcslen,IsThreadDesktopComposited,CryptHashCertificate,wcsrchr,wcslen,wcslen,wcslen,wcslen,LocalAlloc,wcsncpy,wcscat,wcscat,wcscat,LocalFree,10_2_77BA2EB5
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_77BB46A8 CryptMsgGetParam,CryptMsgGetParam,CryptMsgGetParam,LocalFree,10_2_77BB46A8
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_77BA6610 CryptEncodeObject,CryptEncodeObject,CryptEncodeObject,10_2_77BA6610
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_77BAEE6B LocalAlloc,CryptSignMessage,SetLastError,10_2_77BAEE6B
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_77B9B641 SysFreeString,LoadLibraryW,GetDesktopWindow,wcslen,wcslen,wcslen,LocalAlloc,wcscpy,wcscat,wcscat,wcscat,lstrcmpiW,LocalFree,FreeLibrary,LocalFree,LocalFree,LocalFree,CryptUIDlgFreeCAContext,10_2_77B9B641
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_77BB3D87 CryptEncodeObjectEx,SetLastError,10_2_77BB3D87
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_77BB3DF0 CryptDecodeObjectEx,SetLastError,10_2_77BB3DF0
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_77BAF528 CertFindExtension,CryptDecodeObject,10_2_77BAF528
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_77BA2522 LocalFree,CryptAcquireContextA,CryptGenRandom,CryptGenRandom,CryptGenRandom,wsprintfW,wsprintfW,wsprintfW,wcslen,wcslen,wcslen,wcslen,LocalAlloc,wcscpy,wcscat,wcscat,wcscat,CryptReleaseContext,10_2_77BA2522
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_77BA656F CryptEncodeObject,CryptEncodeObject,CryptEncodeObject,10_2_77BA656F
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_77BA5489 wcslen,wcslen,wcslen,LocalAlloc,wcscat,wcscpy,wcscat,wcscat,GetSystemTimeAsFileTime,CryptMsgEncodeAndSignCTL,CryptMsgEncodeAndSignCTL,LocalAlloc,CryptMsgEncodeAndSignCTL,LocalFree,LocalFree,LocalFree,10_2_77BA5489
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_77BA83E2 LocalAlloc,LocalAlloc,LocalFree,LocalAlloc,LocalAlloc,LocalAlloc,wcschr,CryptEncodeObject,CryptEncodeObject,LocalAlloc,CryptEncodeObject,CAOIDFreeLdapURL,WideCharToMultiByte,LocalAlloc,WideCharToMultiByte,CryptEncodeObject,CryptEncodeObject,CryptEncodeObject,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,CAOIDFreeLdapURL,10_2_77BA83E2
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_77B9B2D1 LocalAlloc,LocalAlloc,LocalAlloc,LocalAlloc,LocalAlloc,wcsstr,wcslen,LocalAlloc,wcslen,LocalAlloc,wcscpy,wcscpy,SysFreeString,CryptUIDlgSelectCA,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,SysFreeString,SysFreeString,10_2_77B9B2D1
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_77BA8237 wcslen,WideCharToMultiByte,LocalAlloc,wcslen,WideCharToMultiByte,CryptEncodeObject,CryptEncodeObject,CryptEncodeObject,LocalFree,10_2_77BA8237
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_77BB420C wcslen,CryptDecodeObject,LocalFree,10_2_77BB420C
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_77BA7925 lstrcmpiW,lstrcmpiW,lstrcmpiW,wcslen,LocalAlloc,LocalFree,wcscpy,LocalFree,lstrcmpiW,lstrcmpiW,WideCharToMultiByte,WideCharToMultiByte,GetLastError,LocalAlloc,LocalAlloc,WideCharToMultiByte,GetLastError,LocalFree,CryptFindOIDInfo,LocalFree,wcslen,LocalAlloc,wcscpy,lstrcmpiW,lstrcmpiW,10_2_77BA7925
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_77BAF09D CryptFindOIDInfo,CryptFindOIDInfo,CryptFindOIDInfo,10_2_77BAF09D
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_77BA805A wcslen,wcslen,WideCharToMultiByte,WideCharToMultiByte,GetLastError,LocalAlloc,wcslen,WideCharToMultiByte,GetLastError,CryptEncodeObject,CryptEncodeObject,CryptEncodeObject,LocalFree,10_2_77BA805A

Compliance

barindex
Uses 32bit PE files
Source: iDentalSoftBridgeSetup_12.2.0_x86 (1).exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
PE / OLE file has a valid certificate
Source: iDentalSoftBridgeSetup_12.2.0_x86 (1).exeStatic PE information: certificate valid
Uses new MSVCR Dlls
Source: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ.exeFile opened: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\msvcr100.dllJump to behavior
Binary contains paths to debug symbols
Source: Binary string: certadm.pdb source: certutil.exe, certutil.exe, 0000000A.00000002.2669008237.000000006F331000.00000020.00000001.01000000.0000000C.sdmp, certutil.exe, 0000000E.00000002.2673574475.000000006F331000.00000020.00000001.01000000.0000000C.sdmp
Source: Binary string: msvcp100.i386.pdb source: iDSBridgeNative.exe, 0000001A.00000002.3386023496.000000006D3A1000.00000020.00000001.01000000.0000001C.sdmp
Source: Binary string: vcruntime140.i386.pdb source: iDSBridgeNative.exe, 0000001A.00000002.3386869503.000000006E941000.00000020.00000001.01000000.0000001A.sdmp
Source: Binary string: vcruntime140.i386.pdbGCTL source: iDSBridgeNative.exe, 0000001A.00000002.3386869503.000000006E941000.00000020.00000001.01000000.0000001A.sdmp
Source: Binary string: msvcr100.i386.pdb source: iDSBridgeNative.exe, 0000001A.00000002.3385289449.000000006D2E1000.00000020.00000001.01000000.0000001D.sdmp
Source: Binary string: certcli.pdb source: certutil.exe, certutil.exe, 0000000A.00000002.2669135112.0000000077B91000.00000020.00000001.01000000.0000000D.sdmp, certutil.exe, 0000000E.00000002.2673731472.0000000077B91000.00000020.00000001.01000000.0000000D.sdmp
Source: Binary string: c:\workspace\8-2-build-windows-i586-cygwin\jdk8u121\8372\build\windows-i586\jdk\objs\libnet\net.pdb source: iDSBridgeJ.exe, 0000001F.00000002.2795083135.000000006C46D000.00000002.00000001.01000000.00000013.sdmp
Source: Binary string: mfc140.i386.pdbGCTL source: iDSBridgeNative.exe, 0000001A.00000002.3382093677.000000006C621000.00000020.00000001.01000000.0000001E.sdmp
Source: Binary string: mfc140.i386.pdb source: iDSBridgeNative.exe, 0000001A.00000002.3382093677.000000006C621000.00000020.00000001.01000000.0000001E.sdmp
Source: Binary string: msvcp140.i386.pdbGCTL source: iDSBridgeNative.exe, 0000001A.00000002.3386386581.000000006E831000.00000020.00000001.01000000.0000001B.sdmp
Source: Binary string: D:\IDS_workspace\source\7.1.0\dependencies\BridgeNative\bin\Release\x86\iDSBridgeNative.pdb source: iDSBridgeNative.exe, 0000001A.00000000.2714981155.0000000000A66000.00000002.00000001.01000000.00000017.sdmp, iDSBridgeNative.exe, 0000001A.00000002.3381003468.0000000000A66000.00000002.00000001.01000000.00000017.sdmp
Source: Binary string: D:\IDS_workspace\source\7.1.0\dependencies\BridgeNative\bin\Release\x86\BridgeNative.pdb source: iDSBridgeNative.exe, 0000001A.00000002.3387598309.0000000073888000.00000002.00000001.01000000.00000018.sdmp
Source: Binary string: certutil.pdb source: certutil.exe, certutil.exe, 0000000A.00000000.2665836640.0000000001001000.00000020.00000001.01000000.0000000A.sdmp, certutil.exe, 0000000A.00000002.2668757884.0000000001001000.00000020.00000001.01000000.0000000A.sdmp, certutil.exe, 0000000E.00000002.2673288626.0000000001001000.00000020.00000001.01000000.0000000A.sdmp, certutil.exe, 0000000E.00000000.2669897300.0000000001001000.00000020.00000001.01000000.0000000A.sdmp
Source: Binary string: c:\workspace\8-2-build-windows-i586-cygwin\jdk8u121\8372\build\windows-i586\jdk\objs\libnet\net.pdby source: iDSBridgeJ.exe, 0000001F.00000002.2795083135.000000006C46D000.00000002.00000001.01000000.00000013.sdmp
Source: Binary string: D:\IDS_workspace\source\7.1.0\dependencies\BridgeNative\bin\Release\x86\iDSBridgeNative.pdb'' source: iDSBridgeNative.exe, 0000001A.00000000.2714981155.0000000000A66000.00000002.00000001.01000000.00000017.sdmp, iDSBridgeNative.exe, 0000001A.00000002.3381003468.0000000000A66000.00000002.00000001.01000000.00000017.sdmp
Source: Binary string: msvcp140.i386.pdb source: iDSBridgeNative.exe, 0000001A.00000002.3386386581.000000006E831000.00000020.00000001.01000000.0000001B.sdmp
Source: Binary string: D:\IDS_workspace\source\7.1.0\dependencies\BridgeNative\bin\Release\x86\BridgeNative.pdb-- source: iDSBridgeNative.exe, 0000001A.00000002.3387598309.0000000073888000.00000002.00000001.01000000.00000018.sdmp
Source: Binary string: c:\workspace\8-2-build-windows-i586-cygwin\jdk8u121\8372\build\windows-i586\jdk\objs\libzip\zip.pdb source: iDSBridgeJ.exe, 0000001F.00000002.2793202587.000000006BE9A000.00000002.00000001.01000000.00000012.sdmp
Source: Binary string: c:\workspace\8-2-build-windows-i586-cygwin\jdk8u121\8372\build\windows-i586\jdk\objs\javaw_objs\javaw.pdb source: iDSBridgeJ.exe, 0000000D.00000000.2667545211.0000000000B3C000.00000002.00000001.01000000.0000000B.sdmp, iDSBridgeJ.exe, 0000000D.00000002.3380614378.0000000000B3C000.00000002.00000001.01000000.0000000B.sdmp, iDSBridgeJ.exe, 0000001F.00000000.2721460854.0000000000B3C000.00000002.00000001.01000000.0000000B.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2763260153.0000000000B3C000.00000002.00000001.01000000.0000000B.sdmp
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpCode function: 2_2_00452A60 FindFirstFileA,GetLastError,2_2_00452A60
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpCode function: 2_2_00474DFC FindFirstFileA,FindNextFileA,FindClose,2_2_00474DFC
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpCode function: 2_2_004625C4 FindFirstFileA,FindNextFileA,FindClose,2_2_004625C4
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpCode function: 2_2_00463B50 SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,SetErrorMode,2_2_00463B50
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpCode function: 2_2_00497C14 FindFirstFileA,SetFileAttributesA,FindNextFileA,FindClose,2_2_00497C14
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpCode function: 2_2_00463FCC SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,SetErrorMode,2_2_00463FCC
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_0105B191 FindFirstFileW,LocalFree,FindNextFileW,FindClose,LocalFree,10_2_0105B191
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_010501C5 wcslen,LocalAlloc,wcscpy,wcscpy,wcsrchr,FindFirstFileW,wcscpy,lstrcmpW,lstrcmpW,DeleteFileW,FindNextFileW,FindClose,LocalFree,LocalFree,LocalFree,10_2_010501C5
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_0105902A wcslen,wcscpy,wcscat,FindFirstFileW,FindNextFileW,FindClose,10_2_0105902A
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_0105A048 FindFirstFileW,FindNextFileW,FindClose,LocalFree,10_2_0105A048
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_010590DE wcslen,wcscpy,wcscpy,wcscat,FindFirstFileW,wcslen,wcscpy,DeleteFileW,FindNextFileW,FindClose,10_2_010590DE
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_0105AA90 wcslen,wcslen,wcscpy,wcscat,wcscat,wcscat,FindFirstFileW,FindNextFileW,wcslen,wcscpy,FindClose,wcslen,wcslen,LocalAlloc,wcscpy,wcscat,wcscat,10_2_0105AA90
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_0105960F wcschr,wcslen,wcscpy,wcscat,FindFirstFileW,wcslen,wcscpy,wcsrchr,_wcsnicmp,iswxdigit,wcstoul,FindNextFileW,LocalFree,LocalFree,LocalFree,FindClose,10_2_0105960F
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_6F338862 WritePrivateProfileStringW,wcscpy,wsprintfW,wcscpy,wcschr,RegQueryValueExW,wcscpy,wcsrchr,FindFirstFileW,wcstoul,wcscpy,DeleteFileW,FindNextFileW,LocalFree,LocalFree,LocalFree,LocalFree,FindClose,10_2_6F338862
Source: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ.exeFile opened: C:\Users\user\.swt\lib\win32\Jump to behavior
Source: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ.exeFile opened: C:\Users\user\.swt\lib\win32\x86\Jump to behavior
Source: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ.exeFile opened: C:\Users\user\.swt\lib\win32\x86\swt-win32-4332.dllJump to behavior
Source: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ.exeFile opened: C:\Users\user\.swt\Jump to behavior
Source: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ.exeFile opened: C:\Users\user\Jump to behavior
Source: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ.exeFile opened: C:\Users\user\.swt\lib\Jump to behavior
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 4x nop then int ADh10_2_77B98709
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 4x nop then push eax10_2_77BB3640
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 4x nop then push eax10_2_77BB35EA
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 4x nop then push eax10_2_77BB35E2
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 4x nop then test esi, esi10_2_77BAD49D
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 4x nop then mov edi, edi10_2_77B9CA20
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 4x nop then mov edi, edi10_2_77B9D278
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_0101A40C InternetReadFile,LocalAlloc,10_2_0101A40C
Source: certutil.exeString found in binary or memory: http://%1/CertEnroll/%1_%3%4.crt
Source: certutil.exe, 0000000A.00000000.2665836640.0000000001001000.00000020.00000001.01000000.0000000A.sdmp, certutil.exe, 0000000A.00000002.2668757884.0000000001001000.00000020.00000001.01000000.0000000A.sdmp, certutil.exe, 0000000E.00000002.2673288626.0000000001001000.00000020.00000001.01000000.0000000A.sdmp, certutil.exe, 0000000E.00000000.2669897300.0000000001001000.00000020.00000001.01000000.0000000A.sdmpString found in binary or memory: http://%1/CertEnroll/%1_%3%4.crtfile://
Source: certutil.exeString found in binary or memory: http://%1/CertEnroll/%3%8%9.crl
Source: certutil.exe, 0000000A.00000000.2665836640.0000000001001000.00000020.00000001.01000000.0000000A.sdmp, certutil.exe, 0000000A.00000002.2668757884.0000000001001000.00000020.00000001.01000000.0000000A.sdmp, certutil.exe, 0000000E.00000002.2673288626.0000000001001000.00000020.00000001.01000000.0000000A.sdmp, certutil.exe, 0000000E.00000000.2669897300.0000000001001000.00000020.00000001.01000000.0000000A.sdmpString found in binary or memory: http://%1/CertEnroll/%3%8%9.crlfile://
Source: iDSBridgeJ.exe, 0000000D.00000003.2723257464.0000000026342000.00000004.00000020.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000003.2725196452.000000002639C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://apache.org/xml/featu
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000005872000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://apache.org/xml/feature
Source: iDSBridgeJ.exe, 0000001F.00000002.2792508765.0000000025A40000.00000004.00000020.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.00000000054FB000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.0000000005417000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.0000000005780000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://apache.org/xml/features/
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000005530000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007913000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000002.3384849193.000000000AB33000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.00000000052F8000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2792508765.0000000025A40000.00000004.00000020.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.00000000054FB000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://apache.org/xml/features/allow-java-encodings
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000005530000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007913000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000002.3384849193.000000000AB33000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.00000000052F8000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2789182107.00000000259B9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://apache.org/xml/features/continue-after-fatal-error
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.000000000544C000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.00000000050A2000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://apache.org/xml/features/create-cdata-nodes
Source: iDSBridgeJ.exe, 0000001F.00000002.2764198138.0000000005417000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://apache.org/xml/features/disallow-doctype-decl
Source: iDSBridgeJ.exe, 0000001F.00000002.2792508765.0000000025A40000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://apache.org/xml/features/disallow-doctype-decl:
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.000000000544C000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.00000000050A2000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://apache.org/xml/features/dom/create-entity-ref-nodes
Source: iDSBridgeJ.exe, 0000001F.00000002.2789182107.00000000259B9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://apache.org/xml/features/dom/create-entity-ref-nodess
Source: iDSBridgeJ.exe, 0000001F.00000002.2764198138.00000000050A2000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://apache.org/xml/features/dom/defer-node-expansion
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.000000000544C000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2789182107.00000000259B9000.00000004.00000020.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.00000000050A2000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://apache.org/xml/features/dom/include-ignorable-whitespace
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000005530000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007913000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.00000000052F8000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2789182107.00000000259B9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://apache.org/xml/features/generate-synthetic-annotations
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000005530000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007913000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.00000000052F8000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2789182107.00000000259B9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://apache.org/xml/features/honour-all-schemaLocations
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.000000000544C000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2792508765.0000000025A40000.00000004.00000020.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.00000000050A2000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://apache.org/xml/features/include-comments
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000005530000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.00000000052F8000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.0000000005210000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.00000000054FB000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://apache.org/xml/features/internal/parser-settings
Source: iDSBridgeJ.exe, 0000001F.00000002.2792508765.0000000025A40000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://apache.org/xml/features/internal/parser-settings%
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000005530000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.00000000052F8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://apache.org/xml/features/internal/validation/schema/use-grammar-pool-only
Source: iDSBridgeJ.exe, 0000001F.00000002.2764198138.00000000052F8000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.0000000005417000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://apache.org/xml/features/nonvalidating/load-external-dtd
Source: iDSBridgeJ.exe, 0000000D.00000003.2727583496.0000000025E3E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://apache.org/xml/features/nonvalidating/load-external-dtdEl
Source: iDSBridgeJ.exe, 0000001F.00000002.2792508765.0000000025A40000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://apache.org/xml/features/nonvalidating/load-external-dtdrcb
Source: iDSBridgeJ.exe, 0000001F.00000002.2764198138.00000000052F8000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.0000000005417000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://apache.org/xml/features/scanner/notify-builtin-refs
Source: iDSBridgeJ.exe, 0000000D.00000003.2727583496.0000000025E3E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://apache.org/xml/features/scanner/notify-builtin-refs(LjavaF
Source: iDSBridgeJ.exe, 0000001F.00000002.2792508765.0000000025A40000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://apache.org/xml/features/scanner/notify-builtin-refsa/lang0
Source: iDSBridgeJ.exe, 0000001F.00000002.2764198138.00000000052F8000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2792508765.0000000025A40000.00000004.00000020.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.00000000053DE000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.0000000005417000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://apache.org/xml/features/scanner/notify-char-refs
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000005530000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007913000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2792508765.0000000025A40000.00000004.00000020.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.00000000054FB000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.00000000053DE000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://apache.org/xml/features/standard-uri-conformant
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000005530000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007913000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.00000000052F8000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2792508765.0000000025A40000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://apache.org/xml/features/validate-annotations
Source: iDSBridgeJ.exe, 0000000D.00000003.2723257464.0000000026342000.00000004.00000020.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000003.2725196452.000000002639C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://apache.org/xml/features/validation/
Source: iDSBridgeJ.exe, 0000001F.00000002.2764198138.00000000053DE000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://apache.org/xml/features/validation/balance-syntax-trees
Source: iDSBridgeJ.exe, 0000000D.00000003.2727583496.0000000025E3E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://apache.org/xml/features/validation/balance-syntax-treesor
Source: iDSBridgeJ.exe, 0000001F.00000002.2792508765.0000000025A40000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://apache.org/xml/features/validation/balance-syntax-treess/
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000005530000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2792508765.0000000025A40000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://apache.org/xml/features/validation/dynamic
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000005530000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.00000000052F8000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2789182107.00000000259B9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://apache.org/xml/features/validation/id-idref-checking
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000005530000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.00000000052F8000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2792508765.0000000025A40000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://apache.org/xml/features/validation/identity-constraint-checking
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.000000000544C000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000005530000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007913000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.00000000052F8000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2792508765.0000000025A40000.00000004.00000020.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.0000000005210000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://apache.org/xml/features/validation/schema
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000005530000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.00000000052F8000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2789182107.00000000259B9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://apache.org/xml/features/validation/schema-full-checking
Source: iDSBridgeJ.exe, 0000001F.00000002.2789182107.00000000259B9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://apache.org/xml/features/validation/schema-full-checkingpX
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000005530000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.00000000052F8000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2789182107.00000000259B9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://apache.org/xml/features/validation/schema/augment-psvi
Source: iDSBridgeJ.exe, 0000001F.00000002.2789182107.00000000259B9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://apache.org/xml/features/validation/schema/augment-psvi$_
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000005530000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.00000000052F8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://apache.org/xml/features/validation/schema/element-default
Source: iDSBridgeJ.exe, 0000001F.00000002.2789182107.00000000259B9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://apache.org/xml/features/validation/schema/element-defaultDXN
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000005530000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.00000000052F8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://apache.org/xml/features/validation/schema/ignore-xsi-type-until-elemdecl
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000005530000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.00000000052F8000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2792508765.0000000025A40000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://apache.org/xml/features/validation/schema/normalized-value
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000005530000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.00000000052F8000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2792508765.0000000025A40000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://apache.org/xml/features/validation/unparsed-entity-checking
Source: iDSBridgeJ.exe, 0000001F.00000002.2792508765.0000000025A40000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://apache.org/xml/features/validation/unparsed-entity-checkingH
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.00000000057AF000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.00000000053DE000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://apache.org/xml/features/validation/warn
Source: iDSBridgeJ.exe, 0000001F.00000002.2764198138.00000000052F8000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2792508765.0000000025A40000.00000004.00000020.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.00000000053DE000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://apache.org/xml/features/validation/warn-on-duplicate-attdef
Source: iDSBridgeJ.exe, 0000001F.00000002.2764198138.00000000052F8000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2792508765.0000000025A40000.00000004.00000020.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.00000000053DE000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://apache.org/xml/features/validation/warn-on-undeclared-elemdef
Source: iDSBridgeJ.exe, 0000001F.00000002.2764198138.00000000052F8000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.00000000054FB000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://apache.org/xml/features/warn-on-duplicate-entitydef
Source: iDSBridgeJ.exe, 0000001F.00000002.2792508765.0000000025A40000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://apache.org/xml/features/warn-on-duplicate-entitydeforg/ap:
Source: iDSBridgeJ.exe, 0000000D.00000003.2727583496.0000000025E3E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://apache.org/xml/features/warn-on-duplicate-entitydeftionIm
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.000000000544C000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.0000000005210000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://apache.org/xml/features/xinclude
Source: iDSBridgeJ.exe, 0000001F.00000002.2792508765.0000000025A40000.00000004.00000020.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.0000000005210000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://apache.org/xml/features/xinclude/fixup-base-uris
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000005641000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000005704000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.00000000052F8000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2792508765.0000000025A40000.00000004.00000020.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.0000000005210000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://apache.org/xml/features/xinclude/fixup-language
Source: iDSBridgeJ.exe, 0000001F.00000002.2789182107.00000000259B9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://apache.org/xml/features/xincludeE
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007A41000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://apache.org/xml/propert
Source: iDSBridgeJ.exe, 0000001F.00000002.2764198138.00000000052F8000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.00000000054FB000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.0000000005417000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.0000000005780000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://apache.org/xml/properties/
Source: iDSBridgeJ.exe, 0000001F.00000002.2764198138.00000000050A2000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://apache.org/xml/properties/dom/current-element-node
Source: iDSBridgeJ.exe, 0000001F.00000002.2789182107.00000000259B9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://apache.org/xml/properties/dom/current-element-node:
Source: iDSBridgeJ.exe, 0000001F.00000002.2764198138.00000000050A2000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://apache.org/xml/properties/dom/document-class-name
Source: iDSBridgeJ.exe, 0000001F.00000002.2792508765.0000000025A40000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://apache.org/xml/properties/er
Source: iDSBridgeJ.exe, 0000001F.00000002.2792508765.0000000025A40000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://apache.org/xml/properties/erxs/i
Source: iDSBridgeJ.exe, 0000001F.00000002.2764198138.00000000054FB000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://apache.org/xml/properties/input-buffer-size
Source: iDSBridgeJ.exe, 0000001F.00000002.2792508765.0000000025A40000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://apache.org/xml/properties/input-buffer-size2
Source: iDSBridgeJ.exe, 0000001F.00000002.2764198138.00000000052F8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://apache.org/xml/properties/internal/datatype-validator-factory
Source: iDSBridgeJ.exe, 0000001F.00000002.2792508765.0000000025A40000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://apache.org/xml/properties/internal/datatype-validator-factory(6
Source: iDSBridgeJ.exe, 0000001F.00000002.2764198138.00000000052F8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://apache.org/xml/properties/internal/document-scanner
Source: iDSBridgeJ.exe, 0000001F.00000002.2792508765.0000000025A40000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://apache.org/xml/properties/internal/document-scannerramete
Source: iDSBridgeJ.exe, 0000001F.00000002.2764198138.00000000052F8000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2792508765.0000000025A40000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://apache.org/xml/properties/internal/dtd-processor
Source: iDSBridgeJ.exe, 0000001F.00000002.2764198138.00000000052F8000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2792508765.0000000025A40000.00000004.00000020.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.0000000005417000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://apache.org/xml/properties/internal/dtd-scanner
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000005530000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000005822000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007913000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000005769000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000002.3384849193.000000000AB33000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.00000000052F8000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.0000000005417000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.0000000005780000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://apache.org/xml/properties/internal/entity-manager
Source: iDSBridgeJ.exe, 0000001F.00000002.2792508765.0000000025A40000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://apache.org/xml/properties/internal/entity-manager4
Source: iDSBridgeJ.exe, 0000001F.00000002.2764198138.00000000050A2000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.00000000053DE000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.0000000005417000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://apache.org/xml/properties/internal/entity-resolver
Source: iDSBridgeJ.exe, 0000001F.00000002.2764198138.00000000050A2000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.00000000053DE000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://apache.org/xml/properties/internal/error-handler
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000005530000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000005822000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007913000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000005769000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000002.3384849193.000000000AB33000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.00000000052F8000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.00000000054FB000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.00000000053DE000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.0000000005417000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.0000000005780000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://apache.org/xml/properties/internal/error-reporter
Source: iDSBridgeJ.exe, 0000001F.00000002.2792508765.0000000025A40000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://apache.org/xml/properties/internal/error-reporterN
Source: iDSBridgeJ.exe, 0000001F.00000002.2764198138.00000000050A2000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.00000000053DE000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://apache.org/xml/properties/internal/grammar-pool
Source: iDSBridgeJ.exe, 0000001F.00000002.2764198138.00000000052F8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://apache.org/xml/properties/internal/namespace-binder
Source: iDSBridgeJ.exe, 0000001F.00000002.2792508765.0000000025A40000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://apache.org/xml/properties/internal/namespace-binderLorg/a&
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000005641000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000002.3384849193.000000000585D000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000005704000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000003.2727583496.0000000025E3E000.00000004.00000020.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.00000000052F8000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.0000000005210000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.0000000005417000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://apache.org/xml/properties/internal/namespace-context
Source: iDSBridgeJ.exe, 0000001F.00000002.2792508765.0000000025A40000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://apache.org/xml/properties/internal/namespace-contexttatio
Source: iDSBridgeJ.exe, 0000001F.00000002.2764198138.00000000050A2000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.00000000053DE000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.0000000005417000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.0000000005780000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://apache.org/xml/properties/internal/symbol-table
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000005530000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000002.3384849193.000000000AB33000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.00000000052F8000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2789182107.00000000259B9000.00000004.00000020.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.00000000054FB000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.0000000005417000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://apache.org/xml/properties/internal/validation-manager
Source: iDSBridgeJ.exe, 0000001F.00000002.2764198138.00000000052F8000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2792508765.0000000025A40000.00000004.00000020.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.00000000053DE000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://apache.org/xml/properties/internal/validator/dtd
Source: iDSBridgeJ.exe, 0000001F.00000002.2792508765.0000000025A40000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://apache.org/xml/properties/internal/validator/dtd0
Source: iDSBridgeJ.exe, 0000001F.00000002.2764198138.00000000052F8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://apache.org/xml/properties/internal/validator/schema
Source: iDSBridgeJ.exe, 0000001F.00000002.2792508765.0000000025A40000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://apache.org/xml/properties/internal/validator/schema/lang/
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000005641000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000005704000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000003.2727583496.0000000025E3E000.00000004.00000020.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.00000000052F8000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2792508765.0000000025A40000.00000004.00000020.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.0000000005210000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://apache.org/xml/properties/internal/xinclude-handler
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000005530000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.00000000052F8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://apache.org/xml/properties/schema/external-noNamespaceSchemaLocation
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000005530000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.00000000052F8000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2789182107.00000000259B9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://apache.org/xml/properties/schema/external-schemaLocation
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.000000000544C000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000002.3384849193.00000000078CB000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007913000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.00000000054FB000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://apache.org/xml/properties/security-manager
Source: iDSBridgeJ.exe, 0000001F.00000002.2792508765.0000000025A40000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://apache.org/xml/properties/validation/schema/root-type-definition
Source: iDSBridgeJ.exe, 0000000D.00000003.2727762557.00000000251A3000.00000004.00000020.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000003.2727762557.00000000251AC000.00000004.00000020.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000003.2727762557.000000002519A000.00000004.00000020.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000004CBD000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2786913062.0000000024DAC000.00000004.00000020.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2786913062.0000000024D69000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://asm.objectweb.org
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.00000000099F8000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000004C00000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://bugreport.sun.com/bugreport/
Source: iDSBridgeJ.exe, 0000000D.00000003.2727762557.00000000251F9000.00000004.00000020.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000004CBD000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://commons.apache.org/collections/
Source: iDSBridgeJ.exe, 0000000D.00000003.2727762557.00000000251F9000.00000004.00000020.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000004CBD000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://commons.apache.org/io/
Source: iDSBridgeJ.exe, 0000000D.00000003.2726225582.0000000025213000.00000004.00000020.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000004CBD000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://commons.apache.org/lang/
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.00000000065AB000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://commons.apache.org/logging/tech.html.
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.00000000065AB000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://commons.apache.org/logging/troubleshooting.html.
Source: iDSBridgeJ.exe, 0000000D.00000003.2727762557.0000000025236000.00000004.00000020.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000004CBD000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2786913062.0000000024E36000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://commons.apache.org/net/
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.000000000658C000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000004CBD000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://commons.apache.org/proper/commons-logging/
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000004D21000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2789182107.00000000256F3000.00000004.00000020.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.0000000004916000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://github.com/FasterXML/jackson
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000008CB2000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000004D75000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000004D90000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000004D21000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.000000000496B000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.0000000004916000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://glassfish.java.net/public/CDDL
Source: iDSBridgeJ.exe, 0000001F.00000002.2764198138.0000000004916000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2789182107.0000000025650000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://hibernate.org
Source: iDSBridgeJ.exe, 0000001F.00000002.2764198138.0000000005AA5000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://jakarta.apache.org/log4j/
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000009DD8000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000002.3384849193.00000000099F8000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000004C00000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://java.oracle.com/
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000005704000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007A41000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000005B8A000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000005EB0000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.00000000052F8000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2789182107.00000000259B9000.00000004.00000020.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2792508765.0000000025A40000.00000004.00000020.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.0000000005780000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://java.sun.com/xml/jaxp/properties/
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.000000000544C000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007046000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000005530000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000002.3384849193.000000000AB33000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.00000000052F8000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2792508765.0000000025A40000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://java.sun.com/xml/jaxp/properties/schemaLanguage
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.00000000078CB000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000005530000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007913000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000002.3384849193.000000000AB33000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.00000000052F8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://java.sun.com/xml/jaxp/properties/schemaSource
Source: iDSBridgeJ.exe, 0000001F.00000002.2792508765.0000000025A40000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://java.sun.com/xml/jaxp/properties/schemaSource/
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.000000000544C000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2792508765.0000000025A40000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://javax.xml.XMLConstants/feature/secure-processing
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000005381000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://logging.apache.org/log
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000005319000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000005302000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000004D90000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://logging.apache.org/log4j/1.2
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000005D2F000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000005EB0000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.0000000005AA5000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.0000000005924000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://logging.apache.org/log4j/1.2/apidocs/org/apache/log4j/xml/doc-files/log4j.dtd
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000005381000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://logging.apache.org/log4j/1.2/faq.html#noconfig
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000005319000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://logging.apache.org/log4j/1.2/faq.html#unload.
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000009795000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000002.3384849193.000000000983C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://mina.apache.org/
Source: iDSBridgeJ.exe, iDSBridgeJ.exe, 0000000D.00000003.2722032873.0000000026224000.00000004.00000020.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000009E67000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000003.2721617661.00000000261EC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://null.sun.com/
Source: iDentalSoftBridgeSetup_12.2.0_x86 (1).exe, 00000000.00000003.2140964625.0000000002330000.00000004.00001000.00020000.00000000.sdmp, iDentalSoftBridgeSetup_12.2.0_x86 (1).exe, 00000000.00000003.2688420496.0000000002088000.00000004.00001000.00020000.00000000.sdmp, iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp, 00000002.00000003.2142961414.0000000002198000.00000004.00001000.00020000.00000000.sdmp, iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp, 00000002.00000003.2679871491.000000000219C000.00000004.00001000.00020000.00000000.sdmp, iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp, 00000002.00000003.2142873948.00000000030F0000.00000004.00001000.00020000.00000000.sdmp, iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp, 00000002.00000003.2681695015.00000000021A0000.00000004.00001000.00020000.00000000.sdmp, iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp, 00000002.00000003.2673913631.0000000002194000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://schemas.microsof
Source: iDSBridgeJ.exe, iDSBridgeJ.exe, 0000000D.00000003.2672302551.0000000025247000.00000004.00000020.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000004D0C000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000003.2726225582.0000000025246000.00000004.00000020.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000003.2724318991.0000000024E47000.00000004.00000020.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2786913062.0000000024E46000.00000004.00000020.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.0000000004902000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://wiki.eclipse.org/
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000004E18000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.0000000004A0E000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://wiki.glassfish.java.net/Wiki.jsp?page=J
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000009795000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000002.3384849193.000000000983C000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000005EB0000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000004D21000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2789182107.0000000025981000.00000004.00000020.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2789182107.0000000025969000.00000004.00000020.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2789182107.00000000257D0000.00000004.00000020.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2789182107.00000000257BB000.00000004.00000020.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2789182107.00000000259B1000.00000004.00000020.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2789182107.00000000256F3000.00000004.00000020.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2789182107.00000000257EA000.00000004.00000020.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2789182107.000000002582B000.00000004.00000020.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2789182107.0000000025842000.00000004.00000020.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2792508765.0000000025A40000.00000004.00000020.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2789182107.00000000257D9000.00000004.00000020.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000003.2729562235.0000000025A93000.00000004.00000020.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.0000000005AA5000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.0000000004916000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2789182107.00000000257C5000.00000004.00000020.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2789182107.0000000025710000.00000004.00000020.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2789182107.0000000025979000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.000000000658C000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000004D21000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000004CBD000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2789182107.00000000256F3000.00000004.00000020.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2786913062.0000000024E36000.00000004.00000020.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2789182107.00000000256EB000.00000004.00000020.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2789182107.0000000025961000.00000004.00000020.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.0000000004916000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.txt
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000004E74000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2789182107.00000000259B9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.cs.princeton.edu/~appel/modern/java/CUP/
Source: iDSBridgeJ.exe, 0000001F.00000002.2789182107.0000000025979000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.eclipse.org/jetty
Source: iDSBridgeJ.exe, iDSBridgeJ.exe, 0000000D.00000003.2723257464.0000000026342000.00000004.00000020.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000003.2725196452.000000002639C000.00000004.00000020.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000002.3384849193.000000000AF39000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.example.org/
Source: iDSBridgeJ.exe, 0000000D.00000003.2723257464.0000000026342000.00000004.00000020.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000003.2725196452.000000002639C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.example.org/-Y
Source: iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp, 00000002.00000003.2673913631.0000000002194000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.identalsoft.com/
Source: iDentalSoftBridgeSetup_12.2.0_x86 (1).exe, 00000000.00000003.2688390187.0000000002081000.00000004.00001000.00020000.00000000.sdmp, iDentalSoftBridgeSetup_12.2.0_x86 (1).exe, 00000000.00000003.2141022035.0000000002081000.00000004.00001000.00020000.00000000.sdmp, iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp, 00000002.00000003.2142961414.0000000002198000.00000004.00001000.00020000.00000000.sdmp, iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp, 00000002.00000003.2681653812.0000000002198000.00000004.00001000.00020000.00000000.sdmp, iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp, 00000002.00000003.2673913631.0000000002194000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.identalsoft.com/&
Source: iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp, iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp, 00000002.00000000.2141721142.0000000000401000.00000020.00000001.01000000.00000004.sdmpString found in binary or memory: http://www.innosetup.com/
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000004D75000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.000000000496B000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2789182107.000000002576A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.jboss.org/jboss-transaction-api_1.1_spec
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000006E86000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2786913062.0000000024D57000.00000004.00000020.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2789182107.0000000025688000.00000004.00000020.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.0000000004916000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2789182107.0000000025690000.00000004.00000020.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2789182107.000000002573D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.oracle.com
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000008CB2000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000004D75000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000004D90000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000004D21000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.000000000496B000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.0000000004916000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.oracle.com/
Source: iDentalSoftBridgeSetup_12.2.0_x86 (1).exe, 00000000.00000003.2141406890.00000000020A0000.00000004.00001000.00020000.00000000.sdmp, iDentalSoftBridgeSetup_12.2.0_x86 (1).exe, 00000000.00000003.2141292235.0000000002330000.00000004.00001000.00020000.00000000.sdmp, iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp, iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp, 00000002.00000000.2141721142.0000000000401000.00000020.00000001.01000000.00000004.sdmpString found in binary or memory: http://www.remobjects.com/ps
Source: iDentalSoftBridgeSetup_12.2.0_x86 (1).exe, 00000000.00000003.2141406890.00000000020A0000.00000004.00001000.00020000.00000000.sdmp, iDentalSoftBridgeSetup_12.2.0_x86 (1).exe, 00000000.00000003.2141292235.0000000002330000.00000004.00001000.00020000.00000000.sdmp, iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp, 00000002.00000000.2141721142.0000000000401000.00000020.00000001.01000000.00000004.sdmpString found in binary or memory: http://www.remobjects.com/psU
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.000000000544C000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000003.2727583496.0000000025E0C000.00000004.00000020.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2789182107.00000000259B9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.saxproject.org/
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.00000000052AD000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2789182107.00000000259B9000.00000004.00000020.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.0000000004E6C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.slf4j.org/codes.html
Source: iDSBridgeJ.exe, 0000001F.00000002.2764198138.0000000004E6C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.slf4j.org/codes.html#StaticLoggerBinder
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000005302000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2786913062.0000000024C60000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.slf4j.org/codes.html#log4j_version
Source: iDSBridgeJ.exe, 0000000D.00000002.3427340039.0000000025060000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.slf4j.org/codes.html#log4j_versionr
Source: iDSBridgeJ.exe, 0000000D.00000002.3427340039.0000000025060000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.slf4j.org/codes.html#log4j_versionrSj
Source: iDSBridgeJ.exe, 0000001F.00000002.2764198138.0000000004E6C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.slf4j.org/codes.html#multiple_bindings
Source: iDSBridgeJ.exe, 0000001F.00000002.2764198138.0000000004E6C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.slf4j.org/codes.html#null_LF
Source: iDSBridgeJ.exe, 0000001F.00000002.2789182107.00000000259B9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.slf4j.org/codes.html#null_LFt
Source: iDSBridgeJ.exe, 0000001F.00000002.2764198138.0000000004E6C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.slf4j.org/codes.html#substituteLogger
Source: iDSBridgeJ.exe, 0000001F.00000002.2764198138.0000000004E6C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.slf4j.org/codes.html#unsuccessfulInit
Source: iDSBridgeJ.exe, 0000001F.00000002.2792508765.0000000025A40000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.slf4j.org/codes.html#unsuccessfulInitO
Source: iDSBridgeJ.exe, 0000001F.00000002.2764198138.0000000004E6C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.slf4j.org/codes.html#version_mismatch
Source: iDSBridgeJ.exe, 0000001F.00000002.2792508765.0000000025A40000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.slf4j.org/codes.html#version_mismatchw
Source: iDSBridgeJ.exe, 0000001F.00000002.2789182107.00000000259B9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.slf4j.org/codes.html-V
Source: iDSBridgeJ.exeString found in binary or memory: http://www.springframework.
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007DA4000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.springframework.or
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007F15000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007DA4000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.springframework.org/
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007DA4000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.springframework.org/sch
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007FAE000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.springframework.org/schema/aop
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007BCF000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.springframework.org/schema/aop/spring-aop-2.0.xsd
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007BCF000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.springframework.org/schema/aop/spring-aop-2.5.xsd
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007BCF000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.springframework.org/schema/aop/spring-aop-3.0.xsd
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007BCF000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.springframework.org/schema/aop/spring-aop-3.1.xsd
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007BCF000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.springframework.org/schema/aop/spring-aop-3.2.xsd
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007BCF000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.springframework.org/schema/aop/spring-aop.xsd
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007E56000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.springframework.org/schema/beans
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007BD5000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.springframework.org/schema/beans/spring-beans-2.0.xsd
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007BD5000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.springframework.org/schema/beans/spring-beans-2.5.xsd
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007BD5000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007BD5000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.springframework.org/schema/beans/spring-beans-3.1.xsd
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007E56000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.springframework.org/schema/beans/spring-beans-3.2.xsd
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007B8E000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007184000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007BD5000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.springframework.org/schema/beans/spring-beans.xsd
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007FB3000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.springframework.org/schema/c
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007FB9000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.springframework.org/schema/cache
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007BD5000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.springframework.org/schema/cache/spring-cache-3.1.xsd
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007BD5000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.springframework.org/schema/cache/spring-cache-3.2.xsd
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007BD5000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.springframework.org/schema/cache/spring-cache.xsd
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007E56000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.springframework.org/schema/context
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007BD5000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.springframework.org/schema/context/spring-context-2.5.xsd
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007BD5000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.springframework.org/schema/context/spring-context-3.0.xsd
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007BD5000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.springframework.org/schema/context/spring-context-3.1.xsd
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007BD5000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.springframework.org/schema/context/spring-context-3.2.xsd
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007B8E000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007184000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007BD5000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.springframework.org/schema/context/spring-context.xsd
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007FBF000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.springframework.org/schema/jdbc
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007BE4000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.springframework.org/schema/jdbc/spring-jdbc-3.0.xsd
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007BE4000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.springframework.org/schema/jdbc/spring-jdbc-3.1.xsd
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007BE4000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.springframework.org/schema/jdbc/spring-jdbc-3.2.xsd
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007BE4000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.springframework.org/schema/jdbc/spring-jdbc.xsd
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007FB9000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.springframework.org/schema/jee
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007BD5000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.springframework.org/schema/jee/spring-jee-2.0.xsd
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007BD5000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.springframework.org/schema/jee/spring-jee-2.5.xsd
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007BD5000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.springframework.org/schema/jee/spring-jee-3.0.xsd
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007BD5000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.springframework.org/schema/jee/spring-jee-3.1.xsd
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007BD5000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.springframework.org/schema/jee/spring-jee-3.2.xsd
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007BD5000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.springframework.org/schema/jee/spring-jee.xsd
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007FB9000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.springframework.org/schema/lang
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007BD5000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.springframework.org/schema/lang/spring-lang-2.0.xsd
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007BD5000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.springframework.org/schema/lang/spring-lang-2.5.xsd
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007BD5000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.springframework.org/schema/lang/spring-lang-3.0.xsd
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007BD5000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.springframework.org/schema/lang/spring-lang-3.1.xsd
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007BD5000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.springframework.org/schema/lang/spring-lang-3.2.xsd
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007BD5000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.springframework.org/schema/lang/spring-lang.xsd
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007FB3000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.springframework.org/schema/p
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007FC5000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.springframework.org/schema/security
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007BEA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.springframework.org/schema/security/spring-security-2.0.1.xsd
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007BEA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.springframework.org/schema/security/spring-security-2.0.2.xsd
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007BEA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.springframework.org/schema/security/spring-security-2.0.4.xsd
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007BEA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.springframework.org/schema/security/spring-security-2.0.xsd
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007BEA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.springframework.org/schema/security/spring-security-3.0.3.xsd
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007BEA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.springframework.org/schema/security/spring-security-3.0.xsd
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007BEA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.springframework.org/schema/security/spring-security-3.1.xsd
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007BEA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.springframework.org/schema/security/spring-security-3.2.xsd
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007BEA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.springframework.org/schema/security/spring-security.xsd
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007FB9000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.springframework.org/schema/task
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007BD5000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.springframework.org/schema/task/spring-task-3.0.xsd
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007BD5000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.springframework.org/schema/task/spring-task-3.1.xsd
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007BD5000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.springframework.org/schema/task/spring-task-3.2.xsd
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007BD5000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.springframework.org/schema/task/spring-task.xsd
Source: iDSBridgeJ.exe, 0000000D.00000003.2727446307.00000000260A2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.springframework.org/schema/tool
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007BD5000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.springframework.org/schema/tool/spring-tool-2.0.xsd
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007BD5000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.springframework.org/schema/tool/spring-tool-2.5.xsd
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007BD5000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.springframework.org/schema/tool/spring-tool-3.0.xsd
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007BD5000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.springframework.org/schema/tool/spring-tool-3.1.xsd
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007E56000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.springframework.org/schema/tool/spring-tool-3.2.xsd
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007BD5000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.springframework.org/schema/tool/spring-tool.xsd
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007184000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.springframework.org/schema/tx
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007BF1000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.springframework.org/schema/tx/spring-tx-2.0.xsd
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007BF1000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.springframework.org/schema/tx/spring-tx-2.5.xsd
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007BF1000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.springframework.org/schema/tx/spring-tx-3.0.xsd
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007BF1000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.springframework.org/schema/tx/spring-tx-3.1.xsd
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007BF1000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.springframework.org/schema/tx/spring-tx-3.2.xsd
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007B8E000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007184000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.springframework.org/schema/tx/spring-tx.xsd
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007FB3000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.springframework.org/schema/util
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007BD5000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.springframework.org/schema/util/spring-util-2.0.xsd
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007BD5000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.springframework.org/schema/util/spring-util-2.5.xsd
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007BD5000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.springframework.org/schema/util/spring-util-3.0.xsd
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007BD5000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.springframework.org/schema/util/spring-util-3.1.xsd
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007BD5000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.springframework.org/schema/util/spring-util-3.2.xsd
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007BD5000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.springframework.org/schema/util/spring-util.xsd
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.000000000544C000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000003.2727583496.0000000025E0C000.00000004.00000020.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2789182107.00000000259B9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.w3c.org/DOM/
Source: iDSBridgeJ.exe, iDSBridgeJ.exe, 0000000D.00000002.3384849193.000000000AE4E000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000002.3384849193.000000000AE70000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000003.2723257464.0000000026342000.00000004.00000020.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000003.2725196452.000000002639C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.xom.nu/fakeRoot
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000004E74000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://xml.apache.
Source: iDSBridgeJ.exe, 0000001F.00000002.2789182107.00000000259B9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://xml.apache.org/
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.000000000544C000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000003.2727583496.0000000025E0C000.00000004.00000020.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2789182107.00000000259B9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://xml.apache.org/commons/
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000004E74000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2789182107.00000000259B9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://xml.apache.org/xalan-j/
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.000000000544C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://xml.apache.org/xerces2-j/
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.000000000887B000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://xml.apache.org/xslt
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007DA4000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000005EB0000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2792508765.0000000025A40000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://xml.org/sax/features/
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000005641000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007DA4000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000005704000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.00000000052F8000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.0000000005210000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://xml.org/sax/features/allow-dtd-events-after-endDTD
Source: iDSBridgeJ.exe, 0000000D.00000003.2727583496.0000000025E3E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://xml.org/sax/features/allow-dtd-events-after-endDTDntNS
Source: iDSBridgeJ.exe, 0000001F.00000002.2792508765.0000000025A40000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://xml.org/sax/features/allow-dtd-events-after-endDTDrg/apac
Source: iDSBridgeJ.exe, 0000001F.00000002.2764198138.00000000052F8000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2792508765.0000000025A40000.00000004.00000020.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.00000000054FB000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://xml.org/sax/features/external-general-entities
Source: iDSBridgeJ.exe, 0000001F.00000002.2764198138.00000000052F8000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2792508765.0000000025A40000.00000004.00000020.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.00000000054FB000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://xml.org/sax/features/external-parameter-entities
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007913000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://xml.org/sax/features/namespace-prefixes
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.000000000544C000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000003.2727583496.0000000025E0C000.00000004.00000020.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000005822000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000002.3384849193.000000000AB33000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.00000000052F8000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2789182107.00000000259B9000.00000004.00000020.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.00000000050A2000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.0000000005417000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://xml.org/sax/features/namespaces
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007913000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://xml.org/sax/features/string-interning
Source: iDSBridgeJ.exe, 0000001F.00000002.2764198138.00000000050A2000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://xml.org/sax/features/use-entity-resolver2
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.000000000544C000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000005530000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000005822000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007913000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000005769000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.00000000052F8000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2789182107.00000000259B9000.00000004.00000020.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.00000000054FB000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.00000000053DE000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.0000000005417000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://xml.org/sax/features/validation
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007DA4000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000005704000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007A41000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000005B8A000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000005EB0000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.00000000052F8000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2792508765.0000000025A40000.00000004.00000020.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.0000000005780000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://xml.org/sax/properties/
Source: iDSBridgeJ.exe, 0000001F.00000002.2792508765.0000000025A40000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://xml.org/sax/properties/b
Source: iDSBridgeJ.exe, 0000000D.00000003.2724650280.0000000026014000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://xml.org/sax/properties/declaration-handler
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007DA4000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://xml.org/sax/properties/dom-node
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007DA4000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://xml.org/sax/properties/lexical-handler
Source: iDSBridgeJ.exe, 0000001F.00000002.2764198138.00000000052F8000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2792508765.0000000025A40000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://xml.org/sax/properties/xml-string
Source: certutil.exeString found in binary or memory: https://%1/CertEnroll/nsrev_%3.asp
Source: certutil.exe, 0000000A.00000000.2665836640.0000000001001000.00000020.00000001.01000000.0000000A.sdmp, certutil.exe, 0000000A.00000002.2668757884.0000000001001000.00000020.00000001.01000000.0000000A.sdmp, certutil.exe, 0000000E.00000002.2673288626.0000000001001000.00000020.00000001.01000000.0000000A.sdmp, certutil.exe, 0000000E.00000000.2669897300.0000000001001000.00000020.00000001.01000000.0000000A.sdmpString found in binary or memory: https://%1/CertEnroll/nsrev_%3.aspldap:///CN=%7%8
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000004D90000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://eclipse.org/jetty
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000004D21000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2789182107.00000000256EB000.00000004.00000020.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.0000000004916000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/FasterXML/jackson-core
Source: iDSBridgeJ.exe, 0000000D.00000003.2726225582.00000000251F1000.00000004.00000020.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000003.2726225582.00000000251DF000.00000004.00000020.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000003.2727762557.00000000251E9000.00000004.00000020.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000004CBD000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2786913062.0000000024DE8000.00000004.00000020.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2786913062.0000000024DF2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/haraldk/TwelveMonkeys/common/co
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000004D21000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2789182107.00000000256D3000.00000004.00000020.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.0000000004916000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/haraldk/TwelveMonkeys/imageio/i
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000004E18000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000004D21000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2789182107.0000000025728000.00000004.00000020.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.0000000004A0E000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.0000000004916000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://glassfish.dev.java.net
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.000000000836F000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000002.3384849193.00000000082AA000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000004E18000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000008377000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000004D21000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2789182107.0000000025728000.00000004.00000020.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.0000000004A0E000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.0000000004916000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2789182107.0000000025718000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://glassfish.dev.java.net/nonav/public/CDDL
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.000000000836F000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000002.3384849193.00000000082AA000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000008377000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000004D21000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.0000000004916000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2789182107.0000000025718000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://glassfish.java.net
Source: iDSBridgeJ.exe, 0000001F.00000002.2764198138.0000000004916000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2789182107.0000000025690000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://glassfish.java.net/nonav/public/CDDL
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000004D21000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.0000000004916000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2789182107.000000002573D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://glassfish.java.net/public/CDDL

E-Banking Fraud

barindex
Registers a new ROOT certificate
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpProcess created: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exe "C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exe" -addstore Root "C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\BridgeSelfCertificate.cer"startup_14
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpProcess created: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exe "C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exe" -addstore Root "C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\BridgeSelfCertificate.cer"b_94062c9bJump to behavior
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_01049178 CertEnumCertificatesInStore,CertCreateCertificateContext,CertAddCertificateContextToStore,CertAddCertificateContextToStore,CertCompareCertificateName,CertOpenStore,CertAddCertificateContextToStore,CertFreeCTLContext,CertCloseStore,10_2_01049178
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\is-DFTCM.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\BridgeSelfCertificate.cer (copy)Jump to dropped file
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_010399A3 CryptAcquireContextW,CryptGetUserKey,CryptGetUserKey,CryptGetUserKey,CryptImportKey,CertFreeCTLContext,CryptReleaseContext,LocalFree,LocalFree,LocalFree,CryptDestroyKey,10_2_010399A3
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_0105488D CryptImportPublicKeyInfo,CryptGenKey,CryptGenRandom,CryptDestroyKey,CryptGetUserKey,CryptImportKey,CryptDestroyKey,CryptDestroyKey,CryptDestroyKey,LocalFree,LocalFree,LocalFree,LocalFree,10_2_0105488D
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_0102D55A LocalAlloc,CryptCreateHash,CryptHashData,CryptGetHashParam,CryptImportKey,CryptSetKeyParam,CryptSetKeyParam,CryptSetKeyParam,CryptCreateHash,CryptHashData,CryptHashData,CryptHashData,CryptGetHashParam,CryptSetKeyParam,LocalFree,LocalFree,LocalFree,LocalFree,CryptDestroyHash,CryptDestroyHash,CryptDestroyHash,10_2_0102D55A
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_0103BC0A CryptAcquireContextW,CryptImportKey,CryptImportKey,CryptImportKey,CertSetCertificateContextProperty,CertAddCertificateContextToStore,LocalFree,LocalFree,CryptDestroyKey,CryptReleaseContext,LocalFree,10_2_0103BC0A
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_01054C84 CryptAcquireContextW,CryptImportKey,CryptDestroyKey,CryptGetUserKey,CryptGetUserKey,CryptGetUserKey,CryptDestroyKey,CryptReleaseContext,CryptAcquireContextW,CryptDestroyKey,CryptReleaseContext,LocalFree,10_2_01054C84
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_0102AFB5 CertAddEncodedCertificateToStore,StringFromCLSID,CryptAcquireContextW,CryptImportKey,CertSetCertificateContextProperty,CryptDestroyKey,CryptReleaseContext,CoTaskMemFree,CertFreeCTLContext,10_2_0102AFB5
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_0105A7CE CryptGetUserKey,CryptReleaseContext,CryptImportKey,LocalFree,CryptDestroyKey,CryptDestroyKey,CryptReleaseContext,CryptDestroyKey,CryptReleaseContext,10_2_0105A7CE
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_0102B693 CryptCreateHash,CryptHashData,CryptGetHashParam,CryptGetUserKey,CryptGetUserKey,CryptGetUserKey,CryptImportKey,CryptDecrypt,CryptDestroyKey,CryptDestroyKey,CryptDestroyHash,LocalFree,CryptDestroyKey,10_2_0102B693
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_010386A0 CertCreateCertificateContext,CryptAcquireContextW,CryptImportKey,CertFreeCTLContext,LocalFree,CryptDestroyKey,CryptReleaseContext,10_2_010386A0
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_010396EC CryptImportKey,CryptSetKeyParam,LocalFree,CertFreeCTLContext,CryptDestroyKey,10_2_010396EC
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpCode function: 2_2_00423B84 NtdllDefWindowProc_A,2_2_00423B84
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpCode function: 2_2_004125D8 NtdllDefWindowProc_A,2_2_004125D8
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpCode function: 2_2_004785E0 NtdllDefWindowProc_A,2_2_004785E0
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpCode function: 2_2_004573E0 PostMessageA,PostMessageA,SetForegroundWindow,NtdllDefWindowProc_A,2_2_004573E0
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpCode function: 2_2_0042F520 NtdllDefWindowProc_A,2_2_0042F520
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\iDentalSoft-Bridge.exeCode function: 8_2_00404D5A GetWindowLongA,CallWindowProcA,RemovePropA,RemovePropA,RemovePropA,RevokeDragDrop,SetWindowLongA,NtdllDefWindowProc_A,8_2_00404D5A
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\iDentalSoft-Bridge.exeCode function: 8_2_00409901 sprintf,GetPropA,HeapFree,HeapFree,HeapFree,RemovePropA,CallWindowProcA,NtdllDefWindowProc_A,8_2_00409901
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\iDentalSoft-Bridge.exeCode function: 8_2_004061E3 GetPropA,DefFrameProcA,SetLastError,NtdllDefWindowProc_A,8_2_004061E3
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_0106B253 NtQuerySystemTime,RtlTimeToSecondsSince1970,10_2_0106B253
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpCode function: 2_2_0042E934: CreateFileA,DeviceIoControl,GetLastError,CloseHandle,SetLastError,2_2_0042E934
Source: C:\Users\user\Desktop\iDentalSoftBridgeSetup_12.2.0_x86 (1).exeCode function: 0_2_00409448 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,0_2_00409448
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpCode function: 2_2_004555E4 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,2_2_004555E4
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeFile created: C:\Windows\certutil.logJump to behavior
Source: C:\Users\user\Desktop\iDentalSoftBridgeSetup_12.2.0_x86 (1).exeCode function: 0_2_0040840C0_2_0040840C
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpCode function: 2_2_004804DB2_2_004804DB
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpCode function: 2_2_0047051C2_2_0047051C
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpCode function: 2_2_004672182_2_00467218
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpCode function: 2_2_0048D9F02_2_0048D9F0
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpCode function: 2_2_0043035C2_2_0043035C
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpCode function: 2_2_004444C82_2_004444C8
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpCode function: 2_2_004345C42_2_004345C4
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpCode function: 2_2_004866B42_2_004866B4
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpCode function: 2_2_00444A702_2_00444A70
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpCode function: 2_2_00430EE82_2_00430EE8
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpCode function: 2_2_0045EF382_2_0045EF38
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpCode function: 2_2_0045AFC42_2_0045AFC4
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpCode function: 2_2_004451682_2_00445168
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpCode function: 2_2_004692782_2_00469278
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpCode function: 2_2_004352C82_2_004352C8
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpCode function: 2_2_004455742_2_00445574
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpCode function: 2_2_004876142_2_00487614
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpCode function: 2_2_004519BC2_2_004519BC
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpCode function: 2_2_0043DD502_2_0043DD50
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\iDentalSoft-Bridge.exeCode function: 8_2_0040E2BA8_2_0040E2BA
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\iDentalSoft-Bridge.exeCode function: 8_2_00407D108_2_00407D10
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\iDentalSoft-Bridge.exeCode function: 8_2_00407FC08_2_00407FC0
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_0104C16710_2_0104C167
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_0101C99410_2_0101C994
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_0106987010_2_01069870
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_0104521D10_2_0104521D
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_01068DB010_2_01068DB0
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_01067CA010_2_01067CA0
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_0106878010_2_01068780
Source: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ.exeCode function: 13_3_262E578C13_3_262E578C
Source: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ.exeCode function: 13_3_262E578C13_3_262E578C
Source: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ.exeCode function: 13_3_262E578C13_3_262E578C
Source: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ.exeCode function: 13_3_262E578C13_3_262E578C
Source: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ.exeCode function: 13_3_262E578C13_3_262E578C
Source: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ.exeCode function: 13_3_262E578C13_3_262E578C
Source: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ.exeCode function: 13_3_262E578C13_3_262E578C
Source: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ.exeCode function: 13_3_262E578C13_3_262E578C
Source: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ.exeCode function: 13_3_262E578C13_3_262E578C
Source: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ.exeCode function: 13_3_262E578C13_3_262E578C
Source: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ.exeCode function: 13_3_2632F6EB13_3_2632F6EB
Source: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ.exeCode function: 13_3_2632F6EB13_3_2632F6EB
Source: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ.exeCode function: 13_3_2632F6EB13_3_2632F6EB
Source: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ.exeCode function: 13_3_2632F6EB13_3_2632F6EB
Source: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ.exeCode function: 13_3_2632E5EF13_3_2632E5EF
Source: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ.exeCode function: 13_3_2632E5EF13_3_2632E5EF
Source: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ.exeCode function: 13_3_2632E5EF13_3_2632E5EF
Source: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ.exeCode function: 13_3_2632E5EF13_3_2632E5EF
Source: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ.exeCode function: 13_3_262E578C13_3_262E578C
Source: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ.exeCode function: 13_3_262E578C13_3_262E578C
Source: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ.exeCode function: 13_3_262E578C13_3_262E578C
Source: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ.exeCode function: 13_3_262E578C13_3_262E578C
Source: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ.exeCode function: 13_3_262E578C13_3_262E578C
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpCode function: String function: 00408C0C appears 45 times
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpCode function: String function: 00406AC4 appears 43 times
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpCode function: String function: 0040595C appears 117 times
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpCode function: String function: 00403400 appears 60 times
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpCode function: String function: 00445DD4 appears 45 times
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpCode function: String function: 004344DC appears 32 times
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpCode function: String function: 004078F4 appears 42 times
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpCode function: String function: 00457D6C appears 73 times
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpCode function: String function: 00403494 appears 82 times
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpCode function: String function: 00403684 appears 224 times
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpCode function: String function: 00457B60 appears 97 times
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpCode function: String function: 00453344 appears 94 times
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpCode function: String function: 004460A4 appears 59 times
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: String function: 6F33D1A3 appears 37 times
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: String function: 6F339AB0 appears 34 times
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: String function: 01056431 appears 303 times
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: String function: 0101B5B1 appears 41 times
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: String function: 0104EEF2 appears 43 times
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: String function: 01051224 appears 64 times
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: String function: 6F335B80 appears 40 times
Source: iDentalSoftBridgeSetup_12.2.0_x86 (1).exeStatic PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp.0.drStatic PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp.0.drStatic PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Source: iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp.0.drStatic PE information: Resource name: RT_VERSION type: 370 sysV pure executable not stripped
Source: is-37ER4.tmp.2.drStatic PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: is-37ER4.tmp.2.drStatic PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Source: is-37ER4.tmp.2.drStatic PE information: Resource name: RT_VERSION type: 370 sysV pure executable not stripped
Source: iDentalSoftBridgeSetup_12.2.0_x86 (1).exe, 00000000.00000003.2141406890.00000000020A0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameshfolder.dll~/ vs iDentalSoftBridgeSetup_12.2.0_x86 (1).exe
Source: iDentalSoftBridgeSetup_12.2.0_x86 (1).exe, 00000000.00000003.2141292235.0000000002330000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameshfolder.dll~/ vs iDentalSoftBridgeSetup_12.2.0_x86 (1).exe
Source: iDentalSoftBridgeSetup_12.2.0_x86 (1).exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
Source: is-JSVPI.tmp.2.drStatic PE information: Section: .MPRESS1 ZLIB complexity 1.00078125
Source: classification engineClassification label: sus32.bank.evad.winEXE@39/799@0/1
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_0106B36C wcscmp,wcscmp,wcscmp,FreeLibrary,wcscpy,LoadLibraryExW,FormatMessageW,FormatMessageW,GetLastError,_itoa,FormatMessageW,WideCharToMultiByte,GetLastError,10_2_0106B36C
Source: C:\Users\user\Desktop\iDentalSoftBridgeSetup_12.2.0_x86 (1).exeCode function: 0_2_00409448 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,0_2_00409448
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpCode function: 2_2_004555E4 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,2_2_004555E4
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_0105C79B GetCurrentThread,OpenThreadToken,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,CloseHandle,CloseHandle,CloseHandle,10_2_0105C79B
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpCode function: 2_2_00455E0C GetModuleHandleA,GetProcAddress,GetDiskFreeSpaceExA,GetDiskFreeSpaceA,2_2_00455E0C
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpCode function: 2_2_00456564 CoCreateInstance,CoCreateInstance,SysFreeString,SysFreeString,2_2_00456564
Source: C:\Users\user\Desktop\iDentalSoftBridgeSetup_12.2.0_x86 (1).exeCode function: 0_2_00409BEC FindResourceA,SizeofResource,LoadResource,LockResource,0_2_00409BEC
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft BridgeJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Users\user\AppData\Local\ProgramsJump to behavior
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5348:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2144:120:WilError_03
Source: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ.exeMutant created: NULL
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6948:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4048:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2716:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6864:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2632:120:WilError_03
Source: C:\Users\user\Desktop\iDentalSoftBridgeSetup_12.2.0_x86 (1).exeFile created: C:\Users\user\AppData\Local\Temp\is-O58FB.tmpJump to behavior
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\iDentalSoft-Bridge.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\3F88.tmp\iDental-Agent.bat""
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCommand line argument: .OCP10_2_0101C824
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCommand line argument: +certutil.log10_2_0101C824
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCommand line argument: certutil.exe10_2_0101C824
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCommand line argument: CertUtilApp10_2_0101C824
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCommand line argument: CertUtilApp10_2_0101C824
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCommand line argument: certutil.exe10_2_0101C824
Source: C:\Windows\SysWOW64\taskkill.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "iDSBridgeNative.exe")
Source: C:\Windows\SysWOW64\tasklist.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile read: C:\Windows\win.iniJump to behavior
Source: C:\Users\user\Desktop\iDentalSoftBridgeSetup_12.2.0_x86 (1).exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganizationJump to behavior
Source: iDSBridgeJ.exeString found in binary or memory: ;q(Lorg/springframework/instrument/classloading/LoadTimeWeaver;)V
Source: iDSBridgeJ.exeString found in binary or memory: 7--launcher.openFile /SWTINTERNAL_ID
Source: C:\Users\user\Desktop\iDentalSoftBridgeSetup_12.2.0_x86 (1).exeFile read: C:\Users\user\Desktop\iDentalSoftBridgeSetup_12.2.0_x86 (1).exeJump to behavior
Source: unknownProcess created: C:\Users\user\Desktop\iDentalSoftBridgeSetup_12.2.0_x86 (1).exe "C:\Users\user\Desktop\iDentalSoftBridgeSetup_12.2.0_x86 (1).exe"
Source: C:\Users\user\Desktop\iDentalSoftBridgeSetup_12.2.0_x86 (1).exeProcess created: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp "C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp" /SL5="$2040C,76918457,64512,C:\Users\user\Desktop\iDentalSoftBridgeSetup_12.2.0_x86 (1).exe"
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpProcess created: C:\Program Files (x86)\iDentalSoft Bridge\bin\iDentalSoft-Bridge.exe "C:\Program Files (x86)\iDentalSoft Bridge\bin\iDentalSoft-Bridge.exe"
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\iDentalSoft-Bridge.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpProcess created: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exe "C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exe" -delstore Root localgateway.iDentalSoft
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\iDentalSoft-Bridge.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\3F88.tmp\iDental-Agent.bat""
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ.exe "C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ" -Xss1m -Xms512M -Xmx512M -XX:MaxPermSize=256M -cp "C:\Program Files (x86)\iDentalSoft Bridge\iDentalSoftBridge.jar";etc\ com.iss.idental.bridge.main.BridgeApplicationMain
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpProcess created: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exe "C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exe" -addstore Root "C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\BridgeSelfCertificate.cer"
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ.exeProcess created: C:\Windows\SysWOW64\icacls.exe icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
Source: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ.exeProcess created: C:\Windows\SysWOW64\icacls.exe icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage\bf02f2a4d931bd0.timestamp /grant "everyone":(OI)(CI)M
Source: C:\Windows\SysWOW64\icacls.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\icacls.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ.exeProcess created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM iDSBridgeNative.exe
Source: C:\Windows\SysWOW64\taskkill.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ.exeProcess created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\tasklist.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\Program Files (x86)\iDentalSoft Bridge\bin\iDentalSoft-Bridge.exe "C:\Program Files (x86)\iDentalSoft Bridge\bin\iDentalSoft-Bridge.exe"
Source: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ.exeProcess created: C:\Program Files (x86)\iDentalSoft Bridge\iDSBridgeNative.exe "C:\Program Files (x86)\iDentalSoft Bridge\iDSBridgeNative.exe"
Source: unknownProcess created: C:\Program Files (x86)\iDentalSoft Bridge\bin\iDentalSoft-Bridge.exe "C:\Program Files (x86)\iDentalSoft Bridge\bin\iDentalSoft-Bridge.exe"
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\iDentalSoft-Bridge.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\iDentalSoft-Bridge.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\5504.tmp\iDental-Agent.bat""
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ.exe "C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ" -Xss1m -Xms512M -Xmx512M -XX:MaxPermSize=256M -cp "C:\Program Files (x86)\iDentalSoft Bridge\iDentalSoftBridge.jar";etc\ com.iss.idental.bridge.main.BridgeApplicationMain
Source: C:\Users\user\Desktop\iDentalSoftBridgeSetup_12.2.0_x86 (1).exeProcess created: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp "C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp" /SL5="$2040C,76918457,64512,C:\Users\user\Desktop\iDentalSoftBridgeSetup_12.2.0_x86 (1).exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpProcess created: C:\Program Files (x86)\iDentalSoft Bridge\bin\iDentalSoft-Bridge.exe "C:\Program Files (x86)\iDentalSoft Bridge\bin\iDentalSoft-Bridge.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpProcess created: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exe "C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exe" -delstore Root localgateway.iDentalSoftJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpProcess created: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exe "C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exe" -addstore Root "C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\BridgeSelfCertificate.cer"Jump to behavior
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\iDentalSoft-Bridge.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\3F88.tmp\iDental-Agent.bat""Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ.exe "C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ" -Xss1m -Xms512M -Xmx512M -XX:MaxPermSize=256M -cp "C:\Program Files (x86)\iDentalSoft Bridge\iDentalSoftBridge.jar";etc\ com.iss.idental.bridge.main.BridgeApplicationMainJump to behavior
Source: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ.exeProcess created: C:\Windows\SysWOW64\icacls.exe icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)MJump to behavior
Source: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ.exeProcess created: C:\Windows\SysWOW64\icacls.exe icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage\bf02f2a4d931bd0.timestamp /grant "everyone":(OI)(CI)MJump to behavior
Source: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ.exeProcess created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM iDSBridgeNative.exeJump to behavior
Source: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ.exeProcess created: C:\Windows\SysWOW64\tasklist.exe tasklistJump to behavior
Source: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ.exeProcess created: C:\Program Files (x86)\iDentalSoft Bridge\iDSBridgeNative.exe "C:\Program Files (x86)\iDentalSoft Bridge\iDSBridgeNative.exe"Jump to behavior
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\iDentalSoft-Bridge.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\5504.tmp\iDental-Agent.bat""
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ.exe "C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ" -Xss1m -Xms512M -Xmx512M -XX:MaxPermSize=256M -cp "C:\Program Files (x86)\iDentalSoft Bridge\iDentalSoftBridge.jar";etc\ com.iss.idental.bridge.main.BridgeApplicationMain
Source: C:\Users\user\Desktop\iDentalSoftBridgeSetup_12.2.0_x86 (1).exeSection loaded: apphelp.dllJump to behavior
Source: C:\Users\user\Desktop\iDentalSoftBridgeSetup_12.2.0_x86 (1).exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpSection loaded: apphelp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpSection loaded: mpr.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpSection loaded: version.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpSection loaded: textinputframework.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpSection loaded: coreuicomponents.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpSection loaded: coremessaging.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpSection loaded: ntmarta.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpSection loaded: wldp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpSection loaded: profapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpSection loaded: shfolder.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpSection loaded: rstrtmgr.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpSection loaded: ncrypt.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpSection loaded: ntasn1.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpSection loaded: textshaping.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpSection loaded: riched20.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpSection loaded: usp10.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpSection loaded: msls31.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpSection loaded: explorerframe.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpSection loaded: sfc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpSection loaded: sfc_os.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpSection loaded: propsys.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpSection loaded: linkinfo.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpSection loaded: ntshrui.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpSection loaded: srvcli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpSection loaded: cscapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpSection loaded: edputil.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpSection loaded: urlmon.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpSection loaded: iertutil.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpSection loaded: netutils.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpSection loaded: windows.staterepositoryps.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpSection loaded: appresolver.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpSection loaded: bcp47langs.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpSection loaded: slc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpSection loaded: userenv.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpSection loaded: sppc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpSection loaded: onecorecommonproxystub.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpSection loaded: onecoreuapcommonproxystub.dllJump to behavior
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\iDentalSoft-Bridge.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\iDentalSoft-Bridge.exeSection loaded: msimg32.dllJump to behavior
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\iDentalSoft-Bridge.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\iDentalSoft-Bridge.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\iDentalSoft-Bridge.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeSection loaded: certadm.dllJump to behavior
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeSection loaded: certcli.dllJump to behavior
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeSection loaded: atl.dllJump to behavior
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeSection loaded: certcli.dllJump to behavior
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeSection loaded: cryptnet.dllJump to behavior
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeSection loaded: cryptui.dllJump to behavior
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeSection loaded: netapi32.dllJump to behavior
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeSection loaded: ntdsapi.dllJump to behavior
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeSection loaded: secur32.dllJump to behavior
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeSection loaded: atl.dllJump to behavior
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeSection loaded: cryptui.dllJump to behavior
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeSection loaded: netapi32.dllJump to behavior
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeSection loaded: secur32.dllJump to behavior
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeSection loaded: version.dllJump to behavior
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeSection loaded: wininet.dllJump to behavior
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeSection loaded: winscard.dllJump to behavior
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeSection loaded: devobj.dllJump to behavior
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeSection loaded: dsrole.dllJump to behavior
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeSection loaded: logoncli.dllJump to behavior
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeSection loaded: logoncli.dllJump to behavior
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeSection loaded: samcli.dllJump to behavior
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeSection loaded: netutils.dllJump to behavior
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: cmdext.dllJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ.exeSection loaded: wsock32.dllJump to behavior
Source: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ.exeSection loaded: winmm.dllJump to behavior
Source: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ.exeSection loaded: version.dllJump to behavior
Source: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ.exeSection loaded: wldp.dllJump to behavior
Source: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ.exeSection loaded: profapi.dllJump to behavior
Source: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ.exeSection loaded: userenv.dllJump to behavior
Source: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ.exeSection loaded: dpapi.dllJump to behavior
Source: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ.exeSection loaded: dhcpcsvc6.dllJump to behavior
Source: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ.exeSection loaded: dhcpcsvc.dllJump to behavior
Source: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ.exeSection loaded: usp10.dllJump to behavior
Source: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ.exeSection loaded: wininet.dllJump to behavior
Source: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ.exeSection loaded: propsys.dllJump to behavior
Source: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeSection loaded: certadm.dll
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeSection loaded: certcli.dll
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeSection loaded: cryptnet.dll
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeSection loaded: cryptui.dll
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeSection loaded: netapi32.dll
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeSection loaded: ntdsapi.dll
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeSection loaded: secur32.dll
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeSection loaded: version.dll
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeSection loaded: wininet.dll
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeSection loaded: winscard.dll
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeSection loaded: atl.dll
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeSection loaded: certcli.dll
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeSection loaded: atl.dll
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeSection loaded: cryptui.dll
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeSection loaded: netapi32.dll
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeSection loaded: secur32.dll
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeSection loaded: devobj.dll
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeSection loaded: logoncli.dll
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeSection loaded: dsrole.dll
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeSection loaded: samcli.dll
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeSection loaded: srvcli.dll
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeSection loaded: netutils.dll
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeSection loaded: netutils.dll
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeSection loaded: sspicli.dll
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeSection loaded: sspicli.dll
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeSection loaded: uxtheme.dll
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeSection loaded: msasn1.dll
Source: C:\Windows\SysWOW64\icacls.exeSection loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\icacls.exeSection loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: profapi.dll
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: version.dll
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: mpr.dll
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: framedynos.dll
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: sspicli.dll
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: srvcli.dll
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: netutils.dll
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: sspicli.dll
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: winsta.dll
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: amsi.dll
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: userenv.dll
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: profapi.dll
Source: C:\Program Files (x86)\iDentalSoft Bridge\iDSBridgeNative.exeSection loaded: apphelp.dll
Source: C:\Program Files (x86)\iDentalSoft Bridge\iDSBridgeNative.exeSection loaded: bridgenative.dll
Source: C:\Program Files (x86)\iDentalSoft Bridge\iDSBridgeNative.exeSection loaded: bridgecommon.dll
Source: C:\Program Files (x86)\iDentalSoft Bridge\iDSBridgeNative.exeSection loaded: msvcp140.dll
Source: C:\Program Files (x86)\iDentalSoft Bridge\iDSBridgeNative.exeSection loaded: vcruntime140.dll
Source: C:\Program Files (x86)\iDentalSoft Bridge\iDSBridgeNative.exeSection loaded: bridgecommon.dll
Source: C:\Program Files (x86)\iDentalSoft Bridge\iDSBridgeNative.exeSection loaded: mfc140.dll
Source: C:\Program Files (x86)\iDentalSoft Bridge\iDSBridgeNative.exeSection loaded: msvcp140.dll
Source: C:\Program Files (x86)\iDentalSoft Bridge\iDSBridgeNative.exeSection loaded: vcruntime140.dll
Source: C:\Program Files (x86)\iDentalSoft Bridge\iDSBridgeNative.exeSection loaded: msvcp100.dll
Source: C:\Program Files (x86)\iDentalSoft Bridge\iDSBridgeNative.exeSection loaded: msvcr100.dll
Source: C:\Program Files (x86)\iDentalSoft Bridge\iDSBridgeNative.exeSection loaded: msvcr100.dll
Source: C:\Program Files (x86)\iDentalSoft Bridge\iDSBridgeNative.exeSection loaded: uxtheme.dll
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\iDentalSoft-Bridge.exeSection loaded: msimg32.dll
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\iDentalSoft-Bridge.exeSection loaded: uxtheme.dll
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\iDentalSoft-Bridge.exeSection loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\iDentalSoft-Bridge.exeSection loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: cmdext.dll
Source: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ.exeSection loaded: wsock32.dll
Source: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ.exeSection loaded: winmm.dll
Source: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ.exeSection loaded: version.dll
Source: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ.exeSection loaded: windows.storage.dll
Source: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ.exeSection loaded: wldp.dll
Source: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ.exeSection loaded: profapi.dll
Source: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ.exeSection loaded: mswsock.dll
Source: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ.exeSection loaded: usp10.dll
Source: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ.exeSection loaded: wininet.dll
Source: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ.exeSection loaded: uxtheme.dll
Source: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ.exeSection loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ.exeSection loaded: propsys.dll
Source: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ.exeSection loaded: textshaping.dll
Source: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ.exeSection loaded: textinputframework.dll
Source: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ.exeSection loaded: coreuicomponents.dll
Source: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ.exeSection loaded: coremessaging.dll
Source: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ.exeSection loaded: ntmarta.dll
Source: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ.exeSection loaded: coremessaging.dll
Source: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ.exeSection loaded: wintypes.dll
Source: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ.exeSection loaded: wintypes.dll
Source: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ.exeSection loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32Jump to behavior
Source: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ.exeProcess created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwnerJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpWindow found: window name: TMainFormJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpAutomated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpAutomated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpAutomated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpAutomated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpAutomated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpAutomated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpAutomated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpAutomated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpAutomated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpAutomated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpAutomated click: Install
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpAutomated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpAutomated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpAutomated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpAutomated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpAutomated click: I accept the agreement
Source: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ.exeAutomated click: OK
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: iDentalSoftBridgeSetup_12.2.0_x86 (1).exeStatic PE information: certificate valid
Source: iDentalSoftBridgeSetup_12.2.0_x86 (1).exeStatic file information: File size 77230776 > 1048576
Source: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ.exeFile opened: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\msvcr100.dllJump to behavior
Source: Binary string: certadm.pdb source: certutil.exe, certutil.exe, 0000000A.00000002.2669008237.000000006F331000.00000020.00000001.01000000.0000000C.sdmp, certutil.exe, 0000000E.00000002.2673574475.000000006F331000.00000020.00000001.01000000.0000000C.sdmp
Source: Binary string: msvcp100.i386.pdb source: iDSBridgeNative.exe, 0000001A.00000002.3386023496.000000006D3A1000.00000020.00000001.01000000.0000001C.sdmp
Source: Binary string: vcruntime140.i386.pdb source: iDSBridgeNative.exe, 0000001A.00000002.3386869503.000000006E941000.00000020.00000001.01000000.0000001A.sdmp
Source: Binary string: vcruntime140.i386.pdbGCTL source: iDSBridgeNative.exe, 0000001A.00000002.3386869503.000000006E941000.00000020.00000001.01000000.0000001A.sdmp
Source: Binary string: msvcr100.i386.pdb source: iDSBridgeNative.exe, 0000001A.00000002.3385289449.000000006D2E1000.00000020.00000001.01000000.0000001D.sdmp
Source: Binary string: certcli.pdb source: certutil.exe, certutil.exe, 0000000A.00000002.2669135112.0000000077B91000.00000020.00000001.01000000.0000000D.sdmp, certutil.exe, 0000000E.00000002.2673731472.0000000077B91000.00000020.00000001.01000000.0000000D.sdmp
Source: Binary string: c:\workspace\8-2-build-windows-i586-cygwin\jdk8u121\8372\build\windows-i586\jdk\objs\libnet\net.pdb source: iDSBridgeJ.exe, 0000001F.00000002.2795083135.000000006C46D000.00000002.00000001.01000000.00000013.sdmp
Source: Binary string: mfc140.i386.pdbGCTL source: iDSBridgeNative.exe, 0000001A.00000002.3382093677.000000006C621000.00000020.00000001.01000000.0000001E.sdmp
Source: Binary string: mfc140.i386.pdb source: iDSBridgeNative.exe, 0000001A.00000002.3382093677.000000006C621000.00000020.00000001.01000000.0000001E.sdmp
Source: Binary string: msvcp140.i386.pdbGCTL source: iDSBridgeNative.exe, 0000001A.00000002.3386386581.000000006E831000.00000020.00000001.01000000.0000001B.sdmp
Source: Binary string: D:\IDS_workspace\source\7.1.0\dependencies\BridgeNative\bin\Release\x86\iDSBridgeNative.pdb source: iDSBridgeNative.exe, 0000001A.00000000.2714981155.0000000000A66000.00000002.00000001.01000000.00000017.sdmp, iDSBridgeNative.exe, 0000001A.00000002.3381003468.0000000000A66000.00000002.00000001.01000000.00000017.sdmp
Source: Binary string: D:\IDS_workspace\source\7.1.0\dependencies\BridgeNative\bin\Release\x86\BridgeNative.pdb source: iDSBridgeNative.exe, 0000001A.00000002.3387598309.0000000073888000.00000002.00000001.01000000.00000018.sdmp
Source: Binary string: certutil.pdb source: certutil.exe, certutil.exe, 0000000A.00000000.2665836640.0000000001001000.00000020.00000001.01000000.0000000A.sdmp, certutil.exe, 0000000A.00000002.2668757884.0000000001001000.00000020.00000001.01000000.0000000A.sdmp, certutil.exe, 0000000E.00000002.2673288626.0000000001001000.00000020.00000001.01000000.0000000A.sdmp, certutil.exe, 0000000E.00000000.2669897300.0000000001001000.00000020.00000001.01000000.0000000A.sdmp
Source: Binary string: c:\workspace\8-2-build-windows-i586-cygwin\jdk8u121\8372\build\windows-i586\jdk\objs\libnet\net.pdby source: iDSBridgeJ.exe, 0000001F.00000002.2795083135.000000006C46D000.00000002.00000001.01000000.00000013.sdmp
Source: Binary string: D:\IDS_workspace\source\7.1.0\dependencies\BridgeNative\bin\Release\x86\iDSBridgeNative.pdb'' source: iDSBridgeNative.exe, 0000001A.00000000.2714981155.0000000000A66000.00000002.00000001.01000000.00000017.sdmp, iDSBridgeNative.exe, 0000001A.00000002.3381003468.0000000000A66000.00000002.00000001.01000000.00000017.sdmp
Source: Binary string: msvcp140.i386.pdb source: iDSBridgeNative.exe, 0000001A.00000002.3386386581.000000006E831000.00000020.00000001.01000000.0000001B.sdmp
Source: Binary string: D:\IDS_workspace\source\7.1.0\dependencies\BridgeNative\bin\Release\x86\BridgeNative.pdb-- source: iDSBridgeNative.exe, 0000001A.00000002.3387598309.0000000073888000.00000002.00000001.01000000.00000018.sdmp
Source: Binary string: c:\workspace\8-2-build-windows-i586-cygwin\jdk8u121\8372\build\windows-i586\jdk\objs\libzip\zip.pdb source: iDSBridgeJ.exe, 0000001F.00000002.2793202587.000000006BE9A000.00000002.00000001.01000000.00000012.sdmp
Source: Binary string: c:\workspace\8-2-build-windows-i586-cygwin\jdk8u121\8372\build\windows-i586\jdk\objs\javaw_objs\javaw.pdb source: iDSBridgeJ.exe, 0000000D.00000000.2667545211.0000000000B3C000.00000002.00000001.01000000.0000000B.sdmp, iDSBridgeJ.exe, 0000000D.00000002.3380614378.0000000000B3C000.00000002.00000001.01000000.0000000B.sdmp, iDSBridgeJ.exe, 0000001F.00000000.2721460854.0000000000B3C000.00000002.00000001.01000000.0000000B.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2763260153.0000000000B3C000.00000002.00000001.01000000.0000000B.sdmp

Data Obfuscation

barindex
Detected unpacking (changes PE section rights)
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\iDentalSoft-Bridge.exeUnpacked PE file: 8.2.iDentalSoft-Bridge.exe.400000.0.unpack .MPRESS1:EW;.MPRESS2:EW;.rsrc:W; vs .MPRESS1:ER;.MPRESS2:ER;.rsrc:W;
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\iDentalSoft-Bridge.exeUnpacked PE file: 28.2.iDentalSoft-Bridge.exe.400000.0.unpack .MPRESS1:EW;.MPRESS2:EW;.rsrc:W; vs .MPRESS1:ER;.MPRESS2:ER;.rsrc:W;
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpCode function: 2_2_004502C0 GetVersion,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,2_2_004502C0
Source: initial sampleStatic PE information: section where entry point is pointing to: .MPRESS2
Source: is-JSVPI.tmp.2.drStatic PE information: section name: .MPRESS1
Source: is-JSVPI.tmp.2.drStatic PE information: section name: .MPRESS2
Source: C:\Users\user\Desktop\iDentalSoftBridgeSetup_12.2.0_x86 (1).exeCode function: 0_2_004065C8 push 00406605h; ret 0_2_004065FD
Source: C:\Users\user\Desktop\iDentalSoftBridgeSetup_12.2.0_x86 (1).exeCode function: 0_2_004040B5 push eax; ret 0_2_004040F1
Source: C:\Users\user\Desktop\iDentalSoftBridgeSetup_12.2.0_x86 (1).exeCode function: 0_2_00408104 push ecx; mov dword ptr [esp], eax0_2_00408109
Source: C:\Users\user\Desktop\iDentalSoftBridgeSetup_12.2.0_x86 (1).exeCode function: 0_2_00404185 push 00404391h; ret 0_2_00404389
Source: C:\Users\user\Desktop\iDentalSoftBridgeSetup_12.2.0_x86 (1).exeCode function: 0_2_00404206 push 00404391h; ret 0_2_00404389
Source: C:\Users\user\Desktop\iDentalSoftBridgeSetup_12.2.0_x86 (1).exeCode function: 0_2_0040C218 push eax; ret 0_2_0040C219
Source: C:\Users\user\Desktop\iDentalSoftBridgeSetup_12.2.0_x86 (1).exeCode function: 0_2_004042E8 push 00404391h; ret 0_2_00404389
Source: C:\Users\user\Desktop\iDentalSoftBridgeSetup_12.2.0_x86 (1).exeCode function: 0_2_00404283 push 00404391h; ret 0_2_00404389
Source: C:\Users\user\Desktop\iDentalSoftBridgeSetup_12.2.0_x86 (1).exeCode function: 0_2_00408F38 push 00408F6Bh; ret 0_2_00408F63
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpCode function: 2_2_0040994C push 00409989h; ret 2_2_00409981
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpCode function: 2_2_00483A6C push 00483B7Ah; ret 2_2_00483B72
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpCode function: 2_2_004062B4 push ecx; mov dword ptr [esp], eax2_2_004062B5
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpCode function: 2_2_004104E0 push ecx; mov dword ptr [esp], edx2_2_004104E5
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpCode function: 2_2_0049481C push ecx; mov dword ptr [esp], ecx2_2_00494821
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpCode function: 2_2_00412928 push 0041298Bh; ret 2_2_00412983
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpCode function: 2_2_0040CE38 push ecx; mov dword ptr [esp], edx2_2_0040CE3A
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpCode function: 2_2_0048515C push ecx; mov dword ptr [esp], ecx2_2_00485161
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpCode function: 2_2_00459120 push 00459164h; ret 2_2_0045915C
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpCode function: 2_2_0040F398 push ecx; mov dword ptr [esp], edx2_2_0040F39A
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpCode function: 2_2_00443440 push ecx; mov dword ptr [esp], ecx2_2_00443444
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpCode function: 2_2_0040546D push eax; ret 2_2_004054A9
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpCode function: 2_2_0040553D push 00405749h; ret 2_2_00405741
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpCode function: 2_2_004055BE push 00405749h; ret 2_2_00405741
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpCode function: 2_2_00477628 push ecx; mov dword ptr [esp], edx2_2_00477629
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpCode function: 2_2_0040563B push 00405749h; ret 2_2_00405741
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpCode function: 2_2_004056A0 push 00405749h; ret 2_2_00405741
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpCode function: 2_2_004517F8 push 0045182Bh; ret 2_2_00451823
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpCode function: 2_2_004519BC push ecx; mov dword ptr [esp], eax2_2_004519C1
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpCode function: 2_2_0045FB90 push ecx; mov dword ptr [esp], ecx2_2_0045FB94
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpCode function: 2_2_00419C28 push ecx; mov dword ptr [esp], ecx2_2_00419C2D
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpCode function: 2_2_00499D1C pushad ; retf 2_2_00499D2B
Source: is-JSVPI.tmp.2.drStatic PE information: section name: .MPRESS1 entropy: 7.9919065689091715

Persistence and Installation Behavior

barindex
Installs new ROOT certificates
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeRegistry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\68E3FE56532941E5707231791F8D4A173146399D Blob
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\msvcp140.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-TJRKV.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\msvcr100.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\msvcr120.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-EC551.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\iDSBridgeNative.exe (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\npt.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-8R81H.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\jpeg.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\mfc100.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\sunmscapi.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\dt_shmem.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\is-AJT9U.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\javafx_font_t2k.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\javacpl.exe (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\t2k.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-16G4J.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\mfc140.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\is-4RUAM.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\JAWTAccessBridge-32.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\jdwp.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\iDSBridgeNativex64.exe (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\net.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-OU1MJ.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certreq.exe (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-DFA5D.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ.exe (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\lcms.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\msvcp100.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSDashboard.exe (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-BB5PB.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\plugin2\is-U4PV7.tmpJump to dropped file
Source: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ.exeFile created: C:\Users\user\.swt\lib\win32\x86\swt-win32-4332.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\sunec.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-0UFA0.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\prism_d3d.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-03IUI.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\dtplugin\npdeployJava1.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-E34MU.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\dtplugin\is-MJAQO.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\prism_common.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-GPUOT.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\is-QSGEK.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\resource.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\is-UPF22.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\java.exe (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\java-rmi.exe (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\is-DQA0M.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-8B5J9.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-9044A.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\jp2launcher.exe (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Users\user\AppData\Local\Temp\is-NQDF9.tmp\_isetup\_shfoldr.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\jfr.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-EK3KP.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\jp2iexp.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\vcruntime140.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\client\is-CPU5F.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\ktab.exe (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\nio.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\JavaDDE.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-RLB9D.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\jp2native.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\WindowsAccessBridge-32.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\jsoundds.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\decora_sse.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\javaw.exe (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\ssv.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-1SFSS.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\is-IH3MV.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-6SK0G.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-RHOV8.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\java_crw_demo.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-81F63.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\client\jvm.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-80MMG.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\is-87KCD.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\rmiregistry.exe (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-V5RFN.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\dt_socket.dll (copy)Jump to dropped file
Source: C:\Users\user\Desktop\iDentalSoftBridgeSetup_12.2.0_x86 (1).exeFile created: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-C8J3S.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-K7HEV.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-PP5E3.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-NLQ51.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\is-PK7TM.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-ERD4S.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-TES04.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\is-JCHHI.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\java.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-4957E.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\management.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\rmid.exe (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\is-T8PP8.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-3C7AJ.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\dtplugin\deployJava1.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\is-9G93M.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\verify.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-IFNEP.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-1ILMQ.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\BridgeCommonx64.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\iDentalSoft-Bridge.exe (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-3G5EA.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\zip.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\tnameserv.exe (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-8S5P9.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exe (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSJ.exe (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\is-KL3FJ.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-H4RTI.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\JavaDDEx64.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-K3O7L.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\is-37ER4.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-DDN6J.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-1S91F.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\is-635B0.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\kinit.exe (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\BridgeNative.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-THDCJ.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\TWAINDSM.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\w2k_lsa_auth.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\javafx_iio.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-6PM4K.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-IPPDT.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\glib-lite.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\jjs.exe (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\hprof.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\jp2ssv.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\jli.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\servertool.exe (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-8SMD0.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-PH1HN.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\javafx_font.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-P7IK9.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\mlib_image.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSCompressorJ.exe (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-5IL4D.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\BridgeCommon.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\is-6BR1D.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\jsdt.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\wsdetect.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\gstreamer-lite.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-QTFL4.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\plugin2\msvcr100.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\ssvagent.exe (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\is-R217A.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\glass.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\splashscreen.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-JJBC3.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\j2pkcs11.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-C36CL.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\unins000.exe (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\is-CK4OJ.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\TwainJNIx64.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\jsound.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-70VRK.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Users\user\AppData\Local\Temp\is-NQDF9.tmp\_isetup\_setup64.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\orbd.exe (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-J3KRM.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-E7OLP.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-GAQUC.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\dcpr.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-QGJIJ.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-64C6H.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\is-Q1K3O.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\bin\is-JHDPG.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\deploy.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\msvcp120.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-H1N8H.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-S1BEV.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-RUP3V.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certadm.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-55073.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\javaws.exe (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\jawt.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-O8F6O.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\is-7HAU4.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certcli.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-33NBO.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\awt.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\j2pcsc.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-RRNSM.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\TWAINDSMx64.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-QTCMC.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\instrument.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-U9P83.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-4LN6F.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\dtplugin\is-BK5HC.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-GO27Q.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-Q65KF.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\pack200.exe (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\fxplugins.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\is-RQ9QA.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\unpack.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\jaas_nt.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\fontmanager.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-2C49U.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\keytool.exe (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\unpack200.exe (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\is-JSVPI.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-C2SKN.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-L4EVF.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\TwainJNI.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-K28U7.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-D65PD.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-QBLLD.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-GTIIP.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\is-7J5B1.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-RFJLV.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\javacpl.cpl (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-BSD0S.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\is-D18FS.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-1SC48.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\jfxmedia.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\jfxwebkit.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-TTFAR.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-4MQ70.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\bin\iDentalSoft-Bridge.exe (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\prism_sw.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-133N7.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\kcms.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-P9TA9.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-U5GQQ.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-E9ND9.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\is-81VOH.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-RODTM.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\eula.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\plugin2\is-JD61V.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\msvcr100.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSClientJ.exe (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-L256E.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-E01S9.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\BridgeNativex64.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\jabswitch.exe (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\plugin2\npjp2.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-AN89T.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-1K2V4.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-BSU7H.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\klist.exe (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-IDVTK.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\policytool.exe (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\bci.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-RR4DS.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\JavaAccessBridge-32.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-G9F45.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iDentalSoft BridgeJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iDentalSoft Bridge\iDentalSoft Bridge.lnkJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpFile created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iDentalSoft Bridge\iDentalSoft Bridge Uninstall.lnkJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpRegistry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run iDentalSoft-BridgeJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpRegistry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run iDentalSoft-BridgeJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpCode function: 2_2_0042285C SendMessageA,ShowWindow,ShowWindow,CallWindowProcA,SendMessageA,ShowWindow,SetWindowPos,GetActiveWindow,IsIconic,SetWindowPos,SetActiveWindow,ShowWindow,2_2_0042285C
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpCode function: 2_2_00423C0C IsIconic,PostMessageA,PostMessageA,PostMessageA,SendMessageA,IsWindowEnabled,IsWindowEnabled,IsWindowVisible,GetFocus,SetFocus,SetFocus,IsIconic,GetFocus,SetFocus,2_2_00423C0C
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpCode function: 2_2_00423C0C IsIconic,PostMessageA,PostMessageA,PostMessageA,SendMessageA,IsWindowEnabled,IsWindowEnabled,IsWindowVisible,GetFocus,SetFocus,SetFocus,IsIconic,GetFocus,SetFocus,2_2_00423C0C
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpCode function: 2_2_004241DC IsIconic,SetActiveWindow,SetFocus,2_2_004241DC
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpCode function: 2_2_00424194 IsIconic,SetActiveWindow,2_2_00424194
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpCode function: 2_2_00418384 IsIconic,GetWindowPlacement,GetWindowRect,GetWindowLongA,GetWindowLongA,ScreenToClient,ScreenToClient,2_2_00418384
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpCode function: 2_2_00483420 IsIconic,GetWindowLongA,ShowWindow,ShowWindow,2_2_00483420
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpCode function: 2_2_00417598 IsIconic,GetCapture,2_2_00417598
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpCode function: 2_2_00417CCE IsIconic,SetWindowPos,2_2_00417CCE
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpCode function: 2_2_00417CD0 IsIconic,SetWindowPos,GetWindowPlacement,SetWindowPlacement,2_2_00417CD0
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpCode function: 2_2_0041F118 GetVersion,SetErrorMode,LoadLibraryA,SetErrorMode,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,2_2_0041F118
Source: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ.exeProcess created: C:\Windows\SysWOW64\icacls.exe icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
Source: C:\Users\user\Desktop\iDentalSoftBridgeSetup_12.2.0_x86 (1).exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\iDentalSoft-Bridge.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\taskkill.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\tasklist.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\iDentalSoft Bridge\iDSBridgeNative.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\iDentalSoft Bridge\iDSBridgeNative.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\iDentalSoft Bridge\iDSBridgeNative.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\iDentalSoft-Bridge.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ.exeCode function: 13_3_26224000 sldt word ptr [eax]13_3_26224000
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\msvcr120.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-TJRKV.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-EC551.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\npt.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-8R81H.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\jpeg.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\sunmscapi.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\mfc100.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\dt_shmem.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\javafx_font_t2k.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\javacpl.exe (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\t2k.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-16G4J.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\JAWTAccessBridge-32.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\jdwp.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\is-4RUAM.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\net.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\iDSBridgeNativex64.exe (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-OU1MJ.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certreq.exe (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\lcms.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-DFA5D.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-BB5PB.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\plugin2\is-U4PV7.tmpJump to dropped file
Source: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ.exeDropped PE file which has not been started: C:\Users\user\.swt\lib\win32\x86\swt-win32-4332.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\sunec.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-0UFA0.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\prism_d3d.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-03IUI.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\dtplugin\npdeployJava1.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\dtplugin\is-MJAQO.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\prism_common.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-E34MU.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\is-QSGEK.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\resource.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\java.exe (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\is-UPF22.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\java-rmi.exe (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\is-DQA0M.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-9044A.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\jp2launcher.exe (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-8B5J9.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-NQDF9.tmp\_isetup\_shfoldr.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\jfr.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-EK3KP.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\jp2iexp.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\nio.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\ktab.exe (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\client\is-CPU5F.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\JavaDDE.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\jp2native.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-RLB9D.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\WindowsAccessBridge-32.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\jsoundds.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\decora_sse.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\ssv.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-1SFSS.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\is-IH3MV.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-6SK0G.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-RHOV8.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\java_crw_demo.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\client\jvm.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-81F63.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-80MMG.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\rmiregistry.exe (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\is-87KCD.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-V5RFN.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\dt_socket.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-C8J3S.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-K7HEV.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-NLQ51.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\is-PK7TM.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-ERD4S.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-TES04.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\is-JCHHI.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\java.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-4957E.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\management.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\rmid.exe (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\is-T8PP8.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-3C7AJ.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\dtplugin\deployJava1.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\is-9G93M.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\verify.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-IFNEP.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-1ILMQ.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\BridgeCommonx64.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-3G5EA.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\zip.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\tnameserv.exe (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-8S5P9.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\is-KL3FJ.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-H4RTI.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\JavaDDEx64.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-K3O7L.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\is-37ER4.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-DDN6J.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-1S91F.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\is-635B0.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\kinit.exe (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\TWAINDSM.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-THDCJ.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\w2k_lsa_auth.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\javafx_iio.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-6PM4K.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-IPPDT.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\jjs.exe (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\glib-lite.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\jp2ssv.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\hprof.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\jli.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\servertool.exe (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-8SMD0.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-PH1HN.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\javafx_font.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\mlib_image.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\jsdt.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\wsdetect.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\gstreamer-lite.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-QTFL4.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\ssvagent.exe (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\is-R217A.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\glass.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\splashscreen.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\j2pkcs11.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-C36CL.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\unins000.exe (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\is-CK4OJ.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\TwainJNIx64.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\jsound.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-NQDF9.tmp\_isetup\_setup64.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-70VRK.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\orbd.exe (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-J3KRM.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-E7OLP.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-GAQUC.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\dcpr.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-64C6H.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-QGJIJ.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\is-Q1K3O.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\deploy.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\msvcp120.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-H1N8H.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-S1BEV.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-RUP3V.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-55073.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\javaws.exe (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\jawt.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-O8F6O.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\is-7HAU4.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-33NBO.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\j2pcsc.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\awt.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\TWAINDSMx64.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\instrument.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-QTCMC.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-U9P83.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-4LN6F.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\dtplugin\is-BK5HC.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-GO27Q.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-Q65KF.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\pack200.exe (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\fxplugins.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\is-RQ9QA.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\unpack.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\jaas_nt.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\fontmanager.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-2C49U.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\keytool.exe (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\unpack200.exe (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-C2SKN.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\TwainJNI.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-L4EVF.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-K28U7.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-D65PD.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-QBLLD.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-GTIIP.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\is-7J5B1.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-RFJLV.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\javacpl.cpl (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-BSD0S.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\is-D18FS.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-1SC48.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\jfxmedia.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\jfxwebkit.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-TTFAR.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-4MQ70.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\prism_sw.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-133N7.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\kcms.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-P9TA9.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-E9ND9.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-U5GQQ.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\is-81VOH.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-RODTM.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\eula.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\plugin2\is-JD61V.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-L256E.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-E01S9.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\BridgeNativex64.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\jabswitch.exe (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\plugin2\npjp2.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-AN89T.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-1K2V4.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-BSU7H.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\klist.exe (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-IDVTK.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\policytool.exe (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\bci.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-RR4DS.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\JavaAccessBridge-32.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpDropped PE file which has not been started: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-G9F45.tmpJump to dropped file
Source: C:\Users\user\Desktop\iDentalSoftBridgeSetup_12.2.0_x86 (1).exeEvasive API call chain: GetSystemTime,DecisionNodesgraph_0-5542
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeAPI coverage: 1.8 %
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_0102BAF4 GetSystemTime followed by cmp: cmp word ptr [ebp+3eh], cx and CTI: jbe 0102BC3Fh10_2_0102BAF4
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpCode function: 2_2_00452A60 FindFirstFileA,GetLastError,2_2_00452A60
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpCode function: 2_2_00474DFC FindFirstFileA,FindNextFileA,FindClose,2_2_00474DFC
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpCode function: 2_2_004625C4 FindFirstFileA,FindNextFileA,FindClose,2_2_004625C4
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpCode function: 2_2_00463B50 SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,SetErrorMode,2_2_00463B50
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpCode function: 2_2_00497C14 FindFirstFileA,SetFileAttributesA,FindNextFileA,FindClose,2_2_00497C14
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpCode function: 2_2_00463FCC SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,SetErrorMode,2_2_00463FCC
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_0105B191 FindFirstFileW,LocalFree,FindNextFileW,FindClose,LocalFree,10_2_0105B191
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_010501C5 wcslen,LocalAlloc,wcscpy,wcscpy,wcsrchr,FindFirstFileW,wcscpy,lstrcmpW,lstrcmpW,DeleteFileW,FindNextFileW,FindClose,LocalFree,LocalFree,LocalFree,10_2_010501C5
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_0105902A wcslen,wcscpy,wcscat,FindFirstFileW,FindNextFileW,FindClose,10_2_0105902A
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_0105A048 FindFirstFileW,FindNextFileW,FindClose,LocalFree,10_2_0105A048
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_010590DE wcslen,wcscpy,wcscpy,wcscat,FindFirstFileW,wcslen,wcscpy,DeleteFileW,FindNextFileW,FindClose,10_2_010590DE
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_0105AA90 wcslen,wcslen,wcscpy,wcscat,wcscat,wcscat,FindFirstFileW,FindNextFileW,wcslen,wcscpy,FindClose,wcslen,wcslen,LocalAlloc,wcscpy,wcscat,wcscat,10_2_0105AA90
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_0105960F wcschr,wcslen,wcscpy,wcscat,FindFirstFileW,wcslen,wcscpy,wcsrchr,_wcsnicmp,iswxdigit,wcstoul,FindNextFileW,LocalFree,LocalFree,LocalFree,FindClose,10_2_0105960F
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_6F338862 WritePrivateProfileStringW,wcscpy,wsprintfW,wcscpy,wcschr,RegQueryValueExW,wcscpy,wcsrchr,FindFirstFileW,wcstoul,wcscpy,DeleteFileW,FindNextFileW,LocalFree,LocalFree,LocalFree,LocalFree,FindClose,10_2_6F338862
Source: C:\Users\user\Desktop\iDentalSoftBridgeSetup_12.2.0_x86 (1).exeCode function: 0_2_00409B30 GetSystemInfo,VirtualQuery,VirtualProtect,VirtualProtect,VirtualQuery,0_2_00409B30
Source: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ.exeFile opened: C:\Users\user\.swt\lib\win32\Jump to behavior
Source: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ.exeFile opened: C:\Users\user\.swt\lib\win32\x86\Jump to behavior
Source: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ.exeFile opened: C:\Users\user\.swt\lib\win32\x86\swt-win32-4332.dllJump to behavior
Source: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ.exeFile opened: C:\Users\user\.swt\Jump to behavior
Source: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ.exeFile opened: C:\Users\user\Jump to behavior
Source: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ.exeFile opened: C:\Users\user\.swt\lib\Jump to behavior
Source: iDSBridgeJ.exe, 0000000D.00000003.2668355442.000000002506E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: com/sun/corba/se/impl/util/SUNVMCID.classPK
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.00000000065AB000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: java/lang/VirtualMachineError
Source: iDSBridgeJ.exe, 0000000D.00000003.2668355442.000000002506E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: %com/sun/corba/se/impl/util/SUNVMCID.classPK
Source: iDSBridgeJ.exe, 0000000D.00000003.2668355442.000000002506E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: org/omg/CORBA/OMGVMCID.classPK
Source: iDSBridgeJ.exe, 0000000D.00000002.3382842253.0000000002965000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 6aq[Ljava/lang/VirtualMachineError;
Source: iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp, 00000002.00000002.2685002468.000000000071E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\s
Source: iDSBridgeJ.exe, 0000000D.00000002.3382842253.0000000002965000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: cjava/lang/VirtualMachineError
Source: iDSBridgeJ.exe, 0000000D.00000002.3384849193.00000000065AB000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: java.lang.VirtualMachineError
Source: iDSBridgeJ.exe, 0000000D.00000003.2668355442.000000002506E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: java/lang/VirtualMachineError.classPK
Source: iDSBridgeJ.exe, 0000000D.00000002.3381174499.0000000000C38000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpProcess information queried: ProcessInformationJump to behavior
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_77BA14E7 #203,GetLastError,#205,_vsnprintf,_snprintf,EnterCriticalSection,IsDebuggerPresent,GetStdHandle,_iob,_iob,fflush,fflush,OutputDebugStringA,LeaveCriticalSection,SetLastError,10_2_77BA14E7
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_77BA14E7 #203,GetLastError,#205,_vsnprintf,_snprintf,EnterCriticalSection,IsDebuggerPresent,GetStdHandle,_iob,_iob,fflush,fflush,OutputDebugStringA,LeaveCriticalSection,SetLastError,10_2_77BA14E7
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpCode function: 2_2_004502C0 GetVersion,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,2_2_004502C0
Source: C:\Windows\SysWOW64\taskkill.exeProcess token adjusted: Debug
Source: C:\Windows\SysWOW64\tasklist.exeProcess token adjusted: Debug
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\iDentalSoft-Bridge.exeCode function: 8_2_00404210 SetUnhandledExceptionFilter,8_2_00404210
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\iDentalSoft-Bridge.exeCode function: 8_2_004040C0 SetUnhandledExceptionFilter,SetUnhandledExceptionFilter,SetUnhandledExceptionFilter,8_2_004040C0
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_010478B9 SetUnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,10_2_010478B9
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_6F339880 SetUnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,10_2_6F339880
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_77B9F7CD #14,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,10_2_77B9F7CD
Source: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ.exeMemory protected: page read and write | page guardJump to behavior

HIPS / PFW / Operating System Protection Evasion

barindex
Contains functionality to prevent local Windows debugging
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_77BA0C49 #201,IsDebuggerPresent,DebugBreak,10_2_77BA0C49
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpCode function: 2_2_00478024 ShellExecuteEx,GetLastError,MsgWaitForMultipleObjects,GetExitCodeProcess,CloseHandle,2_2_00478024
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpProcess created: C:\Program Files (x86)\iDentalSoft Bridge\bin\iDentalSoft-Bridge.exe "C:\Program Files (x86)\iDentalSoft Bridge\bin\iDentalSoft-Bridge.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpProcess created: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exe "C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exe" -delstore Root localgateway.iDentalSoftJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpProcess created: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exe "C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exe" -addstore Root "C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\BridgeSelfCertificate.cer"Jump to behavior
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\iDentalSoft-Bridge.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\3F88.tmp\iDental-Agent.bat""Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ.exe "C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ" -Xss1m -Xms512M -Xmx512M -XX:MaxPermSize=256M -cp "C:\Program Files (x86)\iDentalSoft Bridge\iDentalSoftBridge.jar";etc\ com.iss.idental.bridge.main.BridgeApplicationMainJump to behavior
Source: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ.exeProcess created: C:\Windows\SysWOW64\icacls.exe icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)MJump to behavior
Source: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ.exeProcess created: C:\Windows\SysWOW64\icacls.exe icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage\bf02f2a4d931bd0.timestamp /grant "everyone":(OI)(CI)MJump to behavior
Source: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ.exeProcess created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM iDSBridgeNative.exeJump to behavior
Source: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ.exeProcess created: C:\Windows\SysWOW64\tasklist.exe tasklistJump to behavior
Source: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ.exeProcess created: C:\Program Files (x86)\iDentalSoft Bridge\iDSBridgeNative.exe "C:\Program Files (x86)\iDentalSoft Bridge\iDSBridgeNative.exe"Jump to behavior
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\iDentalSoft-Bridge.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\5504.tmp\iDental-Agent.bat""
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ.exe "C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ" -Xss1m -Xms512M -Xmx512M -XX:MaxPermSize=256M -cp "C:\Program Files (x86)\iDentalSoft Bridge\iDentalSoftBridge.jar";etc\ com.iss.idental.bridge.main.BridgeApplicationMain
Source: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ.exeProcess created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM iDSBridgeNative.exeJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpCode function: 2_2_0042E09C AllocateAndInitializeSid,GetVersion,GetModuleHandleA,GetProcAddress,CheckTokenMembership,GetCurrentThread,OpenThreadToken,GetLastError,GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetLastError,GetTokenInformation,EqualSid,CloseHandle,FreeSid,2_2_0042E09C
Source: C:\Users\user\Desktop\iDentalSoftBridgeSetup_12.2.0_x86 (1).exeCode function: GetLocaleInfoA,0_2_0040520C
Source: C:\Users\user\Desktop\iDentalSoftBridgeSetup_12.2.0_x86 (1).exeCode function: GetLocaleInfoA,0_2_00405258
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpCode function: GetLocaleInfoA,2_2_00408568
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpCode function: GetLocaleInfoA,2_2_004085B4
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ.exeQueries volume information: C:\Program Files (x86)\iDentalSoft Bridge\iDentalSoftBridge.lck VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpCode function: 2_2_00458418 GetTickCount,QueryPerformanceCounter,GetSystemTimeAsFileTime,GetCurrentProcessId,CreateNamedPipeA,GetLastError,CreateFileA,SetNamedPipeHandleState,CreateProcessA,CloseHandle,CloseHandle,2_2_00458418
Source: C:\Users\user\Desktop\iDentalSoftBridgeSetup_12.2.0_x86 (1).exeCode function: 0_2_004026C4 GetSystemTime,0_2_004026C4
Source: C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmpCode function: 2_2_0045559C GetUserNameA,2_2_0045559C
Source: C:\Users\user\Desktop\iDentalSoftBridgeSetup_12.2.0_x86 (1).exeCode function: 0_2_00405CF4 GetVersionExA,0_2_00405CF4
Source: C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_0101FB0D DsGetDcNameW,DsBindW,DsCrackNamesW,wcslen,wcslen,wcslen,wcslen,wcslen,LocalAlloc,wsprintfW,DsUnBindW,NetApiBufferFree,DsFreeNameResultW,LocalFree,LocalFree,LocalFree,10_2_0101FB0D
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_01020FFF wcschr,NetApiBufferFree,DsFreeNameResultW,#13,LocalFree,DsGetDcNameW,DsBindW,DsCrackNamesW,#145,#14,#73,#208,#26,#127,LocalFree,#140,#224,#167,#27,#224,#224,#41,NetApiBufferFree,DsUnBindW,DsFreeNameResultW,#13,LocalFree,10_2_01020FFF
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_77B9BDE1 RpcBindingFree,10_2_77B9BDE1
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_77B9BD1A wcslen,RpcNetworkIsProtseqValidW,RpcStringBindingComposeW,RpcBindingFromStringBindingW,RpcStringFreeW,RpcEpResolveBinding,RpcStringFreeW,10_2_77B9BD1A
Source: C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exeCode function: 10_2_77B9BC85 RpcMgmtInqServerPrincNameW,RpcBindingSetAuthInfoW,RpcStringFreeW,10_2_77B9BC85

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity Information1
Scripting		Valid Accounts1
Windows Management Instrumentation		1
Scripting		1
Exploitation for Privilege Escalation		11
Disable or Modify Tools		OS Credential Dumping11
System Time Discovery		Remote Services11
Archive Collected Data		1
Ingress Tool Transfer		Exfiltration Over Other Network Medium1
Data Encrypted for Impact
CredentialsDomainsDefault Accounts2
Native API		1
DLL Side-Loading		1
DLL Side-Loading		1
Deobfuscate/Decode Files or Information		LSASS Memory1
Account Discovery		Remote Desktop ProtocolData from Removable Media2
Encrypted Channel		Exfiltration Over Bluetooth1
System Shutdown/Reboot
Email AddressesDNS ServerDomain Accounts3
Command and Scripting Interpreter		11
Registry Run Keys / Startup Folder		1
Access Token Manipulation		4
Obfuscated Files or Information		Security Account Manager3
File and Directory Discovery		SMB/Windows Admin SharesData from Network Shared DriveSteganographyAutomated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCron1
Services File Permissions Weakness		112
Process Injection		2
Install Root Certificate		NTDS27
System Information Discovery		Distributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon Script11
Registry Run Keys / Startup Folder		12
Software Packing		LSA Secrets21
Security Software Discovery		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC Scripts1
Services File Permissions Weakness		1
DLL Side-Loading		Cached Domain Credentials1
Virtualization/Sandbox Evasion		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items12
Masquerading		DCSync2
Process Discovery		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job1
Virtualization/Sandbox Evasion		Proc Filesystem1
Application Window Discovery		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt1
Access Token Manipulation		/etc/passwd and /etc/shadow3
System Owner/User Discovery		Direct Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement
IP AddressesCompromise InfrastructureSupply Chain CompromisePowerShellCronCron112
Process Injection		Network SniffingNetwork Service DiscoveryShared WebrootLocal Data StagingFile Transfer ProtocolsExfiltration Over Asymmetric Encrypted Non-C2 ProtocolExternal Defacement
Network Security AppliancesDomainsCompromise Software Dependencies and Development ToolsAppleScriptLaunchdLaunchd1
Services File Permissions Weakness		Input CaptureSystem Network Connections DiscoverySoftware Deployment ToolsRemote Data StagingMail ProtocolsExfiltration Over Unencrypted Non-C2 ProtocolFirmware Corruption

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1525215 Sample: iDentalSoftBridgeSetup_12.2... Startdate: 03/10/2024 Architecture: WINDOWS Score: 32 77 Detected unpacking (changes PE section rights) 2->77 79 Registers a new ROOT certificate 2->79 81 Sigma detected: System File Execution Location Anomaly 2->81 83 Contains functionality to prevent local Windows debugging 2->83 11 iDentalSoftBridgeSetup_12.2.0_x86 (1).exe 2 2->11         started        14 iDentalSoft-Bridge.exe 2->14         started        16 iDentalSoft-Bridge.exe 2->16         started        process3 file4 71 iDentalSoftBridgeS..._12.2.0_x86 (1).tmp, PE32 11->71 dropped 18 iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp 28 435 11->18         started        22 cmd.exe 14->22         started        24 conhost.exe 14->24         started        process5 file6 63 C:\...\iDentalSoft-Bridge.exe (copy), MS-DOS 18->63 dropped 65 C:\...\certutil.exe (copy), PE32 18->65 dropped 67 C:\Users\user\AppData\Local\...\_shfoldr.dll, PE32 18->67 dropped 69 239 other files (none is malicious) 18->69 dropped 85 Registers a new ROOT certificate 18->85 26 certutil.exe 18->26         started        29 iDentalSoft-Bridge.exe 4 18->29         started        31 certutil.exe 2 18->31         started        33 iDSBridgeJ.exe 22->33         started        signatures7 process8 signatures9 87 Installs new ROOT certificates 26->87 35 conhost.exe 26->35         started        37 cmd.exe 1 29->37         started        39 conhost.exe 29->39         started        41 conhost.exe 31->41         started        process10 process11 43 iDSBridgeJ.exe 38 37->43         started        dnsIp12 75 127.0.0.1 unknown unknown 43->75 73 C:\Users\user\.swt\lib\...\swt-win32-4332.dll, PE32 43->73 dropped 47 icacls.exe 43->47         started        49 icacls.exe 43->49         started        51 taskkill.exe 43->51         started        53 2 other processes 43->53 file13 process14 process15 55 conhost.exe 47->55         started        57 conhost.exe 49->57         started        59 conhost.exe 51->59         started        61 conhost.exe 53->61         started       

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

⊘No Antivirus matches

Dropped Files

SourceDetectionScannerLabelLink
C:\Program Files (x86)\iDentalSoft Bridge\JavaDDE.dll (copy)0%ReversingLabs
C:\Program Files (x86)\iDentalSoft Bridge\JavaDDEx64.dll (copy)0%ReversingLabs
C:\Program Files (x86)\iDentalSoft Bridge\TWAINDSMx64.dll (copy)0%ReversingLabs
C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certadm.dll (copy)0%ReversingLabs
C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certcli.dll (copy)0%ReversingLabs
C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certreq.exe (copy)2%ReversingLabs
C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exe (copy)0%ReversingLabs
C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\is-635B0.tmp2%ReversingLabs
C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\is-9G93M.tmp0%ReversingLabs
C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\is-AJT9U.tmp0%ReversingLabs
C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\is-D18FS.tmp0%ReversingLabs
C:\Program Files (x86)\iDentalSoft Bridge\is-37ER4.tmp5%ReversingLabs
C:\Program Files (x86)\iDentalSoft Bridge\is-4RUAM.tmp0%ReversingLabs
C:\Program Files (x86)\iDentalSoft Bridge\is-7J5B1.tmp0%ReversingLabs
C:\Program Files (x86)\iDentalSoft Bridge\is-81VOH.tmp2%ReversingLabs
C:\Program Files (x86)\iDentalSoft Bridge\is-87KCD.tmp2%ReversingLabs
C:\Program Files (x86)\iDentalSoft Bridge\is-CK4OJ.tmp0%ReversingLabs
C:\Program Files (x86)\iDentalSoft Bridge\is-JCHHI.tmp0%ReversingLabs
C:\Program Files (x86)\iDentalSoft Bridge\is-Q1K3O.tmp0%ReversingLabs
C:\Program Files (x86)\iDentalSoft Bridge\is-QSGEK.tmp2%ReversingLabs
C:\Program Files (x86)\iDentalSoft Bridge\is-T8PP8.tmp0%ReversingLabs
C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\JAWTAccessBridge-32.dll (copy)0%ReversingLabs
C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\JavaAccessBridge-32.dll (copy)0%ReversingLabs
C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\WindowsAccessBridge-32.dll (copy)0%ReversingLabs
C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\awt.dll (copy)0%ReversingLabs
C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\bci.dll (copy)0%ReversingLabs
C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\client\is-CPU5F.tmp0%ReversingLabs
C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\client\jvm.dll (copy)0%ReversingLabs
C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\dcpr.dll (copy)0%ReversingLabs
C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\decora_sse.dll (copy)0%ReversingLabs
C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\deploy.dll (copy)0%ReversingLabs
C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\dt_shmem.dll (copy)0%ReversingLabs
C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\dt_socket.dll (copy)2%ReversingLabs
C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\dtplugin\deployJava1.dll (copy)0%ReversingLabs
C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\dtplugin\is-BK5HC.tmp0%ReversingLabs
C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\dtplugin\is-MJAQO.tmp2%ReversingLabs
C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\dtplugin\npdeployJava1.dll (copy)2%ReversingLabs
C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\eula.dll (copy)0%ReversingLabs
C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\fontmanager.dll (copy)0%ReversingLabs
C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\fxplugins.dll (copy)0%ReversingLabs
C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\glass.dll (copy)0%ReversingLabs
C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\glib-lite.dll (copy)0%ReversingLabs
C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\gstreamer-lite.dll (copy)0%ReversingLabs
C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\hprof.dll (copy)0%ReversingLabs
C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ.exe (copy)0%ReversingLabs
C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSClientJ.exe (copy)0%ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

SourceDetectionScannerLabelLink
http://www.innosetup.com/0%URL Reputationsafe
http://bugreport.sun.com/bugreport/0%URL Reputationsafe
http://java.oracle.com/0%URL Reputationsafe

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

NameSourceMaliciousAntivirus DetectionReputation
http://www.springframework.org/schema/context/spring-context-3.2.xsdiDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007BD5000.00000004.00001000.00020000.00000000.sdmpfalse
    		unknown
    http://www.example.org/iDSBridgeJ.exe, iDSBridgeJ.exe, 0000000D.00000003.2723257464.0000000026342000.00000004.00000020.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000003.2725196452.000000002639C000.00000004.00000020.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000002.3384849193.000000000AF39000.00000004.00001000.00020000.00000000.sdmpfalse
      		unknown
      http://apache.org/xml/features/validation/schema/augment-psviiDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000005530000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.00000000052F8000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2789182107.00000000259B9000.00000004.00000020.00020000.00000000.sdmpfalse
        		unknown
        http://www.springframework.org/schema/context/spring-context-2.5.xsdiDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007BD5000.00000004.00001000.00020000.00000000.sdmpfalse
          		unknown
          http://www.springframework.org/schema/tx/spring-tx-2.5.xsdiDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007BF1000.00000004.00001000.00020000.00000000.sdmpfalse
            		unknown
            http://apache.org/xml/properties/input-buffer-sizeiDSBridgeJ.exe, 0000001F.00000002.2764198138.00000000054FB000.00000004.00001000.00020000.00000000.sdmpfalse
              		unknown
              http://www.springframework.org/schema/tx/spring-tx-3.2.xsdiDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007BF1000.00000004.00001000.00020000.00000000.sdmpfalse
                		unknown
                http://xml.apache.org/xerces2-j/iDSBridgeJ.exe, 0000000D.00000002.3384849193.000000000544C000.00000004.00001000.00020000.00000000.sdmpfalse
                  		unknown
                  http://www.springframework.org/schema/tool/spring-tool-2.0.xsdiDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007BD5000.00000004.00001000.00020000.00000000.sdmpfalse
                    		unknown
                    http://apache.org/xml/properties/internal/entity-manageriDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000005530000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000005822000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007913000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000005769000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000002.3384849193.000000000AB33000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.00000000052F8000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.0000000005417000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.0000000005780000.00000004.00001000.00020000.00000000.sdmpfalse
                      		unknown
                      http://apache.org/xml/features/validation/unparsed-entity-checkingHiDSBridgeJ.exe, 0000001F.00000002.2792508765.0000000025A40000.00000004.00000020.00020000.00000000.sdmpfalse
                        		unknown
                        http://github.com/FasterXML/jacksoniDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000004D21000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2789182107.00000000256F3000.00000004.00000020.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.0000000004916000.00000004.00001000.00020000.00000000.sdmpfalse
                          		unknown
                          http://wiki.glassfish.java.net/Wiki.jsp?page=JiDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000004E18000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.0000000004A0E000.00000004.00001000.00020000.00000000.sdmpfalse
                            		unknown
                            http://commons.apache.org/logging/troubleshooting.html.iDSBridgeJ.exe, 0000000D.00000002.3384849193.00000000065AB000.00000004.00001000.00020000.00000000.sdmpfalse
                              		unknown
                              http://xml.org/sax/features/allow-dtd-events-after-endDTDntNSiDSBridgeJ.exe, 0000000D.00000003.2727583496.0000000025E3E000.00000004.00000020.00020000.00000000.sdmpfalse
                                		unknown
                                http://apache.org/xml/features/internal/parser-settingsiDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000005530000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.00000000052F8000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.0000000005210000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.00000000054FB000.00000004.00001000.00020000.00000000.sdmpfalse
                                  		unknown
                                  http://apache.org/xml/features/dom/include-ignorable-whitespaceiDSBridgeJ.exe, 0000000D.00000002.3384849193.000000000544C000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2789182107.00000000259B9000.00000004.00000020.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.00000000050A2000.00000004.00001000.00020000.00000000.sdmpfalse
                                    		unknown
                                    http://logging.apache.org/log4j/1.2/faq.html#unload.iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000005319000.00000004.00001000.00020000.00000000.sdmpfalse
                                      		unknown
                                      http://apache.org/xml/features/warn-on-duplicate-entitydeftionImiDSBridgeJ.exe, 0000000D.00000003.2727583496.0000000025E3E000.00000004.00000020.00020000.00000000.sdmpfalse
                                        		unknown
                                        http://www.springframework.org/schema/lang/spring-lang-3.0.xsdiDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007BD5000.00000004.00001000.00020000.00000000.sdmpfalse
                                          		unknown
                                          http://apache.org/xml/features/xinclude/fixup-base-urisiDSBridgeJ.exe, 0000001F.00000002.2792508765.0000000025A40000.00000004.00000020.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.0000000005210000.00000004.00001000.00020000.00000000.sdmpfalse
                                            		unknown
                                            http://apache.org/xml/properties/internal/namespace-binderLorg/a&iDSBridgeJ.exe, 0000001F.00000002.2792508765.0000000025A40000.00000004.00000020.00020000.00000000.sdmpfalse
                                              		unknown
                                              http://apache.org/xml/properties/schema/external-noNamespaceSchemaLocationiDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000005530000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.00000000052F8000.00000004.00001000.00020000.00000000.sdmpfalse
                                                		unknown
                                                http://apache.org/xml/properties/internal/error-reporteriDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000005530000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000005822000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007913000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000005769000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000002.3384849193.000000000AB33000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.00000000052F8000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.00000000054FB000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.00000000053DE000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.0000000005417000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.0000000005780000.00000004.00001000.00020000.00000000.sdmpfalse
                                                  		unknown
                                                  http://www.slf4j.org/codes.html#multiple_bindingsiDSBridgeJ.exe, 0000001F.00000002.2764198138.0000000004E6C000.00000004.00001000.00020000.00000000.sdmpfalse
                                                    		unknown
                                                    http://apache.org/xml/features/validation/balance-syntax-treesoriDSBridgeJ.exe, 0000000D.00000003.2727583496.0000000025E3E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                      		unknown
                                                      http://www.springframework.org/schema/jdbc/spring-jdbc.xsdiDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007BE4000.00000004.00001000.00020000.00000000.sdmpfalse
                                                        		unknown
                                                        http://www.springframework.org/schema/cacheiDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007FB9000.00000004.00001000.00020000.00000000.sdmpfalse
                                                          		unknown
                                                          http://apache.org/xml/features/include-commentsiDSBridgeJ.exe, 0000000D.00000002.3384849193.000000000544C000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2792508765.0000000025A40000.00000004.00000020.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.00000000050A2000.00000004.00001000.00020000.00000000.sdmpfalse
                                                            		unknown
                                                            http://apache.org/xml/features/scanner/notify-char-refsiDSBridgeJ.exe, 0000001F.00000002.2764198138.00000000052F8000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2792508765.0000000025A40000.00000004.00000020.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.00000000053DE000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.0000000005417000.00000004.00001000.00020000.00000000.sdmpfalse
                                                              		unknown
                                                              http://apache.org/xml/properties/dom/current-element-node:iDSBridgeJ.exe, 0000001F.00000002.2789182107.00000000259B9000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                		unknown
                                                                http://www.springframework.org/schema/txiDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007184000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                  		unknown
                                                                  http://www.innosetup.com/iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp, iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp, 00000002.00000000.2141721142.0000000000401000.00000020.00000001.01000000.00000004.sdmpfalse
                                                                  • URL Reputation: safe
                                                                  		unknown
                                                                  http://apache.org/xml/features/continue-after-fatal-erroriDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000005530000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007913000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000002.3384849193.000000000AB33000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.00000000052F8000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2789182107.00000000259B9000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                    		unknown
                                                                    http://apache.org/xml/features/standard-uri-conformantiDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000005530000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007913000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2792508765.0000000025A40000.00000004.00000020.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.00000000054FB000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.00000000053DE000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                      		unknown
                                                                      http://apache.org/xml/properties/internal/document-scanneriDSBridgeJ.exe, 0000001F.00000002.2764198138.00000000052F8000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                        		unknown
                                                                        http://www.springframework.org/schema/tool/spring-tool-3.1.xsdiDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007BD5000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                          		unknown
                                                                          http://xml.org/sax/properties/biDSBridgeJ.exe, 0000001F.00000002.2792508765.0000000025A40000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            		unknown
                                                                            http://bugreport.sun.com/bugreport/iDSBridgeJ.exe, 0000000D.00000002.3384849193.00000000099F8000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000004C00000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                            • URL Reputation: safe
                                                                            		unknown
                                                                            http://java.oracle.com/iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000009DD8000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000002.3384849193.00000000099F8000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000004C00000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                            • URL Reputation: safe
                                                                            		unknown
                                                                            https://%1/CertEnroll/nsrev_%3.aspcertutil.exefalse
                                                                              		unknown
                                                                              http://apache.org/xml/features/iDSBridgeJ.exe, 0000001F.00000002.2792508765.0000000025A40000.00000004.00000020.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.00000000054FB000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.0000000005417000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.0000000005780000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                		unknown
                                                                                http://apache.org/xml/features/generate-synthetic-annotationsiDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000005530000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007913000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.00000000052F8000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2789182107.00000000259B9000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                  		unknown
                                                                                  http://www.springframework.org/schema/jdbciDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007FBF000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                    		unknown
                                                                                    http://xml.org/sax/features/allow-dtd-events-after-endDTDiDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000005641000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007DA4000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000005704000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.00000000052F8000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.0000000005210000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                      		unknown
                                                                                      http://www.slf4j.org/codes.html#substituteLoggeriDSBridgeJ.exe, 0000001F.00000002.2764198138.0000000004E6C000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                        		unknown
                                                                                        http://www.springframework.org/schema/cache/spring-cache-3.1.xsdiDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007BD5000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                          		unknown
                                                                                          http://www.springframework.org/schema/task/spring-task-3.2.xsdiDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007BD5000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                            		unknown
                                                                                            http://apache.org/xml/features/internal/validation/schema/use-grammar-pool-onlyiDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000005530000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.00000000052F8000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                              		unknown
                                                                                              http://commons.apache.org/lang/iDSBridgeJ.exe, 0000000D.00000003.2726225582.0000000025213000.00000004.00000020.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000004CBD000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                		unknown
                                                                                                http://apache.org/xml/properties/internal/namespace-binderiDSBridgeJ.exe, 0000001F.00000002.2764198138.00000000052F8000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                  		unknown
                                                                                                  http://apache.org/xml/features/validation/iDSBridgeJ.exe, 0000000D.00000003.2723257464.0000000026342000.00000004.00000020.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000003.2725196452.000000002639C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                    		unknown
                                                                                                    http://apache.org/xml/features/validation/balance-syntax-treess/iDSBridgeJ.exe, 0000001F.00000002.2792508765.0000000025A40000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                      		unknown
                                                                                                      http://www.springframework.org/schema/beans/spring-beans-3.1.xsdiDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007BD5000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                        		unknown
                                                                                                        http://www.springframework.org/schema/security/spring-security-3.2.xsdiDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007BEA000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                          		unknown
                                                                                                          http://www.springframework.org/schema/tx/spring-tx.xsdiDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007B8E000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007184000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                            		unknown
                                                                                                            http://www.springframework.org/schema/securityiDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007FC5000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                              		unknown
                                                                                                              http://www.springframework.org/schema/lang/spring-lang-2.0.xsdiDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007BD5000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                		unknown
                                                                                                                http://apache.org/xml/properties/security-manageriDSBridgeJ.exe, 0000000D.00000002.3384849193.000000000544C000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000002.3384849193.00000000078CB000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007913000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.00000000054FB000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                  		unknown
                                                                                                                  http://xml.apache.org/xsltiDSBridgeJ.exe, 0000000D.00000002.3384849193.000000000887B000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                    		unknown
                                                                                                                    http://www.slf4j.org/codes.html#unsuccessfulInitOiDSBridgeJ.exe, 0000001F.00000002.2792508765.0000000025A40000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                      		unknown
                                                                                                                      http://www.springframework.org/schema/cache/spring-cache.xsdiDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007BD5000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                        		unknown
                                                                                                                        http://www.springframework.org/schema/security/spring-security-2.0.4.xsdiDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007BEA000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                          		unknown
                                                                                                                          http://asm.objectweb.orgiDSBridgeJ.exe, 0000000D.00000003.2727762557.00000000251A3000.00000004.00000020.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000003.2727762557.00000000251AC000.00000004.00000020.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000003.2727762557.000000002519A000.00000004.00000020.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000004CBD000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2786913062.0000000024DAC000.00000004.00000020.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2786913062.0000000024D69000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                            		unknown
                                                                                                                            http://apache.org/xml/features/validation/schema/element-defaultDXNiDSBridgeJ.exe, 0000001F.00000002.2789182107.00000000259B9000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                              		unknown
                                                                                                                              http://apache.org/xml/features/scanner/notify-builtin-refsa/lang0iDSBridgeJ.exe, 0000001F.00000002.2792508765.0000000025A40000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                		unknown
                                                                                                                                http://xml.org/sax/features/allow-dtd-events-after-endDTDrg/apaciDSBridgeJ.exe, 0000001F.00000002.2792508765.0000000025A40000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                  		unknown
                                                                                                                                  http://apache.org/xml/features/xincludeiDSBridgeJ.exe, 0000000D.00000002.3384849193.000000000544C000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.0000000005210000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                    		unknown
                                                                                                                                    http://www.springframework.org/schema/util/spring-util-2.0.xsdiDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007BD5000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                      		unknown
                                                                                                                                      http://apache.org/xml/features/warn-on-duplicate-entitydeforg/ap:iDSBridgeJ.exe, 0000001F.00000002.2792508765.0000000025A40000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                        		unknown
                                                                                                                                        http://mina.apache.org/iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000009795000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000002.3384849193.000000000983C000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                          		unknown
                                                                                                                                          http://www.oracle.com/iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000008CB2000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000004D75000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000004D90000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000004D21000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.000000000496B000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.0000000004916000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                            		unknown
                                                                                                                                            http://apache.org/xml/features/validation/schema-full-checkingiDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000005530000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.00000000052F8000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2789182107.00000000259B9000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                              		unknown
                                                                                                                                              http://%1/CertEnroll/%3%8%9.crlfile://certutil.exe, 0000000A.00000000.2665836640.0000000001001000.00000020.00000001.01000000.0000000A.sdmp, certutil.exe, 0000000A.00000002.2668757884.0000000001001000.00000020.00000001.01000000.0000000A.sdmp, certutil.exe, 0000000E.00000002.2673288626.0000000001001000.00000020.00000001.01000000.0000000A.sdmp, certutil.exe, 0000000E.00000000.2669897300.0000000001001000.00000020.00000001.01000000.0000000A.sdmpfalse
                                                                                                                                                		unknown
                                                                                                                                                http://www.springframework.org/schema/tx/spring-tx-3.1.xsdiDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007BF1000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                  		unknown
                                                                                                                                                  https://glassfish.dev.java.net/nonav/public/CDDLiDSBridgeJ.exe, 0000000D.00000002.3384849193.000000000836F000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000002.3384849193.00000000082AA000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000004E18000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000008377000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000004D21000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2789182107.0000000025728000.00000004.00000020.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.0000000004A0E000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.0000000004916000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2789182107.0000000025718000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                    		unknown
                                                                                                                                                    http://www.slf4j.org/codes.html#unsuccessfulInitiDSBridgeJ.exe, 0000001F.00000002.2764198138.0000000004E6C000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                      		unknown
                                                                                                                                                      http://www.springframework.org/schema/beans/spring-beans-2.5.xsdiDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007BD5000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                        		unknown
                                                                                                                                                        http://apache.org/xml/properties/internal/grammar-pooliDSBridgeJ.exe, 0000001F.00000002.2764198138.00000000050A2000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.00000000053DE000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                          		unknown
                                                                                                                                                          http://apache.org/xml/properties/internal/validator/dtd0iDSBridgeJ.exe, 0000001F.00000002.2792508765.0000000025A40000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                            		unknown
                                                                                                                                                            http://www.springframework.org/schema/beans/spring-beans.xsdiDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007B8E000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007184000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007BD5000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                              		unknown
                                                                                                                                                              http://www.springframework.org/schema/security/spring-security-2.0.1.xsdiDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007BEA000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                		unknown
                                                                                                                                                                http://xml.apache.org/iDSBridgeJ.exe, 0000001F.00000002.2789182107.00000000259B9000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                  		unknown
                                                                                                                                                                  http://apache.org/xml/features/allow-java-encodingsiDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000005530000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007913000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000002.3384849193.000000000AB33000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.00000000052F8000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2792508765.0000000025A40000.00000004.00000020.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.00000000054FB000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                    		unknown
                                                                                                                                                                    http://jakarta.apache.org/log4j/iDSBridgeJ.exe, 0000001F.00000002.2764198138.0000000005AA5000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                      		unknown
                                                                                                                                                                      http://www.springframework.org/schema/util/spring-util-2.5.xsdiDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007BD5000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                        		unknown
                                                                                                                                                                        http://www.springframework.org/schema/aop/spring-aop.xsdiDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007BCF000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                          		unknown
                                                                                                                                                                          http://logging.apache.org/log4j/1.2iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000005319000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000005302000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000004D90000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                            		unknown
                                                                                                                                                                            http://commons.apache.org/collections/iDSBridgeJ.exe, 0000000D.00000003.2727762557.00000000251F9000.00000004.00000020.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000004CBD000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                              		unknown
                                                                                                                                                                              http://apache.org/xml/features/nonvalidating/load-external-dtdrcbiDSBridgeJ.exe, 0000001F.00000002.2792508765.0000000025A40000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                		unknown
                                                                                                                                                                                http://www.springframework.org/schema/beans/spring-beans-2.0.xsdiDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007BD5000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                  		unknown
                                                                                                                                                                                  https://github.com/haraldk/TwelveMonkeys/common/coiDSBridgeJ.exe, 0000000D.00000003.2726225582.00000000251F1000.00000004.00000020.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000003.2726225582.00000000251DF000.00000004.00000020.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000003.2727762557.00000000251E9000.00000004.00000020.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000004CBD000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2786913062.0000000024DE8000.00000004.00000020.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2786913062.0000000024DF2000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                    		unknown
                                                                                                                                                                                    http://www.springframework.org/schiDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007DA4000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                      		unknown
                                                                                                                                                                                      http://apache.org/xml/features/validation/schema/normalized-valueiDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000005530000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.00000000052F8000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2792508765.0000000025A40000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                        		unknown
                                                                                                                                                                                        http://www.identalsoft.com/&iDentalSoftBridgeSetup_12.2.0_x86 (1).exe, 00000000.00000003.2688390187.0000000002081000.00000004.00001000.00020000.00000000.sdmp, iDentalSoftBridgeSetup_12.2.0_x86 (1).exe, 00000000.00000003.2141022035.0000000002081000.00000004.00001000.00020000.00000000.sdmp, iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp, 00000002.00000003.2142961414.0000000002198000.00000004.00001000.00020000.00000000.sdmp, iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp, 00000002.00000003.2681653812.0000000002198000.00000004.00001000.00020000.00000000.sdmp, iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp, 00000002.00000003.2673913631.0000000002194000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                          		unknown
                                                                                                                                                                                          http://www.cs.princeton.edu/~appel/modern/java/CUP/iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000004E74000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2789182107.00000000259B9000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                            		unknown
                                                                                                                                                                                            http://apache.org/xml/features/xinclude/fixup-languageiDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000005641000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000005704000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.00000000052F8000.00000004.00001000.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2792508765.0000000025A40000.00000004.00000020.00020000.00000000.sdmp, iDSBridgeJ.exe, 0000001F.00000002.2764198138.0000000005210000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                              		unknown
                                                                                                                                                                                              http://www.springframework.org/schema/ciDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007FB3000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                                		unknown
                                                                                                                                                                                                http://apache.org/xml/properties/internal/validator/schema/lang/iDSBridgeJ.exe, 0000001F.00000002.2792508765.0000000025A40000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                  		unknown
                                                                                                                                                                                                  http://www.springframework.org/schema/cache/spring-cache-3.2.xsdiDSBridgeJ.exe, 0000000D.00000002.3384849193.0000000007BD5000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                                    		unknown

                                                                                                                                                                                                    World Map of Contacted IPs

                                                                                                                                                                                                    • No. of IPs < 25%
                                                                                                                                                                                                    • 25% < No. of IPs < 50%
                                                                                                                                                                                                    • 50% < No. of IPs < 75%
                                                                                                                                                                                                    • 75% < No. of IPs

                                                                                                                                                                                                    Public IPs

                                                                                                                                                                                                    IPDomainCountryFlagASNASN NameMalicious

                                                                                                                                                                                                    Private

                                                                                                                                                                                                    IP
                                                                                                                                                                                                    127.0.0.1

                                                                                                                                                                                                    General Information

                                                                                                                                                                                                    Joe Sandbox version:41.0.0 Charoite
                                                                                                                                                                                                    Analysis ID:1525215
                                                                                                                                                                                                    Start date and time:2024-10-03 21:37:22 +02:00
                                                                                                                                                                                                    Joe Sandbox product:CloudBasic
                                                                                                                                                                                                    Overall analysis duration:0h 11m 41s
                                                                                                                                                                                                    Hypervisor based Inspection enabled:false
                                                                                                                                                                                                    Report type:full
                                                                                                                                                                                                    Cookbook file name:default.jbs
                                                                                                                                                                                                    Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                                                                                                                                    Number of analysed new started processes analysed:35
                                                                                                                                                                                                    Number of new started drivers analysed:0
                                                                                                                                                                                                    Number of existing processes analysed:0
                                                                                                                                                                                                    Number of existing drivers analysed:0
                                                                                                                                                                                                    Number of injected processes analysed:1
                                                                                                                                                                                                    Technologies:
                                                                                                                                                                                                    • HCA enabled
                                                                                                                                                                                                    • EGA enabled
                                                                                                                                                                                                    • AMSI enabled
                                                                                                                                                                                                    Analysis Mode:default
                                                                                                                                                                                                    Analysis stop reason:Timeout
                                                                                                                                                                                                    Sample name:iDentalSoftBridgeSetup_12.2.0_x86 (1).exe
                                                                                                                                                                                                    Detection:SUS
                                                                                                                                                                                                    Classification:sus32.bank.evad.winEXE@39/799@0/1
                                                                                                                                                                                                    EGA Information:
                                                                                                                                                                                                    • Successful, ratio: 80%
                                                                                                                                                                                                    HCA Information:
                                                                                                                                                                                                    • Successful, ratio: 96%
                                                                                                                                                                                                    • Number of executed functions: 219
                                                                                                                                                                                                    • Number of non-executed functions: 241
                                                                                                                                                                                                    Cookbook Comments:
                                                                                                                                                                                                    • Found application associated with file extension: .exe

                                                                                                                                                                                                    Warnings

                                                                                                                                                                                                    • Exclude process from analysis (whitelisted): dllhost.exe, audiodg.exe, consent.exe, RuntimeBroker.exe, ShellExperienceHost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
                                                                                                                                                                                                    • Excluded domains from analysis (whitelisted): client.wns.windows.com, fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
                                                                                                                                                                                                    • Execution Graph export aborted for target iDSBridgeJ.exe, PID 7048 because there are no executed function
                                                                                                                                                                                                    • Not all processes where analyzed, report is missing behavior information
                                                                                                                                                                                                    • Report creation exceeded maximum time and may have missing disassembly code information.
                                                                                                                                                                                                    • Report size exceeded maximum capacity and may have missing behavior information.
                                                                                                                                                                                                    • Report size exceeded maximum capacity and may have missing disassembly code.
                                                                                                                                                                                                    • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                                                                                                                                                    • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                                                                                                                                                                    • Report size getting too big, too many NtQueryValueKey calls found.
                                                                                                                                                                                                    • Report size getting too big, too many NtSetInformationFile calls found.
                                                                                                                                                                                                    • VT rate limit hit for: iDentalSoftBridgeSetup_12.2.0_x86 (1).exe

                                                                                                                                                                                                    Simulations

                                                                                                                                                                                                    Behavior and APIs

                                                                                                                                                                                                    TimeTypeDescription
                                                                                                                                                                                                    21:39:04AutostartRun: HKLM\Software\Microsoft\Windows\CurrentVersion\Run iDentalSoft-Bridge "C:\Program Files (x86)\iDentalSoft Bridge\iDentalSoft Bridge.lnk"

                                                                                                                                                                                                    Joe Sandbox View / Context

                                                                                                                                                                                                    IPs

                                                                                                                                                                                                    ⊘No context

                                                                                                                                                                                                    Domains

                                                                                                                                                                                                    ⊘No context

                                                                                                                                                                                                    ASNs

                                                                                                                                                                                                    ⊘No context

                                                                                                                                                                                                    JA3 Fingerprints

                                                                                                                                                                                                    ⊘No context

                                                                                                                                                                                                    Dropped Files

                                                                                                                                                                                                    ⊘No context

                                                                                                                                                                                                    Created / dropped Files

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\BridgeCommon.dll (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):28496
                                                                                                                                                                                                    Entropy (8bit):6.5898728199626015
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:0hXAzuA2XgBZUq7tWmzKmtVmiQQ5HkFkSWFbF0sioPn6OZKPV5/2Gs7V7DCl8ZpO:JrgyXBF6sj6OZKdB2GKV7OliRBEH
                                                                                                                                                                                                    MD5:BA56075540813A909A7E303E31CDB290
                                                                                                                                                                                                    SHA1:F720CD8EF99E29F99C7818DC28B11691D1A4AC88
                                                                                                                                                                                                    SHA-256:12C12CDD21A3C7A6BDF18AAD522700E0BDDDACB2EF94E75409EC874E286EB8B2
                                                                                                                                                                                                    SHA-512:D6BCB8E0FF799C89D9973F30EAFD0F16CB2A3CDA0B093C82AF83CD2B1CEF1EA010F247FE4C17353A10D4F712E4247A7FA8C44D5A1E7FE532F2FEB50EB51CA728
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........kY...................E.......................................................................Rich............................PE..L.....{_...........!.....*...*......./.......@............................................@..........................Y.......J..P....................R..P....p.......................................B..@............@...............................text..._(.......*.................. ..`.rdata.......@......................@..@.data........`.......H..............@....reloc..H....p.......J..............@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\BridgeCommonx64.dll (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):26112
                                                                                                                                                                                                    Entropy (8bit):5.458252398909699
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:fuhbZsOIfEfc6nLbzdTBKxGPSBr32pgK25o7QbaKU37sOlh6MW:mhGD6LXoGPk32aK25o7O7EIOlHW
                                                                                                                                                                                                    MD5:34C22195F81C8037C6773098E88B193D
                                                                                                                                                                                                    SHA1:27E244108A7457DA0781D9C5E67D821C21DFBFCB
                                                                                                                                                                                                    SHA-256:B512C782D6DE531B5006B6E0B80EAC4FDFDF340BD78407277659703FC04A9CDA
                                                                                                                                                                                                    SHA-512:AAAFA7AFDE705124B1C3F65D7B9134EA043072D71ECE55F4BE1424E50EC766AD5F53F77808AAFCC657CE56FEE7AF5F5377D1EB6A186B0EA269B43F51487851CC
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........].f...f...f....x..f...(s..f....u..f....A..f....w..f...f...f....@..f....D..f....p..f....v..f..Rich.f..................PE..d....g.Z.........." .........4......P3..............................................t.....@..........................................d..i....T..P...............x...............d....................................................@..8............................text....,.......................... ..`.rdata...$...@...&...2..............@..@.data...x....p.......X..............@....pdata..x............\..............@..@.rsrc................`..............@..@.reloc...............d..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\BridgeNative.dll (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):51024
                                                                                                                                                                                                    Entropy (8bit):6.570853299187645
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:768:OzODb0Z75wT6FdYD2l+uYYdsNlc363tjAfdV7OliRBEE:R4Z75rYD2qNzefXgiD3
                                                                                                                                                                                                    MD5:EE5E5A105435298F5D68910762037368
                                                                                                                                                                                                    SHA1:97250A606B3DC63CF5EB01B720F53D0CE1CEA18E
                                                                                                                                                                                                    SHA-256:EE127B4D164DB763FF31A219499E06CC0178FE04EA5C2D5B2C3F155837CA83C5
                                                                                                                                                                                                    SHA-512:3DD75A5BF12DB8F3D759400CF3E1FD7773871491C4DC3C83671E4931D33C9F0D4CCD320FC7EBFCA1B7AD9C3D24B1F157E9321F950E4C9575205D51A1DE09200A
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........q..g...g...g.......g.......g.......g.......g.......g.......g..!....g...g...g..!....g..!....g..!..g..!....g..Rich.g..........................PE..L.....\...........!.....h...B......>d....................................................@.........................0...0...`...........................P...........`...p...................p..........@............................................text...,f.......h.................. ..`.rdata...-...........l..............@..@.data...............................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\BridgeNativex64.dll (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):21504
                                                                                                                                                                                                    Entropy (8bit):5.190679897153252
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:wmEZyaJHB5X6txYVslslOBDxiPtQzEl+bxNf7PzOlEIbjk:pAyaJhqxmVQsPKE0bxNbzOlT
                                                                                                                                                                                                    MD5:852DF89978F979C1658720607CFA20FF
                                                                                                                                                                                                    SHA1:A6A2EFECF22BB4CD721556896A5FB9B1C3569FC7
                                                                                                                                                                                                    SHA-256:5446575727413241CAB1879EBC8CF97321DED05712C076816349AAFE75C6CE8D
                                                                                                                                                                                                    SHA-512:2C87F003E3AD288790D3EFE3421B4E4C9A3E71286F7748451ED3B2AE10BAECB483E4040E1235F459194AFD05B99E98E559C9CC0B3CD73085933C9B3D5EBFCB98
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9..1}..b}..b}..bt.Ybu..b.Rb|..b..Tb...b..`bq..b..abp..b..Vbx..b}..b...b..ebx..b..Qb|..b..Pb|..b..Wb|..bRich}..b................PE..d....g.Z.........." .....$...,.......#..............................................\.....@.........................................P].......U..........4....p..................,....C...............................................@..X............................text....".......$.................. ..`.rdata.......@... ...(..............@..@.data........`.......H..............@....pdata.......p.......J..............@..@.rsrc...4............N..............@..@.reloc...............R..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\EndUserLicenseAgreement.rtf (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):55448
                                                                                                                                                                                                    Entropy (8bit):5.190578673559488
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:Y3oaarN79ozVzEFtB26IJICr1q2A8TqOQ6YLt9l0vwxP5mLnAPeo75Y3kmA31dvT:Y3CB26IJICrU2fOOU9Uwxx/2ZrS14U
                                                                                                                                                                                                    MD5:2BF908F9B390DFF77953F913B1DD1BB8
                                                                                                                                                                                                    SHA1:768290E40080B7890219AA76C6DA8479CC626227
                                                                                                                                                                                                    SHA-256:FDB3764F71276B3820549CD4BDC6F14AED1376EDDEEC9B3CFED91A15168FEFC2
                                                                                                                                                                                                    SHA-512:718638377B3095FC5F5CAF912DC56D8D2073479A301A2F1B98100AED3BAD51832D9B82A5B5A5B8497F1A37EF75B9044A293B3CBC094B6BC6562F005169B9B772
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch37\stshfhich37\stshfbi37\deflang1033\deflangfe1033\themelang1033\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\f37\fbidi \fswiss\fcharset0\fprq2{\*\panose 020f0502020204030204}Calibri;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fhimino

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\JavaDDE.dll (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):156160
                                                                                                                                                                                                    Entropy (8bit):6.283455442630357
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:1536:nlBCrOYL9l4h701waNCIAs2u2r4lMzgBJVxb0s5x3mSiFaKHRiJ30KIIZEsy+0Iw:nlT634hDa4JsQOxiQbIIasy+0IV
                                                                                                                                                                                                    MD5:6968B37D8062D8EAFFE3D31A9721CDB7
                                                                                                                                                                                                    SHA1:56C94CFA0F863096F2511D620D74A3E9ECBCE6F6
                                                                                                                                                                                                    SHA-256:C802747272F8B92AC5C0D787441AE6F95DE567BF8EF35D8F933A74211CA6F77B
                                                                                                                                                                                                    SHA-512:0619273D877E4F6B4F6E0C41045A6F72649617845CCAC9334B37148A8167FB16FDE5432E9D352B6F2359BE11B494D80937DC590DC777BA34AE6D2AD8CB746747
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........B..o,..o,..o,.....o,......o,.....o,......o,..o-..o,......o,......o,......o,......o,.Rich.o,.........................PE..L...w.Q...........!................'...........................................................................................<....p.. ....................... ...@...............................H...@............................................text...l........................... ..`.rdata.. \.......^..................@..@.data....4... ......................@....tls.........`.......&..............@....rsrc... ....p.......(..............@..@.reloc..N".......$...>..............@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\JavaDDEx64.dll (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):195584
                                                                                                                                                                                                    Entropy (8bit):5.914069453482232
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:VtMyaCTc5KmxjLyW7rSrG4MUcqneqn5EsMLAMS9apK3BAF:BBCV7mwfqneqykpRA
                                                                                                                                                                                                    MD5:733C54657245520CED930D4394A9DD84
                                                                                                                                                                                                    SHA1:700C85671732AAFFFEB73AB2F562F180D95FBFF5
                                                                                                                                                                                                    SHA-256:D1D78E2D7987E9A0C00F012BACA6C276E7548C8C79FD41857A4EC1B4DAF8EB79
                                                                                                                                                                                                    SHA-512:2945D4920918E409BE7C479BB47A6741FED7E25A6CACB4F4A91CC108A089AAEC769E018449CE7B11616A9C4F37AAD3CC3C544DD285FD40AF36C0CF0D5B434A1D
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......b...&..&..&../.N.K../.X.,../.I..../.^.!..&...../.G./../._.'../.Y.'../.\.'..Rich&..........PE..d.....Q.........." ........................................................p......GR.................................................._.......<....@.. ........(...........`...............................E..(....................................................text...&........................... ..`.rdata..............................@..@.data....A....... ..................@....pdata...(.......*..................@..@.tls.........0......................@....rsrc... ....@......................@..@.reloc.......`......................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\TWAINDSM.dll (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):123904
                                                                                                                                                                                                    Entropy (8bit):6.421088035073883
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:+cK2gFTHnt12TqrYSoJZrz6qAsSSqMD/Bm:+nTHtETUYZJF62qO
                                                                                                                                                                                                    MD5:86BA9DA1B5E0336DE8FA52B0308CF990
                                                                                                                                                                                                    SHA1:571C508B775D820AF18530782644BC2572A26B85
                                                                                                                                                                                                    SHA-256:065FDD0DCC05D0F6B4D27E76E67EA1585CC2F873279DFA357091F97396BDBCDC
                                                                                                                                                                                                    SHA-512:FE6262FF432A8E3F7392ED240C2FA09D501323BC133DEB79F8E0AAD70F6C3733B848D46A69E9EA2A53ABB897D53DA983B0CC5E392F25348BEFC5FB5C123CE73B
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......am.J%.k.%.k.%.k.Jz..1.k.Jz..O.k.,t..,.k.%.j.\.k.Jz....k.Jz..$.k.Jz..$.k.Jz..$.k.Rich%.k.................PE..L.....\...........!.....:..................P...............................@..........................................I...L...d....................................R..................................@............P...............................text...G8.......:.................. ..`.rdata...`...P...b...>..............@..@.data....8..........................@....rsrc...............................@..@.reloc...!......."..................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\TWAINDSMx64.dll (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):168144
                                                                                                                                                                                                    Entropy (8bit):6.219704762029254
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:WS6D86Zy046did4UfpX5QiixnjQxQY5rr8Lf3M3AA51Tiw/:WS6D86ZyV4idvpXaipV5s6AgiA
                                                                                                                                                                                                    MD5:DCD85D844C1583C61D3AFABD983AA0B5
                                                                                                                                                                                                    SHA1:2675B890400C445FAEB4495884D8E2BBEAB15F2F
                                                                                                                                                                                                    SHA-256:96A87AABDF2AF814785965DE82F25D30F2CD1C1C6755835782AED8000D36E56E
                                                                                                                                                                                                    SHA-512:28BEC5FD6148230F88F49DC929965E8B564690A858B6EDB1A602B86F7B8848493C3790DA717BE5922DF1B925A09108F37E00B7AAC2163865E4970B68FBE9B654
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........,..B..B..B.......B.....B..}9..B..C...B......B.....B.....B.....B.Rich.B.................PE..d...kk.R.........." ................H...............................................~................................................3..I....'..d....................r...............................................................................................text...Z........................... ..`.rdata.............................@..@.data...DI...@...(...(..............@....pdata...............P..............@..@.rsrc................`..............@..@.reloc...............h..............@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\TwainJNI.dll (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):40960
                                                                                                                                                                                                    Entropy (8bit):6.4074300922448835
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:768:iWLIYIbn1BJnyi3JRzw6utEKiQviGsPUlcsHyGsfoOfKdtX:i6INtJRzw6uyKiohsPUNRsAOfcX
                                                                                                                                                                                                    MD5:3768CE16E471A8FD9C333F65EAFFA284
                                                                                                                                                                                                    SHA1:26FDF02AEA2B37824D57C30BCA0FD5B5E7C73E19
                                                                                                                                                                                                    SHA-256:A69189F195D846D643CDD33733FFACC4CEB8BEC434D28DE6700AD26719378CB5
                                                                                                                                                                                                    SHA-512:172DB2533261885C490A411C8B9FBF426160F9769FAB708B4F6AAAE980D1252EB3ECA5348A5943605975FDA60E0F3185627AC8664CD6CE01062829876D46F082
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......w^KR3?%.3?%.3?%..q..2?%.\I..2?%.\I..??%.\I..7?%.\I..5?%.:G..6?%.3?$..?%.\I..0?%.\I..2?%.\I..2?%.Rich3?%.........................PE..L.....{_...........!.....^...>.......c.......p.......................................d....@.........................p...........d................................... r..................................@............p...............................text....].......^.................. ..`.rdata...-...p.......b..............@..@.data...............................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\TwainJNIx64.dll (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):55296
                                                                                                                                                                                                    Entropy (8bit):5.865736435639137
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:1536:AZTOUyTGQltVHgQiBtEjZlYqeTEc/4JOl8G:gOckSEjZlAT/QJOl8
                                                                                                                                                                                                    MD5:B3C3273757E907EA5F53F4A4819F28F1
                                                                                                                                                                                                    SHA1:73C367E1A65A16F2986284A84F458BF48A5C2BE4
                                                                                                                                                                                                    SHA-256:6CA216586D312F066015BE2957ADF902188225B29B4A8C8D8D68F23F3DDBFAEB
                                                                                                                                                                                                    SHA-512:28BC2954EF5687F2C32C6731E9180B23C572CB822758589BC23B42375843D771C88C529753C9F6151FFB8A159B1B3E224A65A8D5DFFE6D9CF8887B327BB3EB4C
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......oj..+...+...+...E..*...D}..*...D}2.!...D}../...D}3.-..."s......+......D}7.(...D}..*...D}..*...Rich+...........PE..d...6:SZ.........." .........N............................................... ............@.....................................................d...............................h...0................................................................................text.............................. ..`.rdata...=.......>..................@..@.data...H...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\BridgeSelfCertificate.cer (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Certificate, Version=3
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):967
                                                                                                                                                                                                    Entropy (8bit):7.285069566594567
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:24:efn4wJAMDMOvzn4wJAMDMx7QiaCpIOW8TpiE9Th47TBX478yHgM:on4wJAMDMObn4wJAMDMBQ2Y8TMEZh47C
                                                                                                                                                                                                    MD5:E974F555DB42ED966A918ADC7692711F
                                                                                                                                                                                                    SHA1:68E3FE56532941E5707231791F8D4A173146399D
                                                                                                                                                                                                    SHA-256:A8AFA61B6A6FB1EA42EBCAF5FE053D857470ED9F013FEEB9D3B0B9B6F010E4AD
                                                                                                                                                                                                    SHA-512:2E657AD562FE30883CA997D4C8C6F285D385448B268D1B9C881A604727F8C1F777B1C0DE6E1E07492C5AD1BD248ECBF437D86ED3EC63923555F994A69BEFCFC6
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:0...0..........:...0...*.H........0..1.0...U....US1.0...U....Unknown1.0...U....Unknown1.0...U....iServiceSoft1.0...U....iServiceSoft1!0...U....localgateway.iDentalSoft0 ..230117100200Z..20730104100200Z0..1.0...U....US1.0...U....Unknown1.0...U....Unknown1.0...U....iServiceSoft1.0...U....iServiceSoft1!0...U....localgateway.iDentalSoft0.."0...*.H.............0..........8u...?..p.VF59.Nx..6y .^.El..b....^ei.9.t..K!.z$......VX.W.Sx....I#.0....#....~.5H....G..}.r.,...D.....S...a...yX.....rx.. ...Z...!..J(._>.H3.eo.Fv......7......j.G(q....iGZY5..._.'..%...Ij.I\H.b.2..2z.S02....a..u.$P...;..59.K...._-RQ..c.a.]-......=0;0...U....0.........localhost0...U.......&.0].......3...RD.0...*.H..............L.O^#?..........%...(...W.,....|.Nf.S..p..*...u..3.0......$.#.xU.....P.Y..-..QDu7...a.]..,.?...D..m....J..#....t.....R...7.........JC_0Bp\.zu#..._.JN.I........M...3W.d.......G..:.JV..T.a.?..dK..z.....;M...@....S..)H......B9.|.Y..`....:..

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certadm.dll (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):85504
                                                                                                                                                                                                    Entropy (8bit):5.9322947668452635
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:1536:MeZq3MXXTjmZ5IplbHKp/reRgMxcRircjVgrS9Ll2shT:MeZNvmnswKGMCZSrggsh
                                                                                                                                                                                                    MD5:AED39116FE12C5550975043DA1D1B244
                                                                                                                                                                                                    SHA1:ED8AA12A00E93C1A477F4EF69864948B4014A7FB
                                                                                                                                                                                                    SHA-256:BBBA87BF62E8BDC11602F2A95712E5FE3FB1EDBBCDEB28CBDCF191AEAB286B04
                                                                                                                                                                                                    SHA-512:0AB9EF25BBA0E231A140A5153C9F9149AB194A324F374E655E43EF90715E0417987D7F31F2493E229EC8B704BEAD31F0FBFF6EE811D42CB7AF8C58361979D132
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........xl.....................c.......c._............c.^.....n.].....n.b.....c.\.....c.X.....Rich............PE..L....$.>...........!.........Z...................3o.................................................................................0..p)...................`..x...................................xS..@............................................text............................... ..`.data...............................@....rsrc...p)...0...*..................@..@.reloc..N....`.......2..............@..B.$.>X....$.>e....$.>o....$.>z....$.>.....$.>.....$.>.....$.>.....$.>.....$.>............KERNEL32.dll.NTDLL.DLL.msvcrt.dll.ATL.DLL.certcli.dll.ADVAPI32.dll.USER32.dll.ole32.dll.OLEAUT32.dll.CRYPT32.dll................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certcli.dll (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):194560
                                                                                                                                                                                                    Entropy (8bit):6.205031289220213
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:5zl9QQSzT2uPMB3j75Hz+CyJd8LBJK3oOuJLfabM5y5N8HJjpnssxshVh8:SxMBz75HCTdwBJKYhJoMgcHXU
                                                                                                                                                                                                    MD5:00709952D444EAE14DBBD30D36FBAE0F
                                                                                                                                                                                                    SHA1:1949D2DE6E367A893AACB1D2A304E6291EACAB79
                                                                                                                                                                                                    SHA-256:A65B57C68F9119940133F6680AF3644866EEBDA5378F9B6AED441FB999B50526
                                                                                                                                                                                                    SHA-512:90DFC5C886B7183C6BFD4C44DCB98771525F02090E9987999C11F5D9EB69769CADE92FFD3DFB494FFB7C5F18021A9BC6FFD09C8093B87911F250AB7B58E5A570
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........N../.../.../..[ .../.../......[ ../..[ ../..[ ../..[ ../..[ .../..[ .../..Rich./..........................PE..L......H...........!.....`.........................w......................... ......r................................I..>....T..,........V...........................l..8...........................(w..@.......$....................................text...<].......^.................. ..`.orpc........p.......b.............. ..`.data................d..............@....rsrc....V.......X..................@..@.reloc..............................@..B...H......H......H......H....,..H....,..H.......H.......H....,..H.......H.......H.......H.......H.......H.......H............ADVAPI32.dll.ATL.DLL.CRYPT32.dll.CRYPTUI.dll.KERNEL32.dll.NTDLL.DLL.msvcrt.dll.NETAPI32.dll.ole32.dll.OLEAUT32.dll.RPCRT4.dll.Secur32.dll.USER32.dll.WLDAP32.dll........................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certreq.exe (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):120320
                                                                                                                                                                                                    Entropy (8bit):6.024878827023451
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:dwZWsm6ulAW+1qvF4hxQYHscJRKDazCj29:km6uugqWEJO9y
                                                                                                                                                                                                    MD5:B10415C9EFEA412FC0A353B63255DE51
                                                                                                                                                                                                    SHA1:E8F659CE1F22B04D80AE921DA3653914FF862320
                                                                                                                                                                                                    SHA-256:F0238909CB06B7CD27B0E7C035B163D27EF77F520417F6E1D0AE99527DEDBBEB
                                                                                                                                                                                                    SHA-512:EBDAC67D7D806C3CA98D09D19E10B84B2FAED083FCB401271EE9371F74272126AC2D1EA6409ABCCCDE3E6B95316E6F74F78D6F66C792BAD3AE1427CFE084B5B6
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 2%
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........|..|..|.%t...|.%t...|..|..}.(t...|.(t...|.%t...|.%t...|.Rich.|.........................PE..L...u..>.................z...^......................................................D............ ..........................Xw..T........F..........................................................0^..@...X...P....................................text...&y.......z.................. ..`.data................~..............@....rsrc....F.......H..................@..@.$.>.....$.>.....$.>.....$.>.....$.>.....$.>.....$.>.....$.>.....$.>.....$.>.....$.>.....$.>.....$.>.....$.>.....$.>)....$.>5....$.>A...........KERNEL32.dll.NTDLL.DLL.msvcrt.dll.ADVAPI32.dll.certcli.dll.comdlg32.dll.CRYPT32.dll.CRYPTUI.dll.GDI32.dll.ole32.dll.OLEAUT32.dll.SETUPAPI.dll.USER32.dll.WLDAP32.dll.Secur32.dll.WININET.dll....................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exe (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):569344
                                                                                                                                                                                                    Entropy (8bit):6.1181069611039955
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:6144:AG/XQ+F4FFJaL5TBEf6ID0rq7XqHvXxUEuspBi9NlLlli8QMupzUMfNXyowyQv:rX0vaL506euHPOypA9NlGcuVNXa
                                                                                                                                                                                                    MD5:711DB2EF10B6C2AB2080698AEC6C6D08
                                                                                                                                                                                                    SHA1:5746C14FE1790A18B76CC9833F93BC72937ACA72
                                                                                                                                                                                                    SHA-256:75DDAB1826F220EB36A9EEA9CF8533C94C19BAC89D961380F3A418F6EEDB2B4E
                                                                                                                                                                                                    SHA-512:6568EA1BF41AFA461D2B529D42E0D873C9B1B109875C6010FD965AC8C3D9A0C98EA1EA747119815254BF42130B6CF699C8DC01EE6763F172AE7C57F656FAF7F1
                                                                                                                                                                                                    Malicious:true
                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......O..x..l+..l+..l+..q+..l+..c+..l+..1+:.l+..m+5.l+..3+).l+...+3.l+..2+..l+..6+..l+Rich..l+........PE..L......>............................Wy..............................................ye........... ..........................(........`..@...................................................................P........................................text...l........................... ..`.data...$g.......P..................@....rsrc...@....`.......*..............@..@.$.>.....$.>.....$.>.....$.>.....$.>.....$.>.....$.>.....$.>$....$.>1....$.>=....$.>J....$.>V....$.>`....$.>.....$.>m....$.>y....$.>.....>.....$.>.....$.>.....$.>.....$.>.....$.>.....$.>.....$.>............KERNEL32.dll.NTDLL.DLL.msvcrt.dll.ADVAPI32.dll.certadm.dll.certcli.dll.COMCTL32.dll.comdlg32.dll.CRYPT32.dll.CRYPTNET.dll.CRYPTUI.dll.GDI32.dll.NETAPI32.dll.NTDSAPI.dll.ole32.dll.OLEAUT32.dll.RPCRT4.d

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\is-635B0.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):120320
                                                                                                                                                                                                    Entropy (8bit):6.024878827023451
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:dwZWsm6ulAW+1qvF4hxQYHscJRKDazCj29:km6uugqWEJO9y
                                                                                                                                                                                                    MD5:B10415C9EFEA412FC0A353B63255DE51
                                                                                                                                                                                                    SHA1:E8F659CE1F22B04D80AE921DA3653914FF862320
                                                                                                                                                                                                    SHA-256:F0238909CB06B7CD27B0E7C035B163D27EF77F520417F6E1D0AE99527DEDBBEB
                                                                                                                                                                                                    SHA-512:EBDAC67D7D806C3CA98D09D19E10B84B2FAED083FCB401271EE9371F74272126AC2D1EA6409ABCCCDE3E6B95316E6F74F78D6F66C792BAD3AE1427CFE084B5B6
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 2%
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........|..|..|.%t...|.%t...|..|..}.(t...|.(t...|.%t...|.%t...|.Rich.|.........................PE..L...u..>.................z...^......................................................D............ ..........................Xw..T........F..........................................................0^..@...X...P....................................text...&y.......z.................. ..`.data................~..............@....rsrc....F.......H..................@..@.$.>.....$.>.....$.>.....$.>.....$.>.....$.>.....$.>.....$.>.....$.>.....$.>.....$.>.....$.>.....$.>.....$.>.....$.>)....$.>5....$.>A...........KERNEL32.dll.NTDLL.DLL.msvcrt.dll.ADVAPI32.dll.certcli.dll.comdlg32.dll.CRYPT32.dll.CRYPTUI.dll.GDI32.dll.ole32.dll.OLEAUT32.dll.SETUPAPI.dll.USER32.dll.WLDAP32.dll.Secur32.dll.WININET.dll....................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\is-9G93M.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):85504
                                                                                                                                                                                                    Entropy (8bit):5.9322947668452635
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:1536:MeZq3MXXTjmZ5IplbHKp/reRgMxcRircjVgrS9Ll2shT:MeZNvmnswKGMCZSrggsh
                                                                                                                                                                                                    MD5:AED39116FE12C5550975043DA1D1B244
                                                                                                                                                                                                    SHA1:ED8AA12A00E93C1A477F4EF69864948B4014A7FB
                                                                                                                                                                                                    SHA-256:BBBA87BF62E8BDC11602F2A95712E5FE3FB1EDBBCDEB28CBDCF191AEAB286B04
                                                                                                                                                                                                    SHA-512:0AB9EF25BBA0E231A140A5153C9F9149AB194A324F374E655E43EF90715E0417987D7F31F2493E229EC8B704BEAD31F0FBFF6EE811D42CB7AF8C58361979D132
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........xl.....................c.......c._............c.^.....n.].....n.b.....c.\.....c.X.....Rich............PE..L....$.>...........!.........Z...................3o.................................................................................0..p)...................`..x...................................xS..@............................................text............................... ..`.data...............................@....rsrc...p)...0...*..................@..@.reloc..N....`.......2..............@..B.$.>X....$.>e....$.>o....$.>z....$.>.....$.>.....$.>.....$.>.....$.>.....$.>............KERNEL32.dll.NTDLL.DLL.msvcrt.dll.ATL.DLL.certcli.dll.ADVAPI32.dll.USER32.dll.ole32.dll.OLEAUT32.dll.CRYPT32.dll................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\is-AJT9U.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):569344
                                                                                                                                                                                                    Entropy (8bit):6.1181069611039955
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:6144:AG/XQ+F4FFJaL5TBEf6ID0rq7XqHvXxUEuspBi9NlLlli8QMupzUMfNXyowyQv:rX0vaL506euHPOypA9NlGcuVNXa
                                                                                                                                                                                                    MD5:711DB2EF10B6C2AB2080698AEC6C6D08
                                                                                                                                                                                                    SHA1:5746C14FE1790A18B76CC9833F93BC72937ACA72
                                                                                                                                                                                                    SHA-256:75DDAB1826F220EB36A9EEA9CF8533C94C19BAC89D961380F3A418F6EEDB2B4E
                                                                                                                                                                                                    SHA-512:6568EA1BF41AFA461D2B529D42E0D873C9B1B109875C6010FD965AC8C3D9A0C98EA1EA747119815254BF42130B6CF699C8DC01EE6763F172AE7C57F656FAF7F1
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......O..x..l+..l+..l+..q+..l+..c+..l+..1+:.l+..m+5.l+..3+).l+...+3.l+..2+..l+..6+..l+Rich..l+........PE..L......>............................Wy..............................................ye........... ..........................(........`..@...................................................................P........................................text...l........................... ..`.data...$g.......P..................@....rsrc...@....`.......*..............@..@.$.>.....$.>.....$.>.....$.>.....$.>.....$.>.....$.>.....$.>$....$.>1....$.>=....$.>J....$.>V....$.>`....$.>.....$.>m....$.>y....$.>.....>.....$.>.....$.>.....$.>.....$.>.....$.>.....$.>.....$.>............KERNEL32.dll.NTDLL.DLL.msvcrt.dll.ADVAPI32.dll.certadm.dll.certcli.dll.COMCTL32.dll.comdlg32.dll.CRYPT32.dll.CRYPTNET.dll.CRYPTUI.dll.GDI32.dll.NETAPI32.dll.NTDSAPI.dll.ole32.dll.OLEAUT32.dll.RPCRT4.d

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\is-D18FS.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):194560
                                                                                                                                                                                                    Entropy (8bit):6.205031289220213
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:5zl9QQSzT2uPMB3j75Hz+CyJd8LBJK3oOuJLfabM5y5N8HJjpnssxshVh8:SxMBz75HCTdwBJKYhJoMgcHXU
                                                                                                                                                                                                    MD5:00709952D444EAE14DBBD30D36FBAE0F
                                                                                                                                                                                                    SHA1:1949D2DE6E367A893AACB1D2A304E6291EACAB79
                                                                                                                                                                                                    SHA-256:A65B57C68F9119940133F6680AF3644866EEBDA5378F9B6AED441FB999B50526
                                                                                                                                                                                                    SHA-512:90DFC5C886B7183C6BFD4C44DCB98771525F02090E9987999C11F5D9EB69769CADE92FFD3DFB494FFB7C5F18021A9BC6FFD09C8093B87911F250AB7B58E5A570
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........N../.../.../..[ .../.../......[ ../..[ ../..[ ../..[ ../..[ .../..[ .../..Rich./..........................PE..L......H...........!.....`.........................w......................... ......r................................I..>....T..,........V...........................l..8...........................(w..@.......$....................................text...<].......^.................. ..`.orpc........p.......b.............. ..`.data................d..............@....rsrc....V.......X..................@..@.reloc..............................@..B...H......H......H......H....,..H....,..H.......H.......H....,..H.......H.......H.......H.......H.......H.......H............ADVAPI32.dll.ATL.DLL.CRYPT32.dll.CRYPTUI.dll.KERNEL32.dll.NTDLL.DLL.msvcrt.dll.NETAPI32.dll.ole32.dll.OLEAUT32.dll.RPCRT4.dll.Secur32.dll.USER32.dll.WLDAP32.dll........................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\is-DFTCM.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Certificate, Version=3
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):967
                                                                                                                                                                                                    Entropy (8bit):7.285069566594567
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:24:efn4wJAMDMOvzn4wJAMDMx7QiaCpIOW8TpiE9Th47TBX478yHgM:on4wJAMDMObn4wJAMDMBQ2Y8TMEZh47C
                                                                                                                                                                                                    MD5:E974F555DB42ED966A918ADC7692711F
                                                                                                                                                                                                    SHA1:68E3FE56532941E5707231791F8D4A173146399D
                                                                                                                                                                                                    SHA-256:A8AFA61B6A6FB1EA42EBCAF5FE053D857470ED9F013FEEB9D3B0B9B6F010E4AD
                                                                                                                                                                                                    SHA-512:2E657AD562FE30883CA997D4C8C6F285D385448B268D1B9C881A604727F8C1F777B1C0DE6E1E07492C5AD1BD248ECBF437D86ED3EC63923555F994A69BEFCFC6
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:0...0..........:...0...*.H........0..1.0...U....US1.0...U....Unknown1.0...U....Unknown1.0...U....iServiceSoft1.0...U....iServiceSoft1!0...U....localgateway.iDentalSoft0 ..230117100200Z..20730104100200Z0..1.0...U....US1.0...U....Unknown1.0...U....Unknown1.0...U....iServiceSoft1.0...U....iServiceSoft1!0...U....localgateway.iDentalSoft0.."0...*.H.............0..........8u...?..p.VF59.Nx..6y .^.El..b....^ei.9.t..K!.z$......VX.W.Sx....I#.0....#....~.5H....G..}.r.,...D.....S...a...yX.....rx.. ...Z...!..J(._>.H3.eo.Fv......7......j.G(q....iGZY5..._.'..%...Ij.I\H.b.2..2z.S02....a..u.$P...;..59.K...._-RQ..c.a.]-......=0;0...U....0.........localhost0...U.......&.0].......3...RD.0...*.H..............L.O^#?..........%...(...W.,....|.Nf.S..p..*...u..3.0......$.#.xU.....P.Y..-..QDu7...a.]..,.?...D..m....J..#....t.....R...7.........JC_0Bp\.zu#..._.JN.I........M...3W.d.......G..:.JV..T.a.?..dK..z.....;M...@....S..)H......B9.|.Y..`....:..

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\bin\iDentalSoft-Bridge.bat (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:ASCII text, with no line terminators
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):12
                                                                                                                                                                                                    Entropy (8bit):3.2516291673878226
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:FJA4:FJA4
                                                                                                                                                                                                    MD5:22A3AA0D46289FF2EE7ED797EE859F50
                                                                                                                                                                                                    SHA1:92CCEF9549789289E51E7691AF3BF6EF73603501
                                                                                                                                                                                                    SHA-256:208984629A84A719B40A3DCF87CDDCE708FCEAEF09D4CF5CC0D71C6EE40AC1A1
                                                                                                                                                                                                    SHA-512:05BE5D8381598B34A840643C784ED74B0533F3861717D54147A3008A945F4DD1E2FB0C5FCDF6445AE9FD06C1C67614BB97EA5342EA3CC6651A09301C6C13F086
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:call run.bat

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\bin\iDentalSoft-Bridge.exe (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:MS-DOS executable PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, MZ for MS-DOS
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):33104
                                                                                                                                                                                                    Entropy (8bit):7.81661953970717
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:768:exHKmM0qauedFQFtxTXKXAx6ZQgZOgRTw7DNV7OliRBEX:eImMyTcTXfxhgZzTugiDU
                                                                                                                                                                                                    MD5:3A8BD34A555D3F6AE3EE8D35168A5A48
                                                                                                                                                                                                    SHA1:1165F4BCF314D28F5B8A7FBB8A71D82504091C33
                                                                                                                                                                                                    SHA-256:4FD9CF4BFAE33D455E9BE978E4445EB0756134F149D611E6868C4DDE73D62FAE
                                                                                                                                                                                                    SHA-512:E339E2B7883927951BC73DC8F39A6B2D18A68058FDA3CA7767586FB23E0D2A9C6DFC0DE0F5E8E8B0627282909D2C29F3EE6C405D7F1D0AA9CA9F6B8777BFA9F3
                                                                                                                                                                                                    Malicious:true
                                                                                                                                                                                                    Preview:MZ@.....................................!..L.!Win32 .EXE...$@...PE..L......M...............2..........................@............................................. ...................................................d..P...............................................................@............................MPRESS1.........P.......................MPRESS2Q............R...................rsrc................`..............@..............................................................................v2.17...O.....45..C.c'I...R.6..h..}bM..c.iF....F....].J+...*tk...|.t.....%.T... C9.."..1a.k..<X....6A.k.T..Q......~.`aN.R2.n..../7.S.806.....]..`F.....v.8.=......}......3..1+..v..*4...W........(.B..'..W1......MI.2q...tP.f....a....../..:f......D....X.........f....~.]K..#..8.TM:.e.....%.'.A..MC%:....m7i..k...p.........Y........Z.KrP&N......9..B.*.I..E\.Kpg....Yy!.[.^.r%..c...a.&..$.....V....C....p...h3.x...)...|dW.Y4.+P..;.>vw%.lQ../......e.(.V...u..h.wU..

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\bin\is-3K905.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:DOS batch file, ASCII text, with CRLF line terminators
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):280
                                                                                                                                                                                                    Entropy (8bit):5.450017723428548
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:6:hQ20bW5ed9fx0dUwxZ2/SeA40Rxh2GTxuSplexJ2dAAy:GDgq9Cdv6XGRn2GHlKAy
                                                                                                                                                                                                    MD5:8EE7FB58A606FDB8417D24FBF11D00F9
                                                                                                                                                                                                    SHA1:CDF2760380CA85299D111952B3DE5C27C48C3789
                                                                                                                                                                                                    SHA-256:4CAF86D9ED77E7F2E7E6A3C561909FE218FFE81FF8ECC61EF9C56B5B375D55D8
                                                                                                                                                                                                    SHA-512:A8570540EC22B3C4EBF37B636C0B43923E2A1AF042BBE7FAEE81E9FFC1DE44116B0D5A6B7F91D845F5CD87475FFFD24C67772F14930B1FD200BD9B39A6F43383
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:@echo off..cd....set _REALPATH=%CD%....@start "C:\Windows\System32\cmd.exe /c" "%_REALPATH%\jre\bin\iDSBridgeJ" -Xss1m -Xms512M -Xmx512M -XX:MaxPermSize=256M -cp "%_REALPATH%\iDentalSoftBridge.jar";etc\ com.iss.idental.bridge.main.BridgeApplicationMain....@if errorlevel 1 pause..

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\bin\is-DNCBQ.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:ASCII text, with no line terminators
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):12
                                                                                                                                                                                                    Entropy (8bit):3.2516291673878226
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:FJA4:FJA4
                                                                                                                                                                                                    MD5:22A3AA0D46289FF2EE7ED797EE859F50
                                                                                                                                                                                                    SHA1:92CCEF9549789289E51E7691AF3BF6EF73603501
                                                                                                                                                                                                    SHA-256:208984629A84A719B40A3DCF87CDDCE708FCEAEF09D4CF5CC0D71C6EE40AC1A1
                                                                                                                                                                                                    SHA-512:05BE5D8381598B34A840643C784ED74B0533F3861717D54147A3008A945F4DD1E2FB0C5FCDF6445AE9FD06C1C67614BB97EA5342EA3CC6651A09301C6C13F086
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:call run.bat

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\bin\is-JHDPG.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:MS-DOS executable PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, MZ for MS-DOS
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):33104
                                                                                                                                                                                                    Entropy (8bit):7.81661953970717
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:768:exHKmM0qauedFQFtxTXKXAx6ZQgZOgRTw7DNV7OliRBEX:eImMyTcTXfxhgZzTugiDU
                                                                                                                                                                                                    MD5:3A8BD34A555D3F6AE3EE8D35168A5A48
                                                                                                                                                                                                    SHA1:1165F4BCF314D28F5B8A7FBB8A71D82504091C33
                                                                                                                                                                                                    SHA-256:4FD9CF4BFAE33D455E9BE978E4445EB0756134F149D611E6868C4DDE73D62FAE
                                                                                                                                                                                                    SHA-512:E339E2B7883927951BC73DC8F39A6B2D18A68058FDA3CA7767586FB23E0D2A9C6DFC0DE0F5E8E8B0627282909D2C29F3EE6C405D7F1D0AA9CA9F6B8777BFA9F3
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ@.....................................!..L.!Win32 .EXE...$@...PE..L......M...............2..........................@............................................. ...................................................d..P...............................................................@............................MPRESS1.........P.......................MPRESS2Q............R...................rsrc................`..............@..............................................................................v2.17...O.....45..C.c'I...R.6..h..}bM..c.iF....F....].J+...*tk...|.t.....%.T... C9.."..1a.k..<X....6A.k.T..Q......~.`aN.R2.n..../7.S.806.....]..`F.....v.8.=......}......3..1+..v..*4...W........(.B..'..W1......MI.2q...tP.f....a....../..:f......D....X.........f....~.]K..#..8.TM:.e.....%.'.A..MC%:....m7i..k...p.........Y........Z.KrP&N......9..B.*.I..E\.Kpg....Yy!.[.^.r%..c...a.&..$.....V....C....p...h3.x...)...|dW.Y4.+P..;.>vw%.lQ../......e.(.V...u..h.wU..

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\bin\run.bat (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:DOS batch file, ASCII text, with CRLF line terminators
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):280
                                                                                                                                                                                                    Entropy (8bit):5.450017723428548
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:6:hQ20bW5ed9fx0dUwxZ2/SeA40Rxh2GTxuSplexJ2dAAy:GDgq9Cdv6XGRn2GHlKAy
                                                                                                                                                                                                    MD5:8EE7FB58A606FDB8417D24FBF11D00F9
                                                                                                                                                                                                    SHA1:CDF2760380CA85299D111952B3DE5C27C48C3789
                                                                                                                                                                                                    SHA-256:4CAF86D9ED77E7F2E7E6A3C561909FE218FFE81FF8ECC61EF9C56B5B375D55D8
                                                                                                                                                                                                    SHA-512:A8570540EC22B3C4EBF37B636C0B43923E2A1AF042BBE7FAEE81E9FFC1DE44116B0D5A6B7F91D845F5CD87475FFFD24C67772F14930B1FD200BD9B39A6F43383
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:@echo off..cd....set _REALPATH=%CD%....@start "C:\Windows\System32\cmd.exe /c" "%_REALPATH%\jre\bin\iDSBridgeJ" -Xss1m -Xms512M -Xmx512M -XX:MaxPermSize=256M -cp "%_REALPATH%\iDentalSoftBridge.jar";etc\ com.iss.idental.bridge.main.BridgeApplicationMain....@if errorlevel 1 pause..

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\config\is-OB3OU.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Generic INItialization configuration [TwainMultipleImagesOrder]
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):866
                                                                                                                                                                                                    Entropy (8bit):5.396532955001538
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:24:aTCte2TMzTboYObEVnJpcpNPpPLB1cO1xV5EWYV5QDZoyM:aTCtedkdEVzy3BqEzM
                                                                                                                                                                                                    MD5:BEF81DB1BC3DA757AD1852D85DF6CDBE
                                                                                                                                                                                                    SHA1:8CC6CDD15F1788C6A69E26D8690CB7115EA594CF
                                                                                                                                                                                                    SHA-256:63A7573DA298F802AB9668F3C303B02E338C6D2682D093E8E55818188F9400EF
                                                                                                                                                                                                    SHA-512:CD5332E253BDF013BA236AB8C48DA265E535B16E9CAD904B0DE49DEB95780A84B50AD3A41287DC427D05A32093A24EE20BFEA8DC5677E61009C8ACD42F55D66D
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:[TwainDSCloseExplicitly]..DS1 = PortView....[TwainMultipleImagesOrder]..FIRST_LAST_REVERSE = PortView..ALL_REVERVE = GxTwain....[Connection]..SERVER_DOMAIN =..CUSTOMER_ID =..USERNAME =..PASSWORD =..SOCKET_PORT = 18567....[CacheTwainImage]..ACTIVE = true..TARGET_FOLDER = ..DAYS_OF_CACHE = 30....[UI]..About.Width = 606..About.Height = 420..TwainConfig.Width = 450..TwainConfig.Height = 400..ServerConfig.Width = 450..ServerConfig.Height = 300..ImagingList.Width = 600..ImagingList.Height = 285..ImagingSelect.Width = 550..ImagingSelect.Height = 440..ImagingUpdate.Width = 550..ImagingUpdate.Height1 = 320..ImagingUpdate.Height2 = 480..ImagingUpdate.Height3 = 600..TwainList.Width = 1220..TwainList.Height = 250....[Perio Voice]..Active = false....[Run]..TwainInvoke = JNI..TwainDLL = twain32..RestartNative = false....[Auto]..AutoRestartTime = 30 5 * * 0,1,2,3,4,5,6

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\config\setting.ini (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Generic INItialization configuration [TwainMultipleImagesOrder]
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):866
                                                                                                                                                                                                    Entropy (8bit):5.396532955001538
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:24:aTCte2TMzTboYObEVnJpcpNPpPLB1cO1xV5EWYV5QDZoyM:aTCtedkdEVzy3BqEzM
                                                                                                                                                                                                    MD5:BEF81DB1BC3DA757AD1852D85DF6CDBE
                                                                                                                                                                                                    SHA1:8CC6CDD15F1788C6A69E26D8690CB7115EA594CF
                                                                                                                                                                                                    SHA-256:63A7573DA298F802AB9668F3C303B02E338C6D2682D093E8E55818188F9400EF
                                                                                                                                                                                                    SHA-512:CD5332E253BDF013BA236AB8C48DA265E535B16E9CAD904B0DE49DEB95780A84B50AD3A41287DC427D05A32093A24EE20BFEA8DC5677E61009C8ACD42F55D66D
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:[TwainDSCloseExplicitly]..DS1 = PortView....[TwainMultipleImagesOrder]..FIRST_LAST_REVERSE = PortView..ALL_REVERVE = GxTwain....[Connection]..SERVER_DOMAIN =..CUSTOMER_ID =..USERNAME =..PASSWORD =..SOCKET_PORT = 18567....[CacheTwainImage]..ACTIVE = true..TARGET_FOLDER = ..DAYS_OF_CACHE = 30....[UI]..About.Width = 606..About.Height = 420..TwainConfig.Width = 450..TwainConfig.Height = 400..ServerConfig.Width = 450..ServerConfig.Height = 300..ImagingList.Width = 600..ImagingList.Height = 285..ImagingSelect.Width = 550..ImagingSelect.Height = 440..ImagingUpdate.Width = 550..ImagingUpdate.Height1 = 320..ImagingUpdate.Height2 = 480..ImagingUpdate.Height3 = 600..TwainList.Width = 1220..TwainList.Height = 250....[Perio Voice]..Active = false....[Run]..TwainInvoke = JNI..TwainDLL = twain32..RestartNative = false....[Auto]..AutoRestartTime = 30 5 * * 0,1,2,3,4,5,6

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\etc\ImagingActive.xml (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):75
                                                                                                                                                                                                    Entropy (8bit):4.841975110917951
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:vFWWMNHU8LdgCfJuk3AbKcZk3Aby:TMVBd/Juw+/Zw+y
                                                                                                                                                                                                    MD5:FA671A3A8AF8266BC3DB608213E52654
                                                                                                                                                                                                    SHA1:7A0C53963A25FC95D2807096438F47A54165F0A1
                                                                                                                                                                                                    SHA-256:1E301E2B03A68BA5F589CE1D034B6C06C12BB341157FBEA9E1152AD8AEB1FB31
                                                                                                                                                                                                    SHA-512:9E4CEB2FFA443619E70750E74A97BD5830F11F4B49B3A6B08299111F7651773081288F4EFF3A1181D98320093823DE5B5F89AE4EFC5C20AD0D65AB328DE7978C
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:<?xml version="1.0" encoding="UTF-8"?>..<ImagingActive>..</ImagingActive>..

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\etc\ImagingConfig.xml (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):14003
                                                                                                                                                                                                    Entropy (8bit):4.7812930982895665
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:PQECdXgAv+YxfZ3JZ6uuJSLUHHxYpAGZCdOsQYixhhxKyGUuWjx1ORNpoYrowRlU:4N592YhZ4lAgRiLEETtDDP2WV8fGc9PU
                                                                                                                                                                                                    MD5:535B2662032DC5AF1F87768F2E686580
                                                                                                                                                                                                    SHA1:6779DC65194B716855B7B1BC89A7516CC7768F27
                                                                                                                                                                                                    SHA-256:45980149530B5D5EEC076F553C3E42A07E5D1A82C2B51C5903FCEB36E2316032
                                                                                                                                                                                                    SHA-512:29E7DA4A68B2A9AF5000E3915734597BB9B0C12DE0A18BCA96BE1D7E33B97EBC4C8504912696A4F62027D303BBF92EC22A9F24C0FBF96192B5032F1D326AE52F
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:<?xml version="1.0" encoding="UTF-8"?>..<ImagingList>.. <Imaging>.. <Name>XVAssistant</Name>.. <Icon>Apteryx.ico</Icon>.. <Manufacturer>Apteryx</Manufacturer>.. <Description>Apteryx</Description>.. <Executable>XVAssistant.exe</Executable>.. <CustomParameters></CustomParameters>.. <Parameters>.. /p$Lname, $Fname::$SSN::$Pid::$MM/DD/YYYY::$Sex.. </Parameters>.. </Imaging>.... <Imaging>.. <Name>XVLite</Name>.. <Icon>Apteryx.ico</Icon>.. <Manufacturer>Apteryx</Manufacturer>.. <Description>Apteryx</Description>.. <Executable>XVLite.exe</Executable>.. <CustomParameters></CustomParameters>.. <Parameters>.. /p"$Lname, $Fname::$SSN::$Pid::$MM/DD/YYYY::$Sex".. </Parameters>.. </Imaging>.... <Imaging>.. <Name>DataGrabber</Name>.. <Icon>Apteryx.ico</Icon>.. <Manufacturer>Apteryx</Manufacturer>.. <Description>Apteryx</Description>.. <Executable>DataGrabber.exe</Executab

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\etc\TwainActive.xml (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):71
                                                                                                                                                                                                    Entropy (8bit):4.84828757029471
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:vFWWMNHU8LdgCfpTXSEMLRy:TMVBd/pTX3KRy
                                                                                                                                                                                                    MD5:825CDA711A72A8B8756D7A5EB22300C5
                                                                                                                                                                                                    SHA1:93F05F0AC01E70E9C5E1CE8A36F5C0038D45D158
                                                                                                                                                                                                    SHA-256:56059CF0AEE9938F6D6C3CF614D2C481048FD83A7214F3BC115551142D260071
                                                                                                                                                                                                    SHA-512:2DDA8DACE54CD76FCBF6A426866DBAF55D927D8CC6EC3133C27007DB92D708ADEC097E10E5AFBB35B143753EE694E8B2E600F6ADB611658281D7AE83B39670A3
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:<?xml version="1.0" encoding="UTF-8"?>..<TwainActive>..</TwainActive>..

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\etc\icon\Apixia.ico (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):5430
                                                                                                                                                                                                    Entropy (8bit):5.1650121167428855
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:48:QxKS+2u0CgvMb88888888888888888888888sOt83jHPKU6s6m8gkAm4dEkzIjII:gkxyZtwKU61Am4dJxDn2G+gDpDcqA
                                                                                                                                                                                                    MD5:7624E33D3C3F0872B824E9A41B54504E
                                                                                                                                                                                                    SHA1:1808F62B437FEE37DB842B6D1EADD051C3615647
                                                                                                                                                                                                    SHA-256:2336CEEBB59093DDFDA6DA16C28DFE681D368D50F8B37A076B6F9C4CF9DE723A
                                                                                                                                                                                                    SHA-512:4D2143B16D6E010DB7364F7B67CE2BB63A9C5125267A9FE527281257BEACAD1D2AB0859475D0807DD51343B2DB82E092F77D98882FC38D2750B349755CF2CD3E
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:............ .h...&... .... .........(....... ..... .....@....................../............................................DDDi...........................................................................................................................................b.......................+..............................]........................R..............................]...........B9$.A:$.]e:.=bO.'...............................^.........".2F;.3.f..!). 28.!................................]............8.......)fY. 4;..................................^......%.....1.}.....*WR. 5=..................................^....z.S."<=...&..;;......0:..................................[....;...'..%...$.../...,........................................&... ..............................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\etc\icon\Apteryx.ico (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):5430
                                                                                                                                                                                                    Entropy (8bit):5.742855350275551
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:96:SRhN7Z+z0ZZZZZZZZZZZm+XXXXXXXXXXXXXXXXXXXXXXue69wHm5z/W5OkMaKuxB:qhN7Az0ZZZZZZZZZZZmLeAR5zJTaKMhr
                                                                                                                                                                                                    MD5:75E44A55C7E41BBA4030425F252E2BE9
                                                                                                                                                                                                    SHA1:9AE4C57C6EEC99E69B7CC474644C09D0429E05C5
                                                                                                                                                                                                    SHA-256:6036F9FCBB9026E139052FBBD174D9C970801C2AA2EC32ECE16D454C58026558
                                                                                                                                                                                                    SHA-512:6873C55D6CFFA78A81E5048D3AD54E488F5F3CB563DF61840784CE154364F47AA7FF8BE725308EA7ECC9AF7DE39E2C4F3F7B2DCFA9A26BEE88A3FD75A12ED414
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:............ .h...&... .... .........(....... ..... .....@.................../../1!..0.../.../.../.../.../.../.../.../.../.../.../...*......i;'...S...S...S...S...S...S...S...S...S...S...S...S...S...R..$...?*...R...T...V...V...V...T...`....T...z...e..d...U...V...R..'...>)..|P..}S..~V..~V...W............................L.~S..|P..'...=)..yO..zP..zQ..~W..................................Z..yO..'...=)..vM..xN..yN......................................R.vM..'...<(..sK..rI...~N..................^1..e/...z...........h.sK..'...;(..oI..nH.............}]/.b8...m<.|Y%.............wH.oI..'...;'..lF..rO..........lF..e?...d2..h7.pN&.............rO..lF..&...:'..hD..qS......]?..`>...k>..h7.X3..................dB..hD..&...9&..eB..cB..];..dB...xP..kA.gG....a.............gE..dB..eB..&...9&..bA..]A..dL...xQ.^B...tK...x.............kP .\?..^A..bA..%...8&.._?..\=..\>..Y;..`D..................]A..Y:..Z;..Z;.._?..%...7%..\>..[;..Y9..Y;..dH...lE.x`4._C..V8..Y;..Y<..Y<..Y<..\>..%...5$..Z<..Z<..Z<..Z<..Z<..Z<

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\etc\icon\BioPak.ico (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):5430
                                                                                                                                                                                                    Entropy (8bit):4.126867539090609
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:96:RcPPZtjVVvamBCFSa8wKFUnWuOjPzqTF:RcPPZ1VVvwFSaCUwOZ
                                                                                                                                                                                                    MD5:2959B1971D7CFC9C32BD7493B49AEF47
                                                                                                                                                                                                    SHA1:F5D804DE7C62B237E0689E7D360522180FA68F05
                                                                                                                                                                                                    SHA-256:C1D4AFFE49E6F45B441198A6E6DBF0A9ECA6A83B4849252CDD614ADEF60AE4E0
                                                                                                                                                                                                    SHA-512:1680B36C3A1F05DEF6EF6EC45EF2EB64A0302C5BCAF30792227227962EB7BAFEBEC01967FD8BCD88F4D55E866B4EE35EC72BE0564BD2D1E7ACAE45C059E2B961
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:............ .h...&... .... .........(....... ..... .....@....................../............................................DDDi.................................................................................................................................................heo.`_c.[\[.^[\.gc`........................................CX~............................................................CT~.0...............s.......^D'................................CT..8#.....................N4.................................CV.. ..._^T.[[Z._\\.6BM......}a................................CS.......................rN....................................ES..'!..............Wbz.!.....................................ES..+%..............{........pd................................GW.............................................................v|..444.111.111.631.C53.................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\etc\icon\CDR.ico (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):5430
                                                                                                                                                                                                    Entropy (8bit):4.326199052290956
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:96:xArZa7T+e60lbujh547xkCAQXKSd4WqTF:0Z4n60gjhUx4dBZ
                                                                                                                                                                                                    MD5:A47277E449782AA8A7B97FFF087DD164
                                                                                                                                                                                                    SHA1:D9B0A2D7868462B4DD98AF393E303E5412682D8B
                                                                                                                                                                                                    SHA-256:9B10F6E01D9C0E87E6F0EF4D59C393B63C13979A7386407460E9B1092D48EB8F
                                                                                                                                                                                                    SHA-512:96F2F4D3837629906B38D46BBCA24FE35068B6A273F84E170D29831B5FAC707BBA499DEAFF06237758B715CCFFF1AD58985227ED11107FA09C2B1189C24E01B8
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:............ .h...&... .... .........(....... ..... .....@....................../............................................DDDi.....................................................................................................................................ju.....................................................................es..w..................................................................er.....................................................................`q|................................................"...............any............................................*...................ds~............................................................r...gv.............................................................iv..gs.....................................................q|..lz..kz.........................................................{...x.......................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\etc\icon\Camsight.ico (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):5430
                                                                                                                                                                                                    Entropy (8bit):5.954137511303142
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:96:g31rpOb7PEzYUk4LM2iUYUqgtT9/5WzIkX37Tnqa7f7yHvh5vxXRFa+bs:g3CX+YUkgMoq/zDbxf7yH5PLa+bs
                                                                                                                                                                                                    MD5:F8A015CFD6BA992A1C1140E2BDA37BE8
                                                                                                                                                                                                    SHA1:4D8A170DC5E5B1824D4A968B8632E891794D8170
                                                                                                                                                                                                    SHA-256:39589C4D2BEB47E4903579A3C065E03C052FCCD984F4D18B9CEE4891173FAB38
                                                                                                                                                                                                    SHA-512:7CED6B59C6819A9826F6E4884FA08E27A5C6609E4A3B995B9AE6369714F5373D48B0EA3AFB317C2F8EE208D15E0A814030A0BC855255AB32058BBE6F33105C60
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:............ .h...&... .... .........(....... ..... .....@..................."S}?Qi}.Ro...x..u.............q..Y..{Wy.yVm.qF^.Y8H.)..s:Uq..Gk..{....l..u.......................n...b..}=S.l5@.O"&.F*3.^........tS.z80..].....................s...`.........wLc.jGV......rQ......&).....>=:.............qYn.EEb..(-.........0.,.1.....9QZ............./k..................&....bx.|z..........#:B.._h.............6...........%........Pa......cy..59..;E.....#FN.}jv....._ou..z|..Y|.xv..........f............bw......EP.....#JQ.xo......2/3..XR...8.jY.......................r.......r......#JC.wa...........)-.....IRu.....Nnn.b...........................#<C..Md......-:.........1Mj.................%.......;...........#;C..8D..........Zn.....IMf.............@.../.......+a..........#>S..7>.n @.........O....Nd.........?z..U.6.........1i..........#U..k7;.t...t....==..=$...,.....}."...+.A.A.-'J.i...._...N...U..#P..g77.?...L...r...........w...m...I. .A.".".E.d....F...I...W..9a..5)).+...@...C...C...D...@.

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\etc\icon\Cerec.ico (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):5430
                                                                                                                                                                                                    Entropy (8bit):3.7609111188818263
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:48:05Yaffc04Mb88888888888888888888888sOtK+HRwSpgAocxK7AKi3V87IcpkEk:05YU14ZtK0TvKq3VAIchiAqTF
                                                                                                                                                                                                    MD5:B227552BC9797224D4767C16A69744A8
                                                                                                                                                                                                    SHA1:B7EAEEACEF7C7D28B48733CD37C285F590CE4B62
                                                                                                                                                                                                    SHA-256:EA2FC3F37AAF2B8FDFD3722F438A00FE03EE9CA45A2F2203610208BF882CD7E4
                                                                                                                                                                                                    SHA-512:A44C3B97495ED200B20C68DEF0D0CCC0926229AEEF5A5B73D6E695070283521E5732AD494AEF58B6721974D73DA5FAB95F8E00FE25E7F6DE4013FDF757870009
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:............ .h...&... .... .........(....... ..... .....@....................../............................................DDDi.....................................................................................................................................................U...................k..............................................3..................................................Q.......I...................................................................................................................................................................................................................................................(..............................................................}.......-..........................................................B....... ...i...{...Y..................................................5...........................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\etc\icon\Cliosoft.ico (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):5430
                                                                                                                                                                                                    Entropy (8bit):6.39094211632833
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:96:KgG031He8IX+6BjL7ERSheSh+61KgUfPYe0AavXGjr+LLeis1h29avRfR:JtuX+65heSf1KgUfP5iXAS/ef1h2cvR
                                                                                                                                                                                                    MD5:71D1B7494DF733FCE0AC9AD3045F3CA8
                                                                                                                                                                                                    SHA1:E322A20E95C4D7D3495F7DFF91630BCEED3FF8B6
                                                                                                                                                                                                    SHA-256:61889ED914DB4A160E92492714C84E76250CD7DA27675DB02FF1E92E172B1EA0
                                                                                                                                                                                                    SHA-512:730875F205F2EA4FCAEEB7C1D9B870F59EB321CAFD58DFAAFF3BDBC1DF8E47EEA096670A622D0318DB2D88EF895C74766F49FB2996BA3F4CADC8ED95703FB4DB
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:............ .h...&... .... .........(....... ..... .....@...................uP!.mE..kC..iB..g@..Z8..V6..c=..e?..d>..c>..c>..c=..b=..b=..mN(.yN..rF..pD..oD..c<..Q4..oY?.fA..d=..Y6..`:..g?..f?..f?..e>..mI...W...N..}L..yK..e>..ph^......iE.^8..[@..kL%.pE..qF..qF..pE..wP...^...T...S...P..kM&..........yY.oT3.........tG..{L..zK..yK...U ..j-..W...V...Q..|fJ.............vfQ..........a2..P...O..~N...X!...U..]...W...Q...x`.............ypc...........d..Q...R...Q...["...U..{E.._..}K..ziS..............................Q...U...T...]#...S..{D..{F.|U$..yp.............................~M...V...V..._$...P..x?..s?..}c..................................h:..W...X...a%...K..s9..m9.........................................Q...Y...c'..}F..o2..p>..........................................`&..Y...d)..zB..j+..r=...........................................b..b!..m4..w>..e$..g).............................................|D...[..u:..]...^....i.......................................b..t9...U..G..n{..p{..wy..........

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\etc\icon\DBSWin.ico (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):5430
                                                                                                                                                                                                    Entropy (8bit):4.158616714067292
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:48:mee4K5zMb88888888888888888888888sOnegg3k3pz/pumzC4rcUFggTRqG9tU8:Te4K5zZeggaVhumzP59tN
                                                                                                                                                                                                    MD5:FFDB6D1A43963357C82EC085199B604E
                                                                                                                                                                                                    SHA1:33F01A85589D9DD196BF44CD598F5B746AF32955
                                                                                                                                                                                                    SHA-256:22CA7A2FA9871B24C9F53E84025D48C0B186C6CFE2C7BD2248DF221ED4371288
                                                                                                                                                                                                    SHA-512:DB8FF985AAE5032327BE14C390F3D44F105D9FE53E82057C92B627C723171B9572EA8C98EE1FAA6DF63254A64803A0DF5C2AB359AC34CD6CB4495C961D6C2B70
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:............ .h...&... .... .........(....... ..... .....@....................../............................................DDDi.......... ......g.....{...{...z...V................................... ......h.....z...{...y...U................................... ......i.....z...{...y...U..........................................h.....z...{...y...U................................... ......g.....z...{...y...V................................... ......g.....z...{...~........................................ ......g.....y.......................................................f.....~................................................ ......f...................................................... ......f....................................................... ..%...........................................................'............................................................%..............................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\etc\icon\DTXStudio.ico (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):4286
                                                                                                                                                                                                    Entropy (8bit):4.374141712392226
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:48:388888888888888888888888sOikt5zaQIqJqZ7lIOV1Nwgxwq4wBQT9BCBQ+/QO:0iIzaJZIMIOBQ+KKMqTBn
                                                                                                                                                                                                    MD5:1EB6209FD331BFBD717D7EB80B72FB49
                                                                                                                                                                                                    SHA1:44E8BCDC8DF36D1D903640B0F82AD2599BAA5BF3
                                                                                                                                                                                                    SHA-256:057494206D637F8EEF2088FEAF1AF791FA9BC2218C48D857BBBC2E349193248F
                                                                                                                                                                                                    SHA-512:A951AEEAC6BE1E43A26AE78DE7C70683B8557BE835D252D1F8D4922774CCC433C6F20682BEDC2B20FED0A4A77C24BC10BEA87890A495272721992853F8AE2A16
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:...... .... .........(... ...@..... .................................rrrYkkk.bbb.```.```.```.```.```.```.```.```.```.```.```.```.```.```.```.```.```.```.```.```.```.```.```.```.000....[...(..............................................................................................................................S...,...........................................................................................................................j...S........................................................................................................................;;;....S........................................................................................................................;;;....S....................................................x.{.dn^.............................................................;;;....S................................................i.p.j.o.[cU.............................................................;;;....S......................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\etc\icon\Default.ico (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:MS Windows icon resource - 6 icons, 256x256 with PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced, 32 bits/pixel, -128x-128, 32 bits/pixel
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):101492
                                                                                                                                                                                                    Entropy (8bit):2.83646037035569
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:768:w1ssnssnssnss7333zXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXfPm:GssnssnssnssPnnnrvvvk/r/T7KiZ
                                                                                                                                                                                                    MD5:07B5AA1189C6599C1AF9F113412CFD29
                                                                                                                                                                                                    SHA1:922BE5006B7BABFEA061784B618B12627B21AA72
                                                                                                                                                                                                    SHA-256:108565DCCD2DDAE83278A245078E3514DE5616B074C6AA820CA053AD193251E4
                                                                                                                                                                                                    SHA-512:6BE4E4E0A276B448A385FA21CB1339A27368D9CA8CA8AADA30EA9908D71838C9C4330F6D4A3CD1FD9B740CEF7DDDFEBB6C6758486D11E4D22D87D2C5CD156EF6
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:............ .....f......... .(...l...@@.... .(B......00.... ..%...Q.. .... .....dw........ .h........PNG........IHDR.............\r.f....IDATx....k]u........_.v...TPR(...."......FWn.Hg...@.W.nD..AD..RZ....Z.mq...*Vc#&qz{...|.C86..}.....'..Uv.....o.Z5;;{f5_.].? ....`............&..l....G.>]......>.......w..[...dqq.j...{....@0..`............&..l..}..px.....3]...i..V..\(.....j.o.M..............&..L. ..@...`p{.....Q.;...grr...a5.../..............&..L. ..@..I..x....@?Z.................&..L. ..@0..`.....J}[....z..z?y..?[...W.}jX..m..?]Y.7o.....a...F..jw............&..L. ..@0....?....O......zo........O5...y}._...g........................&..L. ..@0..`...h.z..T...I..j|_..y.k..}..z..8.>.X....!|.}.....'.........u...]..............&..L. ..@0..`....Z...tY......?.c..p.._;Y..-......[.X.......k.P......5...C.:..~W..............z...[.K........&..L. ..@0..`...z....w.....^..[...................7..............u?../......__.{.~....<..S..k.o.+G..L. ..@0..`...........:.W

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\etc\icon\DentalStudio.ico (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):5430
                                                                                                                                                                                                    Entropy (8bit):5.519304841232682
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:96:QlB9yfwWiNs3NqQtUZZXruiwa4D+rDM/Xt8U9AarTT7vfp7+rf0r:bwWz3MQaZZXiiv4uMvP9tPT7vfp7+rf
                                                                                                                                                                                                    MD5:78CAB5D8750CD6CD6F5ECDFCA1F21936
                                                                                                                                                                                                    SHA1:588F9B76484988458FEADD047B2A8CB8B371F8F0
                                                                                                                                                                                                    SHA-256:5E89608DC7C75426D39172A1D4B4C59D5805D0F8BE0AFEE321D0F6B205EE34D2
                                                                                                                                                                                                    SHA-512:4CDC2851CA01D04A85FD8FA0E07D0D0F82977CFD1464EF6426A13870F0ED8AE9F73FEC1C3A4CA59A5467F53ED2BFC8DD995A277EFAC0D556427265F175BE8B69
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:............ .h...&... .... .........(....... ..... .....@....................p./.l...e..e..e..e..e..e..e..e..e..e..e..e.._..A).i....I..v...5..z...I..t...0..t...B..z...3..[..4..%..Z......F..r..........D..s...E..x...A..z...A..+..D.. ..]........./..............J........M........%.....]......@.........E..@...........$...u.....-.........]......C...R.....,..)......Q.........D.........|.....].................................................].............d...g...i...G.........X..3..............]..........^............................................]....................I......T...............r...........].............K....................?...................]...............................W......m...............]...............@...............................E.....].....................................M.....6.....].....................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\etc\icon\Dexis.ico (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):5430
                                                                                                                                                                                                    Entropy (8bit):4.449163255076371
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:48:FFUIrjaZXNyQRDXMb88888888888888888888888sOtHfWwQ/pCyKMPqQOL7qpmB:btXw9rRbZt/+/pzqhfaSsqTF
                                                                                                                                                                                                    MD5:C34E0B32C3D75220157598B36FB4DC0C
                                                                                                                                                                                                    SHA1:AFD5501ACD26710A8577A123A1618DDFFDFD4EBE
                                                                                                                                                                                                    SHA-256:1B092013CEB2B6A315D7BC5A9DA2EB6E52F37A840F3AAF0ECC50CDA274979BC2
                                                                                                                                                                                                    SHA-512:854A765516F7B661C04736AE3132B1519A79019C53E56ECCC908257123F01283DA1C2597EB84E47F7ABC2BD33CD80FFAD2A8C82637CED6C7CCA4322EA70C4A73
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:............ .h...&... .... .........(....... ..... .....@....................../............................................DDDi..........................................................................................................................................................................................................Z}..f...`...Z...[...\~..Yv....u..............................._...h.....`........s.4.d..._~....o...........................c...e...................i...g...`y............................c...e...................{.A.d...^.............................c...e...................p.-.f..._.............................b...e...................`...i...bz............................`...k...m.&.{.?.g.#.^...a...\}................................^{..h...g...g...k...o.,...W...........................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\etc\icon\EZDentI.ico (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):5430
                                                                                                                                                                                                    Entropy (8bit):6.04232917122418
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:96:IZtqxZMYB+RIIWkDDHJ+ZbIbTTTdORL6:IZxR5DHJ+ZbIbTTTdOR+
                                                                                                                                                                                                    MD5:6F43EBF5D287D8C8428E766B0E8EA5D8
                                                                                                                                                                                                    SHA1:C53B3F04CB562C50AC34A766B8990E3364E6783B
                                                                                                                                                                                                    SHA-256:3ADD2F2B7B06BD0D51689AEAED0DA1FAA50704EC261C138DAAB884C564982BD7
                                                                                                                                                                                                    SHA-512:8CE8975AEA61F876862ADFBADF2AD4B634A86E9806CAD8F8F57CDA89E4DF7BB26BFAA72DDD1AC56EF70352BD302ED0576A2D064D2B579D3999611A1AE44FB327
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:............ .h...&... .... .........(....... ..... .....@....................../............................................DDDi.................................................................6y..9{..8|..:~..<...=...>...@...A...A...B...C................<...<...<...=...>...@...A...D...F...D...H...I................>...@...A...A...B...E...G...I...K...K...P...P.................@...D...D...E...G...K...N...O...Q...Q...E...O."...............B...L...L...M...N...R...U...U...O...?...:...h.A...............A...R...T...T...V...\...V...F...?...C...C.....f...............D...S...]...^. .Z...M...D...D...I...J...K.....................K...Q...a.#.U...J...G...L...P...P...N...Z.....................S...O...R...K...P...S...T...R...T...Q...j.9...................X...T...U...W...X...X...X...X...X...T...y.X...................]...[...^...]...[...[...[...[...[...Z.....y...................]...^...^..._...]...]...]...]...\...`.........................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\etc\icon\EasyDent.ico (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):5430
                                                                                                                                                                                                    Entropy (8bit):6.338724173782412
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:96:CcXky3dHUsQmkaJ0QWk2/6t3ohbTA9DZvAdqNH0SHqOM2mjm4DD21msa:CcXtdtQ4mR/WYhKusULBjRDD21
                                                                                                                                                                                                    MD5:5F1C29B6976D3E84D0134CF6057B0751
                                                                                                                                                                                                    SHA1:BBC840531D5FCE0A58B48C907FB21B9463B59F92
                                                                                                                                                                                                    SHA-256:3FFDDD2F7F64A8DC4B96733E9D553DF7D44C7303184D74D3D08445B1FD39676B
                                                                                                                                                                                                    SHA-512:9203348BD7CECA50966E7E1BDF07E30DA20F264F93742DD23C32A84018B5679FDB61613A8161A9081A307B035F52DEC1870329080D00F0279756BB268CBBE9EB
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:............ .h...&... .... .........(....... ..... .....@....................8./w5..q2..q2..q2..q2..q2..q2..q2..q2..q2..q2..q2..q2..r2..\'.i.:.................|........................u3...9.......5....j......U...}.............:.8.Y.C.......t3...:..........5...Ri..U..................v.....v.X.......t3...:......c..Q...W....................>.?.".5...........u3...:......a..nH......P.........S........&...r..........u3...;.........\=................F.....|...0..............v3...;.........3...............6.....l.X.S.............v3...<...........z..}`.................y.l...u.............v4...<...........]..................'.....z..................w4...=..........9...............Y...O........~........W.W.....w4...=.........>...........................Y.h...........?.....w4...=..........7...........H...............K.l...........:....x4...=..........J...W"..........|...............h.|.7._.z.......x4...=......................~.

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\etc\icon\EvaSoft.ico (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):5430
                                                                                                                                                                                                    Entropy (8bit):6.534446903772901
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:96:2iaw0rHT0oNv+XXXXXXXXXXXXXXXXXXXXXXeft1iMtfRankQX4OoYUTIpzA40fhL:krHT0qvTtDl9QoBT8pz50fh7BBolgdd7
                                                                                                                                                                                                    MD5:B48DF85230D81D95600737CEC935AB04
                                                                                                                                                                                                    SHA1:A928C5A9A970A270E5C4AC980F6B3A67D2FF6AD4
                                                                                                                                                                                                    SHA-256:D728115E0B4DBC4CFCA32646F7EEAC0B7799A3C3A0269377ED93A76EC7D71ACE
                                                                                                                                                                                                    SHA-512:122E0111C9D89B7D4CA8142362268FBF840A6AA08924D92C5A2EB05975EE87885029FFAA83DF6B87099DB071764F1A66F5BB49FA76630E7243099D59E06F667B
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:............ .h...&... .... .........(....... ..... .....@....................../1 ../.../.../.../.../.../.../.../.../.../.../.../...*......i:&...}[..~\..~[..{Y..|Z..{Y..tT..{Y..zY..|Z..zY...\...\...\.$...=(...}Z..\..wU..oO..fK..gK..bH.._F.yV@..jM..aH..zX..\..\.'...='...yW..vU..vU..xW..{W..yV..qR..zV..xW..xW..|W..wV..uV..~Z.'...<&...tT..tU..rV..wW..uW..wV..tT..sS..xU..rR..pP..vU..uV..|Z.'...;%...v[..v]...c..pX..~b..y\..nQ..oR..pS..rS..qS..sQ..jO..~Y.&...;$....g...m...k..u...q...f..i...`..^..~Z...Z..sU..wX...Z.&...:#...t.....~...s...p...m..~e..y`..uX..qR..oP..pQ..Z..\.&...9".....oZQ........... ....... ...!... ...!..."... .1)&..~Z.%...8!....w.....l[Y.................z..m..c..iS......hL.%...7 ...qh.....4//.?87.>77.>63......}.YG?.H91.H7/.,&$......sQ.%...6....zt.....RKK.|po.ykj.vge....RGD.....]IB.dMC.fM@..gM..[.%...6..........JDE...............TJG......hU..hO..bH..aF..~Y.%...5..........535....................1//........... .&!"..}X.$...3..................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\etc\icon\FloridaProbe.ico (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):5430
                                                                                                                                                                                                    Entropy (8bit):3.539060901194267
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:48:iKXkfO7udMb88888888888888888888888sOtTWoEjJ2cZZR7r4qTMrI:iwkW4ZtTxUZZcqTF
                                                                                                                                                                                                    MD5:37B3433341CD64B837BB4A898FAC0952
                                                                                                                                                                                                    SHA1:5652E1C546541CD12C7219FC66DACCA7DCDA437D
                                                                                                                                                                                                    SHA-256:D898A0FBBB919331F5A360EA3C712865F318286D2EEE1E55CDEDA0FB6CD3762C
                                                                                                                                                                                                    SHA-512:BD1521DF615EA07C3900AB135F4FDA861CCEFB096ECA1827FA54095BB1AC660D90A92917BD40B145F169B947BC438F5CAE6F9A871938A098CB8A93A0366005E1
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:............ .h...&... .... .........(....... ..... .....@....................../............................................DDDi.....................................................................................................................................................................................................................................................................d.......................C.........................................=...N...P...n......I......?...B...3.........................|..................Y..................F......................>..................t..............1..........................y...v...s.............?..@..=..................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\etc\icon\Kitview.ico (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):5430
                                                                                                                                                                                                    Entropy (8bit):4.569053497291155
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:96:n9xcjYYYYYYYYYYVlwwwwwwwwwwwwwwwwwwwwwwwQp3jiIG7FNe6NN3mvMjM2:IjYYYYYYYYYYVlp3WIQFNe6v3mvQH
                                                                                                                                                                                                    MD5:96C7CF20FC12C0E144E84242766BF454
                                                                                                                                                                                                    SHA1:032533305F1888CA41909AE182C0B8CB93F1EE92
                                                                                                                                                                                                    SHA-256:0F4C56F5AD9D8F2FDCFD29DE709DA79ED245D3C7352BF318C3A74EE987877D65
                                                                                                                                                                                                    SHA-512:9360479F7DDBB06897613F047369A4E37B2BEF0CA582E229F5675C67365A9ECD0828273AF8B45ED99367F940978AD16F58F8E1888C813049EA4A0C5CF19B75C1
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:............ .h...&... .... .........(....... ..... .....@....................../............................................qUGi...............................................................................................................................................................................................".................................<....._.................&.................................+......x.................&.............................~...........................&...............................D.....................&..............................Z.........................&...........................F.............................&................................Z.........................%.................................x......................{...g..............................g...f.....................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\etc\icon\MeditLink.ico (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):4286
                                                                                                                                                                                                    Entropy (8bit):4.808717884648094
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:48:388888888888888888888888sOMZ0cYyWfCxYCtp375T6ly9vksGasMMDplXlWnz:0MjYyMA1P9vkVasNDplXlUFVTn
                                                                                                                                                                                                    MD5:42E4043747E6D753D2CF76A7B71A62E7
                                                                                                                                                                                                    SHA1:C0C2DEB0BD439BD89819C32E5B452A8FBECF4310
                                                                                                                                                                                                    SHA-256:DA8D3905DFD250043B63EA3D053D269374E055D83CBFD48BF6E3F8917517AB5B
                                                                                                                                                                                                    SHA-512:95364621D8FC54BB7D4FB454A74E1ABBD2D331E11EDFA55D557F101D025F8FDCED37418F55FCF303F698BF6AE5D30D194E6F7B5DC604ECA39EB343F400E706F0
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:...... .... .........(... ...@..... .................................rrrYkkk.bbb.```.```.```.```.```.```.```.```.```.```.```.```.```.```.```.```.```.```.```.```.```.```.```.```.000....[...(..............................................................................................................................S...,...........................................................................................................................j...S........................................................................................................................;;;....S........................................................................................................................;;;....S........................................................................................................................;;;....S.............................................................................................................;;;....S.............g..I...U...S...S...O...U

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\etc\icon\Patterson.ico (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):5430
                                                                                                                                                                                                    Entropy (8bit):3.5484020380230037
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:48:Z2UeGNIVMb88888888888888888888888sOtPi8Ftrh8+dLrTmD6RsW+EDq+qTM8:ZBe5VZtPi8FtV8Ory6Rr+E2+qTF
                                                                                                                                                                                                    MD5:205703559E284DBFB4650D2360FA8A68
                                                                                                                                                                                                    SHA1:FCE92E28247938909C311B76B0BFCD9EF191A6A5
                                                                                                                                                                                                    SHA-256:76737FAB19F4E3B14CD115DB4D743F87A638A87DBD6C0BB717C137DA3BFF0561
                                                                                                                                                                                                    SHA-512:2C5DF4FE060FC47F7739DCC0B5AD1468A165F9A4C8CF1D420B9F992FC4019CD3B15E7C828E3CEF91616F17EF8BFD23498BE8E71ABA31C17149EA72E8134C1EC1
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:............ .h...&... .... .........(....... ..... .....@....................../............................................DDDi......................................................................................................................................................................................................................................................................................................................................................1...................z......................w...F..........................."...........L..................e.......................................=...s..........................$...............&....................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\etc\icon\Planmeca.ico (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):5430
                                                                                                                                                                                                    Entropy (8bit):4.614263552707331
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:48:WYMJ51dEJtiypMb88888888888888888888888sOtzM0pSV2TocNILOzkcm8D3fA:gJjdYJpZtTSV2rqhS3f1AAZVqABMF
                                                                                                                                                                                                    MD5:D5E842A98FE9B268125AA78E0336028B
                                                                                                                                                                                                    SHA1:5B9D968A0AF3B12F67BA4F7AAC395CE73E222F68
                                                                                                                                                                                                    SHA-256:0F423E5666B679EED1EF35327E6D68F4B940203DF10FE0F96E100744F60DE276
                                                                                                                                                                                                    SHA-512:D629BFDEAFBCC6E328A423DC47082AF70A9937F2282EA7E4A89D80B411F16B88981EC53AE65C2466EEFFECE559364939C3165F87DB3F1591F0618B72391A74CB
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:............ .h...&... .... .........(....... ..... .....@....................../............................................DDDi......................................................................................6............m.....................................a.................@...u.............................p..x.............s.........................................R,.........................................................Y.......................T4..............................d..Y2..... ..................v..Y6..........................l..V4..~.....................wW..0..............................T-..X3..w...R.............4...0...............................[6..Y3..S/..x.............6...0.................................R*..{....................5..........................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\etc\icon\PolaroidDDS.ico (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):4286
                                                                                                                                                                                                    Entropy (8bit):2.193962304617272
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:24:suhytRB/sVMkTy3V6U+++2ndlyk5avFQtU4aRw/Ayuiaxaxaxaxaxa3:M/sVk68zyk5quaRB5ccccc
                                                                                                                                                                                                    MD5:E58B8272D6D64BDE0E652BF58D4F57EC
                                                                                                                                                                                                    SHA1:0A678793484446B3B2638A01F6E3254E1838FB65
                                                                                                                                                                                                    SHA-256:1269977833E32E20251A2E9393F40223C22D4A1A8F68D98D8403557E3F59B441
                                                                                                                                                                                                    SHA-512:4AC060123B52B6D15D46F5A46821C5BC5F689D6BAA9F49B50DEB49C85F9FD16853F9654657EB536315280D5BF11AC7CE31FB5CF03A20049FCE345EBDB1E6225B
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:...... .... .........(... ...@..... ..........................&...&...&...&.......I.......w...v...w...v...k....................................P...l...l...j...r...y.....{..............Yg..Yg..Yg..Yg.._[..L~..C...P...N...N...P...E...<...>...>...>...>...>...<...M..Y..U..U..W..K..E...V..G..P..O..O..O.................................................................................................................................................................!...".....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\etc\icon\PreXion.ico (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):4286
                                                                                                                                                                                                    Entropy (8bit):4.277896816135347
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:48:388888888888888888888888sOUL6wPeaAsWGbzL+ZtJqtA5V90xn:0UL1WLd+L+ctAV90xn
                                                                                                                                                                                                    MD5:A417DCF2B603689028DCC264678AA2EA
                                                                                                                                                                                                    SHA1:B974B5E5C4B0C41025D453657D2E03F8524056C1
                                                                                                                                                                                                    SHA-256:87662D392C329043BD5EFFB0FF893D4231641740590B0FFE5204E3FBED31F5D4
                                                                                                                                                                                                    SHA-512:51337BC3BD0D461CB7E2424D6551B7513EFDEA9525E64977EF86CE7553C745F1B5E765B87B8E0DCB303B464350790EAF9931CF3BBE0DCCDAF93867372A00D577
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:...... .... .........(... ...@..... .................................rrrYkkk.bbb.```.```.```.```.```.```.```.```.```.```.```.```.```.```.```.```.```.```.```.```.```.```.```.```.000....[...(..............................................................................................................................S...,...........................................................................................................................j...S........................................................................................................................;;;....S........................................................................................................................;;;....S........................................................................................................................;;;....S.......................................................................................................................;;;....S......................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\etc\icon\ProImage.ico (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):5430
                                                                                                                                                                                                    Entropy (8bit):6.413762448683329
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:96:L++++++++++XOyN162tV/r4gNVjFYQd77/vvTwk0g:L++++++++++Xz16UV/rtNVFYQZ7/vvT7
                                                                                                                                                                                                    MD5:0914E958FD2FEB87770E31A3F820B1F4
                                                                                                                                                                                                    SHA1:4ACD80235564B1289A699F701A7A702E59D7C56E
                                                                                                                                                                                                    SHA-256:093263DC44273B1700CFB93E24747C626946C795988F2BC5E6F6897DBCADFDE6
                                                                                                                                                                                                    SHA-512:6AE99DDECC19874AFCB09FC7B72F2EFC7C2F05035AEB0E48A35A390DF264C9D25957582F3D4817189830923A52CA846E6A8482A3CA076145181A20C9FFEA6692
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:............ .h...&... .... .........(....... ..... .....@....................../!..."..."..."..."..."..."..."..."..."..."..."..."..........i'....J7..J7..aM..R=..S>..S>..A/..J7..J7..J7..J7..J7..J7..I6.....-....H6..H6.........xB1..H6..H6..H6..H6..H6..H6..H6.....,....F5..F5...........uB2..F5..F5..F5..F5..F5..F5..F5.....+....D3..D3............n>...D3..D3..D3..D3..D3..D3..D3.....*....B1..B1...........l>...RA.tG5.k?..l:,..C3..B1..B1.....)...|?/.|?/...........h<-...w........m.gD4.{A1.|?/.....(...w<-.w<-...........g=-.............`:,.x=......'...r:+.r:+...|.......oG8..xi..........eO.s@3.....&...l7).l7)...v.......oG6.l7)..n\........~b.g7*.....%...h4'.h4'..}j........}a..YD...q........uZ.b2%.....$...c2%.c2%..ra....................XE.c2%.....#..._0$._0$..n_....................v_.c4(._0$....."...[.#.[.#.g8,.~J;.wD6.|K>.|L?..QD.{MA.zL?.f8,.[.#.[.#.[.#.........W,!.X-!.X-!.X-!.X-!.X-

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\etc\icon\ProfSuni.ico (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):5430
                                                                                                                                                                                                    Entropy (8bit):3.8172337977156037
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:48:UGPJ3MuKMb88888888888888888888888sOtQANKuq/72aY+Db74/mjsjvZuzLik:Ur3ZtQ7X7r8mjWBuaAGqTF
                                                                                                                                                                                                    MD5:259E036A127EC3C92099296F4F4F990C
                                                                                                                                                                                                    SHA1:26D5155D7AEAD4C6BF0A9921A8FE050B0C171876
                                                                                                                                                                                                    SHA-256:700C8E40ABE907C559C7F84E6F9B097F5D8C944391BBB5621D4434FB4BBA45A8
                                                                                                                                                                                                    SHA-512:4E1F9A636D26165395F5F836F6974E5409416CAC51DF7BBDC8A614E21A86E3C6B3D99401F582CFE5A8FA8E9000FB6E14AF87618995D66E1ACDE149A8334C21CC
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:............ .h...&... .... .........(....... ..... .....@....................../............................................DDDi............................................................................................................................................F...j0.........................................................F...S..........................................................M...G..........................................................e-..F...zD...k................................................~P..F...O...n....:..Q...t......................................|..F...a&........g...]...q....................................F...W................b..._.....................................I...F................i..._....................................]#..F.............S...^.....................................tC..F...K...h....3..L.......................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\etc\icon\QuickVision.ico (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):5430
                                                                                                                                                                                                    Entropy (8bit):5.133669585773461
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:96:9I/O2hYNNNNNNNNNNMcKCPq/N+WldER5CsNl:WG2hYNNNNNNNNNNMhCS/N+WldmCsN
                                                                                                                                                                                                    MD5:7DD9A2D68279F6DAF680A6CACA79B95C
                                                                                                                                                                                                    SHA1:3C48290DE5871D38A50D83E568515DB80568E642
                                                                                                                                                                                                    SHA-256:377D65FBE97D6BD768184376AD44B82406D6FB5C7D25D2D71863F232894D19B9
                                                                                                                                                                                                    SHA-512:0F7765054ACDF1280B7FEE1470A5E573991AAAB924F33310A4B78777191B68820E0B4CFF1FFC1A41CD96CAB33AF881FCD872FFF6B81A45F77B37E3CA678DC1EB
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:............ .h...&... .... .........(....... ..... .....@...................w8./p5..i2..h2..h2..h2..h2..h2..h2..h2..h2..h2..h2..h2..c0..,..i.@...L...L...L...L...L...L...L...L...L...L...L...L...L...L.._-...A...L...L...L...L...L...L...L...L...L...L...L...L...L...L..a....A...L...L...L...L...L...L...L...L...L...L...L...L...L...L..a....A...L...L...L...L...L...L...L...L...L...L...L...L...L...L..a....A...L...L...L...L...L...L...L...L...L...L...L...L...L...L..a....A...L...L...L...L...L...L...L...L...L...L...L...L...L...L..a....A...L...I...J...J...J...K...L...K...K...J...J...J...J...L..a....A...P..Dx..@z..={..igc..O...P...R...[$.]q{.Gw..Fw..aov..J..a....A.._lr.........ckq..K...O...O...R...Y..._..?............W,.a....A..;|......3....]?.alq..R..zaJ.._<..^3.bv...lN.........Qy..a....A..peW.2...khc.....!....^C.........._7.....ay..E...A~..{bK.a....A...K...L...M...X/..X...X-.igc.igc..U...\=..T ..K...J...J..a....A...L...L...L...K...K...K...J...J...K...K...K...L...L...L..b/...@...L...L...L...L...L...L

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\etc\icon\RadioVision.ico (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):5430
                                                                                                                                                                                                    Entropy (8bit):5.045539843945543
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:48:J/ZPHhhmUC3LfTKLKA7Dx80XRx/N+mmL2cKoMWYiEbH8nyZ1F/CMqXBfI:J/HwHLTwKAHu0BDq9Mp8niFdct
                                                                                                                                                                                                    MD5:59FC589C59CDE7DF9940C6A0122A169D
                                                                                                                                                                                                    SHA1:A1780FBCBF5CF85618E957BA78EBC27D957F5E40
                                                                                                                                                                                                    SHA-256:B49AEE5B10E898A7B485CC69639A437EBDFD812B5A54F5BA593A6F316043658C
                                                                                                                                                                                                    SHA-512:DD5EBDB2A5EAA6C552F754BC5F75BE6491C6D8BFAE11D07B37A1EBA220813EF2B4A7240BDF65151CCA80413E3F55E88F808B83E26C13E68D81C4B44593A55A15
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:............ .h...&... .... .........(....... ..... .....@......................?.......................................................xmq.............................................................................................................................................TUS.BDA.>B@.;>:.?DC.ADD.HKK._a`.......................<;5.?A<.EF>.IIA.JKB.DA6.DB8.JIB.FE>.GGB.<>=.<;8.............D@8.VTP.WSK.cdd.beg.bba.]UD.XO?.iij.WXY.llo.VPK.[YU.ID=..un.lje.XTN.`\Y.....}|..xrk.pf^...}.t_V.smb.ska.~zz.UOG.WRM.PJA.dXO....nje.[XU.....[XV.yvp.~TI......9..~me.zwt.ysp.smi.d[T.zum....................WWY......GB......)...wv.....ron.mhc.............................................G8..RF................................................H=......rj..7$.............................................u..!.........../............................................................H7..l_............................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\etc\icon\Sidexis.ico (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):5430
                                                                                                                                                                                                    Entropy (8bit):6.455094846687626
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:96:2/23yA9VA+XXXXXXXXXXXXXXXXXXXXXXsY///////////////////////////KuQ:F3y1v+KuppDNpAgqkw2JdpdQnXlddddP
                                                                                                                                                                                                    MD5:806C23B71E1290818645797EED98DB00
                                                                                                                                                                                                    SHA1:8350F1CC7D942CC820A21C0BEDC2F7CBAE013A09
                                                                                                                                                                                                    SHA-256:C237944E55BFDAF3150DCB0CC359846161FD5CD07B68539EDD66D5D9687DA2CB
                                                                                                                                                                                                    SHA-512:498915DBD31C87E34599942DF0FA775983F8D5F1137C6688554EE294AE6CA12A9673F91420B78FAFE456295802E65E70C422CB19A1CC8F4A26CDD39D6213CCCC
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:............ .h...&... .... .........(....... ..... .....@....................../1 ../.../.../.../.../.../.../.../.../.../.../.../...*......i:&..|L@.|L@.|L@.|L@.|L@.|L@.|L@.|L@.|L@.|L@.|L@.|L@.|L@.{K?.$...=(...MA..MA..MA..MA..MA..MA..L@..TJ..........rj..RH.....OD.'...='...K>..L>..L?..L?..M?..L?..K=..VL......LA............~E7.'...<&...E7..F7..F8..F8..F8..F8..E7..PF.....r4%.........v;..}D6.'...;%...?0..?0..>/.~>..~>..~=..}=..~A6...y..E9..........}v.w9).&...;$..y7&.x6%.x4#.r...~H=..MC.q...{<0......`U..bW.w8*.....u4%.&...:#..p-..p,...I>..................QH.k$..m'..n)..p,..k%..q-..&...9"..l%..f...........................e...j"..m#..m#..l#..l&..%...8!..f...b..........................h"..m%..h...c...c...c...%...7 ...G8..D6..........................G:..PB..PB..L>..>..k)..%...6....OB..UJ..........................[P..]P..^Q.._R.._R..SF.%...6....aT..eZ..........................l`..nb..ob..ob..oc..^Q.%...5....nc..ti..sj..zq.......x......uk..zo..zo..zo..zp..{p..g\.$...3....nb..uj..|r..vk..vk..u

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\etc\icon\SmartDent.ico (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):4286
                                                                                                                                                                                                    Entropy (8bit):4.164135428968617
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:48:388888888888888888888888sOiec3qskEvASmYLBR0t2/pqTBn:0iec3xkpQeGpqTBn
                                                                                                                                                                                                    MD5:1EF21DBE67AB4A2AEAE09A5D0FF369A7
                                                                                                                                                                                                    SHA1:639F795C912B8905346863A7427C0746CFC9DA04
                                                                                                                                                                                                    SHA-256:F82B19E42FB88172F4E53C7DA17F8A280CC453FF2F11B3B28B1158BB54DB0F9A
                                                                                                                                                                                                    SHA-512:860CD8DB368F309199F06735EF5E591F8D2250CA3A3078580BA6963ABB5AFB8A971AC06538304C60581CB01C0169A99BB82D0C233DAB08A6B9DF044D32B34920
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:...... .... .........(... ...@..... .................................rrrYkkk.bbb.```.```.```.```.```.```.```.```.```.```.```.```.```.```.```.```.```.```.```.```.```.```.```.```.000....[...(..............................................................................................................................S...,...........................................................................................................................j...S........................................................................................................................;;;....S........................................................................................................................;;;....S......................z...h...f...g...a...w................................................p..[....................;;;....S.....................Q..)..&..'.....C.....................................L../..*.....>....................;;;....S......................]..9..5..6..

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\etc\icon\Sopro.ico (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):5430
                                                                                                                                                                                                    Entropy (8bit):6.164256045690542
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:96:hfAVmEYcXm2GmtE9kNFlZYFxJl+KKKgPKlIZH6wFn0vy362iipEIixnAy:hoVmlDCtE9kNHZYl/wjFB62iipEIih
                                                                                                                                                                                                    MD5:8D0F5CA07924ED68CA447ECB5AB98D88
                                                                                                                                                                                                    SHA1:320249B20B5857AA7BA27EC724E133AEE21033AE
                                                                                                                                                                                                    SHA-256:C759E53BF35CD2A63A94A7E287988BACAE55DC38F972CA70DE8F9945925649DA
                                                                                                                                                                                                    SHA-512:695DD71B56EDB6187D3720F1A1CD868B521CDAFC080D25F92392443BF8FB62953DCE7FC8210E4307C6E5DD2AFE122A2B3A4154F9B651535775CB1184237A6439
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:............ .h...&... .... .........(....... ..... .....@...................`M./ZI..TD..TD..TD..TD..XG..^L.._M..\J..XG..TD..TD..TD..PA..#..ilW...g...g...g...g..}e....I..l...m..{v8..n...h...g...g...g..L>..nY...i...i...i...j..wtD.....f...g....o......e...i...i...i..O@..nY...k...k...k...p........r..e...f...t8.....{c...h...k...k..O@..oZ...m...m...m...r........U.}c..~d..se&......u2..f...m...m..O@..oZ...p...p...p..ym$.........}b...c..imG.......^.~d...n...p..O@..p[...r...r...r...y:.........sh".mY..{.........t..g...o...r..PA..q[...u...u...u..}o#...........................U..l...n...u..PA..q\...w...w...w...e.._...................o....o...q...s...w..PA..r\...z...z...x..{.f..............................v...z...z..PA..r]...|...|...t.......................................}...|..QA..s^...........v....................................$.........QA..s^...........|...................................{..........QA..t^................#.............|..........P..}..........QB..q\.......................~

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\etc\icon\SuniMAC.ico (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):5430
                                                                                                                                                                                                    Entropy (8bit):4.713984352255154
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:96:2b808GO0Irvv368684JX3DTSIqovnIGgy6Dan/HFaGOAmx2y2qdvI2oQF:y8aO0IzvKTgBJRN
                                                                                                                                                                                                    MD5:79F7B0993DA33682C32C848D5FA3672F
                                                                                                                                                                                                    SHA1:51827BCD9D7B48DAB5388667F6902114B7D952DE
                                                                                                                                                                                                    SHA-256:117C9C8204DBEA8A0D241F454A94CE5E2E130737598D3FC1DB47FE477BA02451
                                                                                                                                                                                                    SHA-512:156675F4CDB69B0196F33DD0C89D7CA68A077B967D2575E80428E59359453AFDEFFC26E080164910D704FACCE74C83684B7DAA5D31256D77EB4E275647072E55
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:............ .h...&... .... .........(....... ..... .....@....................../......~..}..}..}..}..}..}..}..}..}..}..}..z.fJ<i.............................................................~x...............................................................z...............................................................z...............................................................z...............................................................z...............................................................z...............................................................z...............................................................z...............................................................z.............................UWW.........]ae...................z.....................Zt......FJN.iig.omj.bcc...................z...............................................................z...............................................................{...........................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\etc\icon\TekScan.ico (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):5430
                                                                                                                                                                                                    Entropy (8bit):4.128112361584048
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:48:Lbw6QiIU+7Mb88888888888888888888888sOtaCe8Mc2z1mwCAqsmYO5/Y1cMvF:A6QNvZtaCeXlzsE2Yug1cMvAqTF
                                                                                                                                                                                                    MD5:C13DD32AB66D3B65F1C64C3A9B398264
                                                                                                                                                                                                    SHA1:9BCA6BD3268EA9B12D05E8825E524FB432BED024
                                                                                                                                                                                                    SHA-256:0C95883D060E044625348F8A698E942E8D2CF418A0AEDC922B9794342BF18226
                                                                                                                                                                                                    SHA-512:A00CE90CBA80812B9CE4938CDB3CC5D817F6210E2A54C5D8227CBE6FB6AE79C720039E80DA6931CA1DCABDCCB5D318150209B4D7302AE42E506B4714EFD632DD
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:............ .h...&... .... .........(....... ..... .....@....................../............................................DDDi..........................................................................................................................................................................................................................................................................\...l5..............e+..q?/.j-.._..............................e$..n8........................t.i(..._Q........................d(..n5......j;1..qc.........f'..a'.............................h,..j0..................e#..r8!..............................c-..i'.............~H2.`$....u........................[...Y...b"..b"..\...S..........a ..`...`....k`.............................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\etc\icon\TigerView.ico (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):5430
                                                                                                                                                                                                    Entropy (8bit):6.543456330376757
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:96:ogW7GQMP7WJ1wJc9nGQUuyx9kUpzPx/fN3Z2BSb6g7Jh:NvSJSJ0nGQH+dZ/l8dgNh
                                                                                                                                                                                                    MD5:02B9882AC2DE159FB49AF9F2D3B4ADBA
                                                                                                                                                                                                    SHA1:899C6BB6253422E3179F7C6A5FB1B3F7811A98D3
                                                                                                                                                                                                    SHA-256:4F1B3402B162480E56F4F0EAA1AE58A402075EFA160110448050B568A142EC19
                                                                                                                                                                                                    SHA-512:FDA84342DD118F0E0767B8450BE9268A337CB818E838685662A47375C00184AB9BD19A83CC0F3F81711F033B1C012FC110C035FB3DECA80AA0AEEB2B7E6693DD
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:............ .h...&... .... .........(....... ..... .....@...................:;:/:::.676.666.666.666.666.666.666.666.666.666.666.666.232....iEFE.%Y...W...@...-...F...3..c...........Uv..B^..Jt......}..../..GHG.![...L.......,...5...>..Cr..p...,>\.y...\...4S......v...010.GHG..V...E...,...2...%...@..K...........n...Y.....*.?}..j...010.GHG..I...5...2...*..'J...4...H...N..i.......Q..... .&P..U...010.GHG..E...3...4....d.}...a....'...G..#J..[...:.....:..;..J...010.GHG.,n..$e..-h..Z... Z..Hu..s....4...6..3q...>....7..O..;Tj.010.GHG.0s..._..#]..p...(;d.Gj..Ql...0...N...F...'{...3.:~..AEG.010.GHG.)a..#a..>...........r...Oj..Z....2...B....^.(d..<k../,).010.GHG. M...H..q.......Uy..Ol......Lz...<...7..2u..%g..0G`. ..010.GHG..F...8..k...a...k.......j...!b.. ]..;...%P..+L..(2E.#"!.010.GHG."Q...J..(g..z...x...K....W...W..4|..6Z...0E...*.5@d.'''.010.GHG..H...M...N...I..(p..8...W...>y..G...Ml..?S..'5b.=U..OW_.010.GHG.1V..3Z..Ac..Rm..]l..eks.gff.adh.R~..o...b...T...Gl..mor.121.EEE.kkh.lkh.lje.kif.jih.jj

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\etc\icon\Triana.ico (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):5430
                                                                                                                                                                                                    Entropy (8bit):5.477638797355355
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:48:TSylJEkV9tH3GnZvx6kboOOOOOOOOOOFsJ0WBmaXai4ks3su3zpFPQ9NZ3+Nb0/4:XEEP3C7as3BTXa3x/3zE9bQYYtiHX0
                                                                                                                                                                                                    MD5:E61F7D123772E3F90394689B08FD64BE
                                                                                                                                                                                                    SHA1:5D53820591CBBDD10D284B097707A4EAC3F50B40
                                                                                                                                                                                                    SHA-256:0226FD99875EF31590A3587131753ECF89379C11AC32D138DBE18F0C90537571
                                                                                                                                                                                                    SHA-512:06DECCEA3D24273B09899B90D300136E3AD6FBCCAFDBE7BF2516F846A984A98DBA15AFC143FE9D82A0797C3D8915FC33EA9CC8CCE7D618CF0CCFFC82E2E7EB5F
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:............ .h...&... .... .........(....... ..... .....@....................../..........................................}.cG9i.............................................................ys..............................................................~y.........................................Q.k.G.o.............~y..............}U..f<...................:...U...Y...W.|.......~y..........uJ..T...T...T..........f.w...;...X...Y...Y.".Y......~y.........X...T...X...s"...v.....b.s...=...W...Y...Y...Y.....~y.........V...S...t,..9...............@...S...Y...Y...Z.....~y...........c..Y...i...._.............&.M...Q...X...Z...W......~y.........................................@.`...F...J.a.x......~y.....................Z...............'.......................~y.........................................<....................~y.........................................9....................~y.....................O........................................~y...........................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\etc\icon\Trophy.ico (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):5430
                                                                                                                                                                                                    Entropy (8bit):4.1385279073269094
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:48:fzGHl2RmMb88888888888888888888888sOt1VWLdeFHg16TboCz+YD7eMznzkqG:f6HlJZt1VWQqo0e+K7ZnzkmqTF
                                                                                                                                                                                                    MD5:103EF2A054FD580782071295774DF944
                                                                                                                                                                                                    SHA1:474B2F587E3232EAA0AB34C0B01923120D343D55
                                                                                                                                                                                                    SHA-256:A40B49B98513BB31115AFD5CC9B5F32FD3C4EFC8ADBA237D82134822A9A49123
                                                                                                                                                                                                    SHA-512:203576C2D7E1512CEE724E544C3C1F7BDC2C8AA1A60D9049545CCC4B7220C7F790B64BDF626A749CA0E7F692F2B62238E6C0D4C7026C94FA60E41913A3744CE7
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:............ .h...&... .... .........(....... ..... .....@....................../............................................DDDi.............................................................................................................................................................aaa.........999............................................```.....GGG................................................jjj.ddd............... ....................................```.....................9KV................................^^^.............................O..........................bbb.bbb.............................-..........................bbb.bbb............................................................nnn.ccc........................................................................p...;...D..............................................................3...............................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\etc\icon\VaTech.ico (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):5430
                                                                                                                                                                                                    Entropy (8bit):4.942306955075798
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:96:T8bESSSSSSSSS3eNRWod3bPUx4zFc4h8yceel6f/+3CCCCCCCCCCCCCCCCCCCCCg:Ab1sRW43bYKcTeel6f/g
                                                                                                                                                                                                    MD5:230DEEA6646DDBCDDFB5B638C81553A4
                                                                                                                                                                                                    SHA1:35A1249F561820032B16726D07896BAE685D59FB
                                                                                                                                                                                                    SHA-256:DC72070BD59090085E8C294E4613104EB71AB52EF8942FBDC64AE74E2842634D
                                                                                                                                                                                                    SHA-512:572D499F54BC8C45CD71B5021ACAEF507C1D9D7915E47A31F0D08E3CD1A6F89E852B582C70A2DA1994E7EBC4E9C751F12EECF2656CD6F649399CEBCA68A7BE5E
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:............ .h...&... .... .........(....... ..... .....@.....................O...t...e...d...d...d...d...d...d...d...d...d...d...d...[....]...e..........................................................P....m..........................................................Y....m................................kk..KK....................[....m....................................jj....................\....m....................................jj....................^....m................66..EE..............jj...................._....m....................................ll....................a....m............EE..............................11............c....m....................KK....................................d....m........((......%%..........AA............................f....m........................}}................................g....m........<<..%%..............@@............................h....m..........................................................k....]......................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\etc\icon\ViSix.ico (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):5430
                                                                                                                                                                                                    Entropy (8bit):6.3793601436419225
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:96:K56CaOAI07PNtViDiR9RRdAlqw2kGNQatNkkH2:K56e07FPRXIlSrVtNkkH2
                                                                                                                                                                                                    MD5:B6FCD87FCBFC6AE8607F2B5D8A0C1D29
                                                                                                                                                                                                    SHA1:5A5328C10D47F1E992C26997B96C005DAFEE9D05
                                                                                                                                                                                                    SHA-256:AEA266A1303CB4033583B5C558EA1DD787429F60FC7BB11114EA132AC6E9E1AC
                                                                                                                                                                                                    SHA-512:299D8D606AD2B7C992E73CE8D2449A4C815FCA6AEF1BC8DF55182D36DD8BF89113D890BA727579E9E120434973B3A3EC585D7784B7C11C2FD947BD9F0C9BE443
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:............ .h...&... .... .........(....... ..... .....@....................../............................................ECBi..............................................................?..?..?..A..@..?..?...@...D..._......................9...<..3..,...;...=...?...<...b...o......................:../..k...4..#...=...<...N...n...r.......................:...$...)......I...2...Q...k......y........................:...$......#..,../...O...}..............................:...$......$..~...1.......r..............................9...$.......0...e..t...7...5...............................:...$.......7...z...u..{...9...H...........................<...2.......8........j.......;...I.........................\...P...,...o............G..%...{...........................t..V..................:.....................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\etc\icon\VistaDentOC.ico (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):4286
                                                                                                                                                                                                    Entropy (8bit):4.905160271071615
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:48:388888888888888888888888sOCqijUbZ1AFLUoKdVnP9k+xkEpBAARTtpqUiIkD:0rijUcFUVnlJKEp6AZqTnq6LREmn
                                                                                                                                                                                                    MD5:BD25A279E5119440B87A85D24A68DD54
                                                                                                                                                                                                    SHA1:27654258E153370EFC061674A9898F81D3C49AF6
                                                                                                                                                                                                    SHA-256:41794822087E9D2F0283581ABBBF739BDD7CAAB1F5814E362EDCF974BE0854BF
                                                                                                                                                                                                    SHA-512:F3FDCC57A9EA74D3894CF9C362A843692C414A23AAB4BB158C60221E591E2983FE18403A1D5F3C670EB52DFB00950EFA85D5AEFCCEB9795D6034F5F0E4860119
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:...... .... .........(... ...@..... .................................rrrYkkk.bbb.```.```.```.```.```.```.```.```.```.```.```.```.```.```.```.```.```.```.```.```.```.```.```.```.000....[...(..............................................................................................................................S...,...........................................................................................................................j...S...................................................uV+.nkf.............................................................;;;....S.................................................q..n..aXI.............................................................;;;....S.................................................Q..v..iS4.............................................................;;;....S.................................................8..|..zY).............................................................;;;....S......................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\etc\icon\VixWin.ico (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):5430
                                                                                                                                                                                                    Entropy (8bit):5.5254584686354224
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:48:zA64nankKHk1aYy6vwGmWaRd61Dig731C/KMmtobSKjYp5Gy4oJnQ74f+:06bkBaYQdpRdkDJEuabSKjkGybf+
                                                                                                                                                                                                    MD5:0B6A2C6B4A1BFA982FE7ADB194F06265
                                                                                                                                                                                                    SHA1:BA9979D74C583BEAED51D90F600A3FE977EB95E9
                                                                                                                                                                                                    SHA-256:8457CC4383AEA30412314C4CAA18DB88896C658A902C20BFBACD5E93F58C8E90
                                                                                                                                                                                                    SHA-512:CC85E53F86D1E07001E653944BAC91F7394048D153D8A18FE8ED99E21C646C2CFDC044D563D64B9A94596BBC650514EDEC2AC8BB423A207412463321796EE3C8
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:............ .h...&... .... .........(....... ..... .....@...................z/./u...m,..m,..m,..m,..m,..m,..m,..m,..m,..m,..m,..m,..g)..-..i.7...Z,..Z,..Z,..Z,..Z,..Z,..Z,..Z,..Z,..Z,..Z,..Z,..Z,..Y+.b%...:...Z,..Z,..Z,..Z,..Z,..Z,..Z,..Z,..Z,..Z,..Z,..Z,..Z,..Z,.e'...:...Z,..[+..[+..[+..[+..Z+..[+..\+..Z+..Z+..U&..y\..mN..Z,.e'...:...Z,..[+..[*..[+..S$..Z+..[0..S,..T&..V%...r......oN..Z,.e'...:...Z,..[+..[+..V'......M...wX......pS..b?.......m..T#..Z,.e'...:...Z,..[+..X)..sS......^;..S"................S"..[+..Z,.e'...:...Z,..[+..Q"..............O...W...........Q(..[+..Z+..Z,.e'...:...Z,..Z*..f@..............H"...|..........jM..X(..[+..Z,.e'...:...Z,..V%.........M".............|`.........S(..[+..Z,.e'...:...Z,..\2.......f..T .........M(..Z+..X,..\2..[,..[*..Z,.e'...:...Z,...f.....U'..[,..`8.....lJ..Z)..[*..[+..[+..[+..Z,.e'...:...Z,..W(..T%..Z,..Z*..Z+..S%..Y)..Z,..Z+..Z+..Z+..Z+..Z,.e'...:...Z,..Z,..Z,..Z,..Z,..Z,..Z,..Z,..Z,..Z,..Z,..Z,..Z,..Z,.f'...7...Y+..Z,..Z,..Z,..Z,..Z

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\etc\icon\XDR.ico (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):5430
                                                                                                                                                                                                    Entropy (8bit):4.936163317083543
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:96:PXKPa0KkvHzlOIC/Pbou+KEjyf5wnrwyZ+dDn9:PXSayvzlA3Mu5eyfLtdDn
                                                                                                                                                                                                    MD5:4D71293D9FC3C6BE8DB9EAEF4B87E6E7
                                                                                                                                                                                                    SHA1:0BDFA1BA9B97A9C12CF8E4D5C2C50DA052695EC5
                                                                                                                                                                                                    SHA-256:4F245742B03FA6E201DBA17CCCD9E588924F0C74D72B2F603D2F417A78BB8666
                                                                                                                                                                                                    SHA-512:7015CF3A524DDC007D86C1EA0610A167ED719A576DF3A279B3A7AABCDF6F48653FD33E3B68BB772BC397A720865BEEC72FC97DA1E699F1CC99D42D2DAC18CC30
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:............ .h...&... .... .........(....... ..... .....@....................../...........................................................i........................................................~~~.........................~...~...~...~...~...~...............................~....rr..||..JJ..<<..ff..@@..<<..XX..ss..||.~........................++..ss..**..++..gg..//..++..\\..66..BB..................VV..QQ..MM..JJ..VV..00..kk..44..11..ss..00..ZZ..EE..\\..........NN......WW......^^......UU......77..00......UU......YY..........~~......kk..ll..ll..\\..||..MM.....JJ..~~..ii..........................hh..^^..PP..GG..RR..KK..kk..BB..{{..hh..............................GG..55.~...~TT.~++.~QQ.~....;;..PP..........................nn......~~......yy......<<......""..kk..........................%%..<<..==......bb..%%..NN..++..66..SS..........................__..zz..cc..aa..ZZ..rr..uu..ZZ..^^.....................................................................................~~~...................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\etc\icon\XVWeb.ico (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):5430
                                                                                                                                                                                                    Entropy (8bit):5.742855350275551
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:96:SRhN7Z+z0ZZZZZZZZZZZm+XXXXXXXXXXXXXXXXXXXXXXue69wHm5z/W5OkMaKuxB:qhN7Az0ZZZZZZZZZZZmLeAR5zJTaKMhr
                                                                                                                                                                                                    MD5:75E44A55C7E41BBA4030425F252E2BE9
                                                                                                                                                                                                    SHA1:9AE4C57C6EEC99E69B7CC474644C09D0429E05C5
                                                                                                                                                                                                    SHA-256:6036F9FCBB9026E139052FBBD174D9C970801C2AA2EC32ECE16D454C58026558
                                                                                                                                                                                                    SHA-512:6873C55D6CFFA78A81E5048D3AD54E488F5F3CB563DF61840784CE154364F47AA7FF8BE725308EA7ECC9AF7DE39E2C4F3F7B2DCFA9A26BEE88A3FD75A12ED414
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:............ .h...&... .... .........(....... ..... .....@.................../../1!..0.../.../.../.../.../.../.../.../.../.../.../...*......i;'...S...S...S...S...S...S...S...S...S...S...S...S...S...R..$...?*...R...T...V...V...V...T...`....T...z...e..d...U...V...R..'...>)..|P..}S..~V..~V...W............................L.~S..|P..'...=)..yO..zP..zQ..~W..................................Z..yO..'...=)..vM..xN..yN......................................R.vM..'...<(..sK..rI...~N..................^1..e/...z...........h.sK..'...;(..oI..nH.............}]/.b8...m<.|Y%.............wH.oI..'...;'..lF..rO..........lF..e?...d2..h7.pN&.............rO..lF..&...:'..hD..qS......]?..`>...k>..h7.X3..................dB..hD..&...9&..eB..cB..];..dB...xP..kA.gG....a.............gE..dB..eB..&...9&..bA..]A..dL...xQ.^B...tK...x.............kP .\?..^A..bA..%...8&.._?..\=..\>..Y;..`D..................]A..Y:..Z;..Z;.._?..%...7%..\>..[;..Y9..Y;..dH...lE.x`4._C..V8..Y;..Y<..Y<..Y<..\>..%...5$..Z<..Z<..Z<..Z<..Z<..Z<

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\etc\icon\hdx.ico (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):4286
                                                                                                                                                                                                    Entropy (8bit):5.485536122855314
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:48:uKHAiLhdENkhssG7ePaMcAnmwQyYWweG0rHIWn:uKHAiLPSHaPa8BQyYWwe3pn
                                                                                                                                                                                                    MD5:7B0C10237655BC4F678DCFACF9FCC0A5
                                                                                                                                                                                                    SHA1:8FD396E15754D3C482BE74F678A5E56AB2862EB5
                                                                                                                                                                                                    SHA-256:0171EE51B1A59A98AC5A6E3FB3647D667E4B82C860F058D7F9FF3A8CE1404513
                                                                                                                                                                                                    SHA-512:D49FC0D8B9905419F5D954FD522C37AFDB036902CFAAC4E55C15303F04764062818E0E0693905EB5F4079F036B2662D3BCFC36D067F6D934BC45B31DC440D076
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:...... .... .........(... ...@..... .........................jV......;0.Y8-..3)..2(..2(..2(..2(..2(..2(..2(..2(..2(..2(..2(..2(..2(..2(..2(..2(..2(..2(..2(..2(..2(..2(..2(..2(.........[...(jV..qJ..rJ..rJ..rJ..rJ..rJ..rJ..rJ..rJ..rJ..rJ..rJ..rJ..rJ..rJ..rJ..rJ..rJ..rJ..rJ..rJ..rJ..rJ..rJ..rJ..rJ..rJ..rJ..rI..lG.....SjV.,rI..sH..sH..sH..sH..sH..sH..sH..sH..sH..sH..sH..sH..sH..sH..sH..sH..sH..sH..sH..sH..sH..sH..sH..sH..sH..sH..sH..sH..wP!....jjV.SsJ..sH..sH..sH..sH..sH..sH..sH..sH..sH..sH..sH..sH..sH..sH..sH..sH..sH..sH..sH..sH..sH..sH..sH..sH..sH..sH..sH..sH..|W).....jV.SsJ..sH..sH..sH..sH..sH..sH..sH..sH..sH..sH..sH..sH..sH..sH..sH..sH..sH..sH..sH..sH..sH..sH..sH..sH..sH..sH..sH..sH...b8.....jV.SsJ..sH..sH..sH..sH..rG..pD..oB..qE..sH..sH..rG..oC..oC..qF..sH..sH..sH..sH..sH..sH..sH..sH..sH..sH..sH..sH..sH..sH...tO.....jV.SsJ..sH..sH..sH..sG..tJ...W/..]7.|S*.sH..sH..uK...Z3..]7.yP&.sH..sH..sH..sH..sH..sH..sH..sH..sH..sH..sH..sH..sG..xO%...o.....jV.SsJ..sH..sH..sH..qE...^7............uK

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\etc\icon\iCat.ico (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):5430
                                                                                                                                                                                                    Entropy (8bit):3.4793248844530846
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:48:2gXw6Mb88888888888888888888888sOtLoJ7adam1nRsGz61qqTMrI:2grZtLobsRT61qqTF
                                                                                                                                                                                                    MD5:185B9890BCCABE499B8357073DD28B67
                                                                                                                                                                                                    SHA1:5FD45C23DC15837B49D9334C8628869A42655E42
                                                                                                                                                                                                    SHA-256:8D96C4E1E19B39BB08F8E54E4BBE42BCBEDC08C9C241862B7C5C987B154D3322
                                                                                                                                                                                                    SHA-512:E2781E1467D519FF6F464EF7B259C376B5A13D634FF78AFD45E5E2366C32B901F3D9B59B319B1592B9846617FCAA508AB7F99B41EAB5D746F845B9867799A484
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:............ .h...&... .... .........(....... ..... .....@....................../............................................DDDi....................................................................................................................................................................................................................................................................ua.............yX>.qN2.qN1.............nS.....................zf..........bH..........aH..............mS.....................wb........................yX=...~......mS.....................}k...........m...............w..........mS..................................l................}]D......eK................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\etc\icon\iDixel.ico (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):4286
                                                                                                                                                                                                    Entropy (8bit):6.037485225449132
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:96:uK7VmLA0mdRmKmImX8DrmtmE6m7m0mVmVmNsIm+TE+z9CE+oEc9AEZhERPbvBCjw:uA0E5dQ3tX8+Mca500Ct+Y+z9t+zG0Nf
                                                                                                                                                                                                    MD5:DD67EBE3419C1EDEE227666718603BB1
                                                                                                                                                                                                    SHA1:149B960B656E248E25DA07B265DA83A87ECCCE2E
                                                                                                                                                                                                    SHA-256:2240E81AB0A3B2D6088160FFDCB32DA76064E935BE8A5FFE679D6E50CB372315
                                                                                                                                                                                                    SHA-512:C4AD169128F0C0FB59A87C02AA0AF78BF6A84DCC51E3D9E8FF778615AAB4EB1CCD9C05F2900A950B49665A9FE73B069F06A3C4B141A00F9353B8CF6054279E91
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:...... .... .........(... ...@..... .........................jV......;0.Y8-..3)..2(..2(..2(..2(..2(..2(..2(..2(..2(..2(..2(..2(..2(..2(..2(..2(..2(..2(..2(..2(..2(..2(..2(..2(.........[...(jV..fS..kW..kX..kX..kX..kX..kX..kX..kX..kX..kX..kX..kX..kX..kX..kX..kX..kX..kX..kX..kX..kX..kX..kX..kX..kX..kX..kX..hU..H:.....SjV.,lX..l...l...l...l...l...l...l...l...l...l...l...l...l...l...l...l...l...l...l...l...l...l...l...l...l...l...l...k..jV.....jjV.So[..l...l...l...l...l...l...l...l...l...l...l...l...l...l...l...l...l...l...l...l...l...l...l...l...l...l...l...l..hU......jV.So[..l...l...l...m...m...k...l...q...u...x,..|<...M...Y...[...`...f...c...U...@..~(..t...k..}h...j...l...k...k...l..hU......jV.So[..l...l...l...m...k...m...v&..}A...O...S...X..i..t..t..x..~........}...r...^...:..q..{g..~i...l...l...l..hU......jV.So[..l...l...l...k...o&..zV...t...~...........{..|................................I..m..}h...l...l..hU......jV.Sp[..l...l...k...m2..ve..~w...x......

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\etc\icon\is-09OBC.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):4286
                                                                                                                                                                                                    Entropy (8bit):5.485536122855314
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:48:uKHAiLhdENkhssG7ePaMcAnmwQyYWweG0rHIWn:uKHAiLPSHaPa8BQyYWwe3pn
                                                                                                                                                                                                    MD5:7B0C10237655BC4F678DCFACF9FCC0A5
                                                                                                                                                                                                    SHA1:8FD396E15754D3C482BE74F678A5E56AB2862EB5
                                                                                                                                                                                                    SHA-256:0171EE51B1A59A98AC5A6E3FB3647D667E4B82C860F058D7F9FF3A8CE1404513
                                                                                                                                                                                                    SHA-512:D49FC0D8B9905419F5D954FD522C37AFDB036902CFAAC4E55C15303F04764062818E0E0693905EB5F4079F036B2662D3BCFC36D067F6D934BC45B31DC440D076
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:...... .... .........(... ...@..... .........................jV......;0.Y8-..3)..2(..2(..2(..2(..2(..2(..2(..2(..2(..2(..2(..2(..2(..2(..2(..2(..2(..2(..2(..2(..2(..2(..2(..2(.........[...(jV..qJ..rJ..rJ..rJ..rJ..rJ..rJ..rJ..rJ..rJ..rJ..rJ..rJ..rJ..rJ..rJ..rJ..rJ..rJ..rJ..rJ..rJ..rJ..rJ..rJ..rJ..rJ..rJ..rI..lG.....SjV.,rI..sH..sH..sH..sH..sH..sH..sH..sH..sH..sH..sH..sH..sH..sH..sH..sH..sH..sH..sH..sH..sH..sH..sH..sH..sH..sH..sH..sH..wP!....jjV.SsJ..sH..sH..sH..sH..sH..sH..sH..sH..sH..sH..sH..sH..sH..sH..sH..sH..sH..sH..sH..sH..sH..sH..sH..sH..sH..sH..sH..sH..|W).....jV.SsJ..sH..sH..sH..sH..sH..sH..sH..sH..sH..sH..sH..sH..sH..sH..sH..sH..sH..sH..sH..sH..sH..sH..sH..sH..sH..sH..sH..sH...b8.....jV.SsJ..sH..sH..sH..sH..rG..pD..oB..qE..sH..sH..rG..oC..oC..qF..sH..sH..sH..sH..sH..sH..sH..sH..sH..sH..sH..sH..sH..sH...tO.....jV.SsJ..sH..sH..sH..sG..tJ...W/..]7.|S*.sH..sH..uK...Z3..]7.yP&.sH..sH..sH..sH..sH..sH..sH..sH..sH..sH..sH..sH..sG..xO%...o.....jV.SsJ..sH..sH..sH..qE...^7............uK

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\etc\icon\is-1QLBO.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):4286
                                                                                                                                                                                                    Entropy (8bit):4.808717884648094
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:48:388888888888888888888888sOMZ0cYyWfCxYCtp375T6ly9vksGasMMDplXlWnz:0MjYyMA1P9vkVasNDplXlUFVTn
                                                                                                                                                                                                    MD5:42E4043747E6D753D2CF76A7B71A62E7
                                                                                                                                                                                                    SHA1:C0C2DEB0BD439BD89819C32E5B452A8FBECF4310
                                                                                                                                                                                                    SHA-256:DA8D3905DFD250043B63EA3D053D269374E055D83CBFD48BF6E3F8917517AB5B
                                                                                                                                                                                                    SHA-512:95364621D8FC54BB7D4FB454A74E1ABBD2D331E11EDFA55D557F101D025F8FDCED37418F55FCF303F698BF6AE5D30D194E6F7B5DC604ECA39EB343F400E706F0
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:...... .... .........(... ...@..... .................................rrrYkkk.bbb.```.```.```.```.```.```.```.```.```.```.```.```.```.```.```.```.```.```.```.```.```.```.```.```.000....[...(..............................................................................................................................S...,...........................................................................................................................j...S........................................................................................................................;;;....S........................................................................................................................;;;....S........................................................................................................................;;;....S.............................................................................................................;;;....S.............g..I...U...S...S...O...U

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\etc\icon\is-3UM7I.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):5430
                                                                                                                                                                                                    Entropy (8bit):4.449163255076371
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:48:FFUIrjaZXNyQRDXMb88888888888888888888888sOtHfWwQ/pCyKMPqQOL7qpmB:btXw9rRbZt/+/pzqhfaSsqTF
                                                                                                                                                                                                    MD5:C34E0B32C3D75220157598B36FB4DC0C
                                                                                                                                                                                                    SHA1:AFD5501ACD26710A8577A123A1618DDFFDFD4EBE
                                                                                                                                                                                                    SHA-256:1B092013CEB2B6A315D7BC5A9DA2EB6E52F37A840F3AAF0ECC50CDA274979BC2
                                                                                                                                                                                                    SHA-512:854A765516F7B661C04736AE3132B1519A79019C53E56ECCC908257123F01283DA1C2597EB84E47F7ABC2BD33CD80FFAD2A8C82637CED6C7CCA4322EA70C4A73
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:............ .h...&... .... .........(....... ..... .....@....................../............................................DDDi..........................................................................................................................................................................................................Z}..f...`...Z...[...\~..Yv....u..............................._...h.....`........s.4.d..._~....o...........................c...e...................i...g...`y............................c...e...................{.A.d...^.............................c...e...................p.-.f..._.............................b...e...................`...i...bz............................`...k...m.&.{.?.g.#.^...a...\}................................^{..h...g...g...k...o.,...W...........................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\etc\icon\is-3V8EL.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):5430
                                                                                                                                                                                                    Entropy (8bit):4.326199052290956
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:96:xArZa7T+e60lbujh547xkCAQXKSd4WqTF:0Z4n60gjhUx4dBZ
                                                                                                                                                                                                    MD5:A47277E449782AA8A7B97FFF087DD164
                                                                                                                                                                                                    SHA1:D9B0A2D7868462B4DD98AF393E303E5412682D8B
                                                                                                                                                                                                    SHA-256:9B10F6E01D9C0E87E6F0EF4D59C393B63C13979A7386407460E9B1092D48EB8F
                                                                                                                                                                                                    SHA-512:96F2F4D3837629906B38D46BBCA24FE35068B6A273F84E170D29831B5FAC707BBA499DEAFF06237758B715CCFFF1AD58985227ED11107FA09C2B1189C24E01B8
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:............ .h...&... .... .........(....... ..... .....@....................../............................................DDDi.....................................................................................................................................ju.....................................................................es..w..................................................................er.....................................................................`q|................................................"...............any............................................*...................ds~............................................................r...gv.............................................................iv..gs.....................................................q|..lz..kz.........................................................{...x.......................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\etc\icon\is-4C9F4.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):4286
                                                                                                                                                                                                    Entropy (8bit):4.164135428968617
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:48:388888888888888888888888sOiec3qskEvASmYLBR0t2/pqTBn:0iec3xkpQeGpqTBn
                                                                                                                                                                                                    MD5:1EF21DBE67AB4A2AEAE09A5D0FF369A7
                                                                                                                                                                                                    SHA1:639F795C912B8905346863A7427C0746CFC9DA04
                                                                                                                                                                                                    SHA-256:F82B19E42FB88172F4E53C7DA17F8A280CC453FF2F11B3B28B1158BB54DB0F9A
                                                                                                                                                                                                    SHA-512:860CD8DB368F309199F06735EF5E591F8D2250CA3A3078580BA6963ABB5AFB8A971AC06538304C60581CB01C0169A99BB82D0C233DAB08A6B9DF044D32B34920
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:...... .... .........(... ...@..... .................................rrrYkkk.bbb.```.```.```.```.```.```.```.```.```.```.```.```.```.```.```.```.```.```.```.```.```.```.```.```.000....[...(..............................................................................................................................S...,...........................................................................................................................j...S........................................................................................................................;;;....S........................................................................................................................;;;....S......................z...h...f...g...a...w................................................p..[....................;;;....S.....................Q..)..&..'.....C.....................................L../..*.....>....................;;;....S......................]..9..5..6..

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\etc\icon\is-5G6LD.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):4286
                                                                                                                                                                                                    Entropy (8bit):4.905160271071615
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:48:388888888888888888888888sOCqijUbZ1AFLUoKdVnP9k+xkEpBAARTtpqUiIkD:0rijUcFUVnlJKEp6AZqTnq6LREmn
                                                                                                                                                                                                    MD5:BD25A279E5119440B87A85D24A68DD54
                                                                                                                                                                                                    SHA1:27654258E153370EFC061674A9898F81D3C49AF6
                                                                                                                                                                                                    SHA-256:41794822087E9D2F0283581ABBBF739BDD7CAAB1F5814E362EDCF974BE0854BF
                                                                                                                                                                                                    SHA-512:F3FDCC57A9EA74D3894CF9C362A843692C414A23AAB4BB158C60221E591E2983FE18403A1D5F3C670EB52DFB00950EFA85D5AEFCCEB9795D6034F5F0E4860119
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:...... .... .........(... ...@..... .................................rrrYkkk.bbb.```.```.```.```.```.```.```.```.```.```.```.```.```.```.```.```.```.```.```.```.```.```.```.```.000....[...(..............................................................................................................................S...,...........................................................................................................................j...S...................................................uV+.nkf.............................................................;;;....S.................................................q..n..aXI.............................................................;;;....S.................................................Q..v..iS4.............................................................;;;....S.................................................8..|..zY).............................................................;;;....S......................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\etc\icon\is-5KLH5.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):5430
                                                                                                                                                                                                    Entropy (8bit):4.936163317083543
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:96:PXKPa0KkvHzlOIC/Pbou+KEjyf5wnrwyZ+dDn9:PXSayvzlA3Mu5eyfLtdDn
                                                                                                                                                                                                    MD5:4D71293D9FC3C6BE8DB9EAEF4B87E6E7
                                                                                                                                                                                                    SHA1:0BDFA1BA9B97A9C12CF8E4D5C2C50DA052695EC5
                                                                                                                                                                                                    SHA-256:4F245742B03FA6E201DBA17CCCD9E588924F0C74D72B2F603D2F417A78BB8666
                                                                                                                                                                                                    SHA-512:7015CF3A524DDC007D86C1EA0610A167ED719A576DF3A279B3A7AABCDF6F48653FD33E3B68BB772BC397A720865BEEC72FC97DA1E699F1CC99D42D2DAC18CC30
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:............ .h...&... .... .........(....... ..... .....@....................../...........................................................i........................................................~~~.........................~...~...~...~...~...~...............................~....rr..||..JJ..<<..ff..@@..<<..XX..ss..||.~........................++..ss..**..++..gg..//..++..\\..66..BB..................VV..QQ..MM..JJ..VV..00..kk..44..11..ss..00..ZZ..EE..\\..........NN......WW......^^......UU......77..00......UU......YY..........~~......kk..ll..ll..\\..||..MM.....JJ..~~..ii..........................hh..^^..PP..GG..RR..KK..kk..BB..{{..hh..............................GG..55.~...~TT.~++.~QQ.~....;;..PP..........................nn......~~......yy......<<......""..kk..........................%%..<<..==......bb..%%..NN..++..66..SS..........................__..zz..cc..aa..ZZ..rr..uu..ZZ..^^.....................................................................................~~~...................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\etc\icon\is-69VKO.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):4286
                                                                                                                                                                                                    Entropy (8bit):4.374141712392226
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:48:388888888888888888888888sOikt5zaQIqJqZ7lIOV1Nwgxwq4wBQT9BCBQ+/QO:0iIzaJZIMIOBQ+KKMqTBn
                                                                                                                                                                                                    MD5:1EB6209FD331BFBD717D7EB80B72FB49
                                                                                                                                                                                                    SHA1:44E8BCDC8DF36D1D903640B0F82AD2599BAA5BF3
                                                                                                                                                                                                    SHA-256:057494206D637F8EEF2088FEAF1AF791FA9BC2218C48D857BBBC2E349193248F
                                                                                                                                                                                                    SHA-512:A951AEEAC6BE1E43A26AE78DE7C70683B8557BE835D252D1F8D4922774CCC433C6F20682BEDC2B20FED0A4A77C24BC10BEA87890A495272721992853F8AE2A16
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:...... .... .........(... ...@..... .................................rrrYkkk.bbb.```.```.```.```.```.```.```.```.```.```.```.```.```.```.```.```.```.```.```.```.```.```.```.```.000....[...(..............................................................................................................................S...,...........................................................................................................................j...S........................................................................................................................;;;....S........................................................................................................................;;;....S....................................................x.{.dn^.............................................................;;;....S................................................i.p.j.o.[cU.............................................................;;;....S......................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\etc\icon\is-6QUJ3.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):5430
                                                                                                                                                                                                    Entropy (8bit):4.1385279073269094
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:48:fzGHl2RmMb88888888888888888888888sOt1VWLdeFHg16TboCz+YD7eMznzkqG:f6HlJZt1VWQqo0e+K7ZnzkmqTF
                                                                                                                                                                                                    MD5:103EF2A054FD580782071295774DF944
                                                                                                                                                                                                    SHA1:474B2F587E3232EAA0AB34C0B01923120D343D55
                                                                                                                                                                                                    SHA-256:A40B49B98513BB31115AFD5CC9B5F32FD3C4EFC8ADBA237D82134822A9A49123
                                                                                                                                                                                                    SHA-512:203576C2D7E1512CEE724E544C3C1F7BDC2C8AA1A60D9049545CCC4B7220C7F790B64BDF626A749CA0E7F692F2B62238E6C0D4C7026C94FA60E41913A3744CE7
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:............ .h...&... .... .........(....... ..... .....@....................../............................................DDDi.............................................................................................................................................................aaa.........999............................................```.....GGG................................................jjj.ddd............... ....................................```.....................9KV................................^^^.............................O..........................bbb.bbb.............................-..........................bbb.bbb............................................................nnn.ccc........................................................................p...;...D..............................................................3...............................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\etc\icon\is-80KDG.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):5430
                                                                                                                                                                                                    Entropy (8bit):6.164256045690542
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:96:hfAVmEYcXm2GmtE9kNFlZYFxJl+KKKgPKlIZH6wFn0vy362iipEIixnAy:hoVmlDCtE9kNHZYl/wjFB62iipEIih
                                                                                                                                                                                                    MD5:8D0F5CA07924ED68CA447ECB5AB98D88
                                                                                                                                                                                                    SHA1:320249B20B5857AA7BA27EC724E133AEE21033AE
                                                                                                                                                                                                    SHA-256:C759E53BF35CD2A63A94A7E287988BACAE55DC38F972CA70DE8F9945925649DA
                                                                                                                                                                                                    SHA-512:695DD71B56EDB6187D3720F1A1CD868B521CDAFC080D25F92392443BF8FB62953DCE7FC8210E4307C6E5DD2AFE122A2B3A4154F9B651535775CB1184237A6439
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:............ .h...&... .... .........(....... ..... .....@...................`M./ZI..TD..TD..TD..TD..XG..^L.._M..\J..XG..TD..TD..TD..PA..#..ilW...g...g...g...g..}e....I..l...m..{v8..n...h...g...g...g..L>..nY...i...i...i...j..wtD.....f...g....o......e...i...i...i..O@..nY...k...k...k...p........r..e...f...t8.....{c...h...k...k..O@..oZ...m...m...m...r........U.}c..~d..se&......u2..f...m...m..O@..oZ...p...p...p..ym$.........}b...c..imG.......^.~d...n...p..O@..p[...r...r...r...y:.........sh".mY..{.........t..g...o...r..PA..q[...u...u...u..}o#...........................U..l...n...u..PA..q\...w...w...w...e.._...................o....o...q...s...w..PA..r\...z...z...x..{.f..............................v...z...z..PA..r]...|...|...t.......................................}...|..QA..s^...........v....................................$.........QA..s^...........|...................................{..........QA..t^................#.............|..........P..}..........QB..q\.......................~

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\etc\icon\is-9ARNO.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):4286
                                                                                                                                                                                                    Entropy (8bit):4.277896816135347
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:48:388888888888888888888888sOUL6wPeaAsWGbzL+ZtJqtA5V90xn:0UL1WLd+L+ctAV90xn
                                                                                                                                                                                                    MD5:A417DCF2B603689028DCC264678AA2EA
                                                                                                                                                                                                    SHA1:B974B5E5C4B0C41025D453657D2E03F8524056C1
                                                                                                                                                                                                    SHA-256:87662D392C329043BD5EFFB0FF893D4231641740590B0FFE5204E3FBED31F5D4
                                                                                                                                                                                                    SHA-512:51337BC3BD0D461CB7E2424D6551B7513EFDEA9525E64977EF86CE7553C745F1B5E765B87B8E0DCB303B464350790EAF9931CF3BBE0DCCDAF93867372A00D577
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:...... .... .........(... ...@..... .................................rrrYkkk.bbb.```.```.```.```.```.```.```.```.```.```.```.```.```.```.```.```.```.```.```.```.```.```.```.```.000....[...(..............................................................................................................................S...,...........................................................................................................................j...S........................................................................................................................;;;....S........................................................................................................................;;;....S........................................................................................................................;;;....S.......................................................................................................................;;;....S......................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\etc\icon\is-A466C.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):5430
                                                                                                                                                                                                    Entropy (8bit):5.519304841232682
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:96:QlB9yfwWiNs3NqQtUZZXruiwa4D+rDM/Xt8U9AarTT7vfp7+rf0r:bwWz3MQaZZXiiv4uMvP9tPT7vfp7+rf
                                                                                                                                                                                                    MD5:78CAB5D8750CD6CD6F5ECDFCA1F21936
                                                                                                                                                                                                    SHA1:588F9B76484988458FEADD047B2A8CB8B371F8F0
                                                                                                                                                                                                    SHA-256:5E89608DC7C75426D39172A1D4B4C59D5805D0F8BE0AFEE321D0F6B205EE34D2
                                                                                                                                                                                                    SHA-512:4CDC2851CA01D04A85FD8FA0E07D0D0F82977CFD1464EF6426A13870F0ED8AE9F73FEC1C3A4CA59A5467F53ED2BFC8DD995A277EFAC0D556427265F175BE8B69
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:............ .h...&... .... .........(....... ..... .....@....................p./.l...e..e..e..e..e..e..e..e..e..e..e..e.._..A).i....I..v...5..z...I..t...0..t...B..z...3..[..4..%..Z......F..r..........D..s...E..x...A..z...A..+..D.. ..]........./..............J........M........%.....]......@.........E..@...........$...u.....-.........]......C...R.....,..)......Q.........D.........|.....].................................................].............d...g...i...G.........X..3..............]..........^............................................]....................I......T...............r...........].............K....................?...................]...............................W......m...............]...............@...............................E.....].....................................M.....6.....].....................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\etc\icon\is-AL3LL.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):5430
                                                                                                                                                                                                    Entropy (8bit):4.713984352255154
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:96:2b808GO0Irvv368684JX3DTSIqovnIGgy6Dan/HFaGOAmx2y2qdvI2oQF:y8aO0IzvKTgBJRN
                                                                                                                                                                                                    MD5:79F7B0993DA33682C32C848D5FA3672F
                                                                                                                                                                                                    SHA1:51827BCD9D7B48DAB5388667F6902114B7D952DE
                                                                                                                                                                                                    SHA-256:117C9C8204DBEA8A0D241F454A94CE5E2E130737598D3FC1DB47FE477BA02451
                                                                                                                                                                                                    SHA-512:156675F4CDB69B0196F33DD0C89D7CA68A077B967D2575E80428E59359453AFDEFFC26E080164910D704FACCE74C83684B7DAA5D31256D77EB4E275647072E55
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:............ .h...&... .... .........(....... ..... .....@....................../......~..}..}..}..}..}..}..}..}..}..}..}..z.fJ<i.............................................................~x...............................................................z...............................................................z...............................................................z...............................................................z...............................................................z...............................................................z...............................................................z...............................................................z.............................UWW.........]ae...................z.....................Zt......FJN.iig.omj.bcc...................z...............................................................z...............................................................{...........................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\etc\icon\is-BB1TO.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):5430
                                                                                                                                                                                                    Entropy (8bit):6.04232917122418
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:96:IZtqxZMYB+RIIWkDDHJ+ZbIbTTTdORL6:IZxR5DHJ+ZbIbTTTdOR+
                                                                                                                                                                                                    MD5:6F43EBF5D287D8C8428E766B0E8EA5D8
                                                                                                                                                                                                    SHA1:C53B3F04CB562C50AC34A766B8990E3364E6783B
                                                                                                                                                                                                    SHA-256:3ADD2F2B7B06BD0D51689AEAED0DA1FAA50704EC261C138DAAB884C564982BD7
                                                                                                                                                                                                    SHA-512:8CE8975AEA61F876862ADFBADF2AD4B634A86E9806CAD8F8F57CDA89E4DF7BB26BFAA72DDD1AC56EF70352BD302ED0576A2D064D2B579D3999611A1AE44FB327
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:............ .h...&... .... .........(....... ..... .....@....................../............................................DDDi.................................................................6y..9{..8|..:~..<...=...>...@...A...A...B...C................<...<...<...=...>...@...A...D...F...D...H...I................>...@...A...A...B...E...G...I...K...K...P...P.................@...D...D...E...G...K...N...O...Q...Q...E...O."...............B...L...L...M...N...R...U...U...O...?...:...h.A...............A...R...T...T...V...\...V...F...?...C...C.....f...............D...S...]...^. .Z...M...D...D...I...J...K.....................K...Q...a.#.U...J...G...L...P...P...N...Z.....................S...O...R...K...P...S...T...R...T...Q...j.9...................X...T...U...W...X...X...X...X...X...T...y.X...................]...[...^...]...[...[...[...[...[...Z.....y...................]...^...^..._...]...]...]...]...\...`.........................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\etc\icon\is-BS5Q4.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):5430
                                                                                                                                                                                                    Entropy (8bit):4.569053497291155
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:96:n9xcjYYYYYYYYYYVlwwwwwwwwwwwwwwwwwwwwwwwQp3jiIG7FNe6NN3mvMjM2:IjYYYYYYYYYYVlp3WIQFNe6v3mvQH
                                                                                                                                                                                                    MD5:96C7CF20FC12C0E144E84242766BF454
                                                                                                                                                                                                    SHA1:032533305F1888CA41909AE182C0B8CB93F1EE92
                                                                                                                                                                                                    SHA-256:0F4C56F5AD9D8F2FDCFD29DE709DA79ED245D3C7352BF318C3A74EE987877D65
                                                                                                                                                                                                    SHA-512:9360479F7DDBB06897613F047369A4E37B2BEF0CA582E229F5675C67365A9ECD0828273AF8B45ED99367F940978AD16F58F8E1888C813049EA4A0C5CF19B75C1
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:............ .h...&... .... .........(....... ..... .....@....................../............................................qUGi...............................................................................................................................................................................................".................................<....._.................&.................................+......x.................&.............................~...........................&...............................D.....................&..............................Z.........................&...........................F.............................&................................Z.........................%.................................x......................{...g..............................g...f.....................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\etc\icon\is-BV6QK.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):5430
                                                                                                                                                                                                    Entropy (8bit):3.539060901194267
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:48:iKXkfO7udMb88888888888888888888888sOtTWoEjJ2cZZR7r4qTMrI:iwkW4ZtTxUZZcqTF
                                                                                                                                                                                                    MD5:37B3433341CD64B837BB4A898FAC0952
                                                                                                                                                                                                    SHA1:5652E1C546541CD12C7219FC66DACCA7DCDA437D
                                                                                                                                                                                                    SHA-256:D898A0FBBB919331F5A360EA3C712865F318286D2EEE1E55CDEDA0FB6CD3762C
                                                                                                                                                                                                    SHA-512:BD1521DF615EA07C3900AB135F4FDA861CCEFB096ECA1827FA54095BB1AC660D90A92917BD40B145F169B947BC438F5CAE6F9A871938A098CB8A93A0366005E1
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:............ .h...&... .... .........(....... ..... .....@....................../............................................DDDi.....................................................................................................................................................................................................................................................................d.......................C.........................................=...N...P...n......I......?...B...3.........................|..................Y..................F......................>..................t..............1..........................y...v...s.............?..@..=..................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\etc\icon\is-CAAQO.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):5430
                                                                                                                                                                                                    Entropy (8bit):4.126867539090609
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:96:RcPPZtjVVvamBCFSa8wKFUnWuOjPzqTF:RcPPZ1VVvwFSaCUwOZ
                                                                                                                                                                                                    MD5:2959B1971D7CFC9C32BD7493B49AEF47
                                                                                                                                                                                                    SHA1:F5D804DE7C62B237E0689E7D360522180FA68F05
                                                                                                                                                                                                    SHA-256:C1D4AFFE49E6F45B441198A6E6DBF0A9ECA6A83B4849252CDD614ADEF60AE4E0
                                                                                                                                                                                                    SHA-512:1680B36C3A1F05DEF6EF6EC45EF2EB64A0302C5BCAF30792227227962EB7BAFEBEC01967FD8BCD88F4D55E866B4EE35EC72BE0564BD2D1E7ACAE45C059E2B961
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:............ .h...&... .... .........(....... ..... .....@....................../............................................DDDi.................................................................................................................................................heo.`_c.[\[.^[\.gc`........................................CX~............................................................CT~.0...............s.......^D'................................CT..8#.....................N4.................................CV.. ..._^T.[[Z._\\.6BM......}a................................CS.......................rN....................................ES..'!..............Wbz.!.....................................ES..+%..............{........pd................................GW.............................................................v|..444.111.111.631.C53.................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\etc\icon\is-CJKQT.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):5430
                                                                                                                                                                                                    Entropy (8bit):6.338724173782412
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:96:CcXky3dHUsQmkaJ0QWk2/6t3ohbTA9DZvAdqNH0SHqOM2mjm4DD21msa:CcXtdtQ4mR/WYhKusULBjRDD21
                                                                                                                                                                                                    MD5:5F1C29B6976D3E84D0134CF6057B0751
                                                                                                                                                                                                    SHA1:BBC840531D5FCE0A58B48C907FB21B9463B59F92
                                                                                                                                                                                                    SHA-256:3FFDDD2F7F64A8DC4B96733E9D553DF7D44C7303184D74D3D08445B1FD39676B
                                                                                                                                                                                                    SHA-512:9203348BD7CECA50966E7E1BDF07E30DA20F264F93742DD23C32A84018B5679FDB61613A8161A9081A307B035F52DEC1870329080D00F0279756BB268CBBE9EB
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:............ .h...&... .... .........(....... ..... .....@....................8./w5..q2..q2..q2..q2..q2..q2..q2..q2..q2..q2..q2..q2..r2..\'.i.:.................|........................u3...9.......5....j......U...}.............:.8.Y.C.......t3...:..........5...Ri..U..................v.....v.X.......t3...:......c..Q...W....................>.?.".5...........u3...:......a..nH......P.........S........&...r..........u3...;.........\=................F.....|...0..............v3...;.........3...............6.....l.X.S.............v3...<...........z..}`.................y.l...u.............v4...<...........]..................'.....z..................w4...=..........9...............Y...O........~........W.W.....w4...=.........>...........................Y.h...........?.....w4...=..........7...........H...............K.l...........:....x4...=..........J...W"..........|...............h.|.7._.z.......x4...=......................~.

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\etc\icon\is-EGJFB.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):5430
                                                                                                                                                                                                    Entropy (8bit):5.1650121167428855
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:48:QxKS+2u0CgvMb88888888888888888888888sOt83jHPKU6s6m8gkAm4dEkzIjII:gkxyZtwKU61Am4dJxDn2G+gDpDcqA
                                                                                                                                                                                                    MD5:7624E33D3C3F0872B824E9A41B54504E
                                                                                                                                                                                                    SHA1:1808F62B437FEE37DB842B6D1EADD051C3615647
                                                                                                                                                                                                    SHA-256:2336CEEBB59093DDFDA6DA16C28DFE681D368D50F8B37A076B6F9C4CF9DE723A
                                                                                                                                                                                                    SHA-512:4D2143B16D6E010DB7364F7B67CE2BB63A9C5125267A9FE527281257BEACAD1D2AB0859475D0807DD51343B2DB82E092F77D98882FC38D2750B349755CF2CD3E
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:............ .h...&... .... .........(....... ..... .....@....................../............................................DDDi...........................................................................................................................................b.......................+..............................]........................R..............................]...........B9$.A:$.]e:.=bO.'...............................^.........".2F;.3.f..!). 28.!................................]............8.......)fY. 4;..................................^......%.....1.}.....*WR. 5=..................................^....z.S."<=...&..;;......0:..................................[....;...'..%...$.../...,........................................&... ..............................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\etc\icon\is-EIHJ5.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):5430
                                                                                                                                                                                                    Entropy (8bit):5.5254584686354224
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:48:zA64nankKHk1aYy6vwGmWaRd61Dig731C/KMmtobSKjYp5Gy4oJnQ74f+:06bkBaYQdpRdkDJEuabSKjkGybf+
                                                                                                                                                                                                    MD5:0B6A2C6B4A1BFA982FE7ADB194F06265
                                                                                                                                                                                                    SHA1:BA9979D74C583BEAED51D90F600A3FE977EB95E9
                                                                                                                                                                                                    SHA-256:8457CC4383AEA30412314C4CAA18DB88896C658A902C20BFBACD5E93F58C8E90
                                                                                                                                                                                                    SHA-512:CC85E53F86D1E07001E653944BAC91F7394048D153D8A18FE8ED99E21C646C2CFDC044D563D64B9A94596BBC650514EDEC2AC8BB423A207412463321796EE3C8
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:............ .h...&... .... .........(....... ..... .....@...................z/./u...m,..m,..m,..m,..m,..m,..m,..m,..m,..m,..m,..m,..g)..-..i.7...Z,..Z,..Z,..Z,..Z,..Z,..Z,..Z,..Z,..Z,..Z,..Z,..Z,..Y+.b%...:...Z,..Z,..Z,..Z,..Z,..Z,..Z,..Z,..Z,..Z,..Z,..Z,..Z,..Z,.e'...:...Z,..[+..[+..[+..[+..Z+..[+..\+..Z+..Z+..U&..y\..mN..Z,.e'...:...Z,..[+..[*..[+..S$..Z+..[0..S,..T&..V%...r......oN..Z,.e'...:...Z,..[+..[+..V'......M...wX......pS..b?.......m..T#..Z,.e'...:...Z,..[+..X)..sS......^;..S"................S"..[+..Z,.e'...:...Z,..[+..Q"..............O...W...........Q(..[+..Z+..Z,.e'...:...Z,..Z*..f@..............H"...|..........jM..X(..[+..Z,.e'...:...Z,..V%.........M".............|`.........S(..[+..Z,.e'...:...Z,..\2.......f..T .........M(..Z+..X,..\2..[,..[*..Z,.e'...:...Z,...f.....U'..[,..`8.....lJ..Z)..[*..[+..[+..[+..Z,.e'...:...Z,..W(..T%..Z,..Z*..Z+..S%..Y)..Z,..Z+..Z+..Z+..Z+..Z,.e'...:...Z,..Z,..Z,..Z,..Z,..Z,..Z,..Z,..Z,..Z,..Z,..Z,..Z,..Z,.f'...7...Y+..Z,..Z,..Z,..Z,..Z

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\etc\icon\is-EQVO7.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):5430
                                                                                                                                                                                                    Entropy (8bit):5.742855350275551
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:96:SRhN7Z+z0ZZZZZZZZZZZm+XXXXXXXXXXXXXXXXXXXXXXue69wHm5z/W5OkMaKuxB:qhN7Az0ZZZZZZZZZZZmLeAR5zJTaKMhr
                                                                                                                                                                                                    MD5:75E44A55C7E41BBA4030425F252E2BE9
                                                                                                                                                                                                    SHA1:9AE4C57C6EEC99E69B7CC474644C09D0429E05C5
                                                                                                                                                                                                    SHA-256:6036F9FCBB9026E139052FBBD174D9C970801C2AA2EC32ECE16D454C58026558
                                                                                                                                                                                                    SHA-512:6873C55D6CFFA78A81E5048D3AD54E488F5F3CB563DF61840784CE154364F47AA7FF8BE725308EA7ECC9AF7DE39E2C4F3F7B2DCFA9A26BEE88A3FD75A12ED414
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:............ .h...&... .... .........(....... ..... .....@.................../../1!..0.../.../.../.../.../.../.../.../.../.../.../...*......i;'...S...S...S...S...S...S...S...S...S...S...S...S...S...R..$...?*...R...T...V...V...V...T...`....T...z...e..d...U...V...R..'...>)..|P..}S..~V..~V...W............................L.~S..|P..'...=)..yO..zP..zQ..~W..................................Z..yO..'...=)..vM..xN..yN......................................R.vM..'...<(..sK..rI...~N..................^1..e/...z...........h.sK..'...;(..oI..nH.............}]/.b8...m<.|Y%.............wH.oI..'...;'..lF..rO..........lF..e?...d2..h7.pN&.............rO..lF..&...:'..hD..qS......]?..`>...k>..h7.X3..................dB..hD..&...9&..eB..cB..];..dB...xP..kA.gG....a.............gE..dB..eB..&...9&..bA..]A..dL...xQ.^B...tK...x.............kP .\?..^A..bA..%...8&.._?..\=..\>..Y;..`D..................]A..Y:..Z;..Z;.._?..%...7%..\>..[;..Y9..Y;..dH...lE.x`4._C..V8..Y;..Y<..Y<..Y<..\>..%...5$..Z<..Z<..Z<..Z<..Z<..Z<

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\etc\icon\is-ET5HR.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):5430
                                                                                                                                                                                                    Entropy (8bit):4.942306955075798
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:96:T8bESSSSSSSSS3eNRWod3bPUx4zFc4h8yceel6f/+3CCCCCCCCCCCCCCCCCCCCCg:Ab1sRW43bYKcTeel6f/g
                                                                                                                                                                                                    MD5:230DEEA6646DDBCDDFB5B638C81553A4
                                                                                                                                                                                                    SHA1:35A1249F561820032B16726D07896BAE685D59FB
                                                                                                                                                                                                    SHA-256:DC72070BD59090085E8C294E4613104EB71AB52EF8942FBDC64AE74E2842634D
                                                                                                                                                                                                    SHA-512:572D499F54BC8C45CD71B5021ACAEF507C1D9D7915E47A31F0D08E3CD1A6F89E852B582C70A2DA1994E7EBC4E9C751F12EECF2656CD6F649399CEBCA68A7BE5E
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:............ .h...&... .... .........(....... ..... .....@.....................O...t...e...d...d...d...d...d...d...d...d...d...d...d...[....]...e..........................................................P....m..........................................................Y....m................................kk..KK....................[....m....................................jj....................\....m....................................jj....................^....m................66..EE..............jj...................._....m....................................ll....................a....m............EE..............................11............c....m....................KK....................................d....m........((......%%..........AA............................f....m........................}}................................g....m........<<..%%..............@@............................h....m..........................................................k....]......................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\etc\icon\is-F85FE.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):4286
                                                                                                                                                                                                    Entropy (8bit):6.037485225449132
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:96:uK7VmLA0mdRmKmImX8DrmtmE6m7m0mVmVmNsIm+TE+z9CE+oEc9AEZhERPbvBCjw:uA0E5dQ3tX8+Mca500Ct+Y+z9t+zG0Nf
                                                                                                                                                                                                    MD5:DD67EBE3419C1EDEE227666718603BB1
                                                                                                                                                                                                    SHA1:149B960B656E248E25DA07B265DA83A87ECCCE2E
                                                                                                                                                                                                    SHA-256:2240E81AB0A3B2D6088160FFDCB32DA76064E935BE8A5FFE679D6E50CB372315
                                                                                                                                                                                                    SHA-512:C4AD169128F0C0FB59A87C02AA0AF78BF6A84DCC51E3D9E8FF778615AAB4EB1CCD9C05F2900A950B49665A9FE73B069F06A3C4B141A00F9353B8CF6054279E91
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:...... .... .........(... ...@..... .........................jV......;0.Y8-..3)..2(..2(..2(..2(..2(..2(..2(..2(..2(..2(..2(..2(..2(..2(..2(..2(..2(..2(..2(..2(..2(..2(..2(..2(.........[...(jV..fS..kW..kX..kX..kX..kX..kX..kX..kX..kX..kX..kX..kX..kX..kX..kX..kX..kX..kX..kX..kX..kX..kX..kX..kX..kX..kX..kX..hU..H:.....SjV.,lX..l...l...l...l...l...l...l...l...l...l...l...l...l...l...l...l...l...l...l...l...l...l...l...l...l...l...l...k..jV.....jjV.So[..l...l...l...l...l...l...l...l...l...l...l...l...l...l...l...l...l...l...l...l...l...l...l...l...l...l...l...l..hU......jV.So[..l...l...l...m...m...k...l...q...u...x,..|<...M...Y...[...`...f...c...U...@..~(..t...k..}h...j...l...k...k...l..hU......jV.So[..l...l...l...m...k...m...v&..}A...O...S...X..i..t..t..x..~........}...r...^...:..q..{g..~i...l...l...l..hU......jV.So[..l...l...l...k...o&..zV...t...~...........{..|................................I..m..}h...l...l..hU......jV.Sp[..l...l...k...m2..ve..~w...x......

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\etc\icon\is-FHAG3.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):5430
                                                                                                                                                                                                    Entropy (8bit):6.455094846687626
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:96:2/23yA9VA+XXXXXXXXXXXXXXXXXXXXXXsY///////////////////////////KuQ:F3y1v+KuppDNpAgqkw2JdpdQnXlddddP
                                                                                                                                                                                                    MD5:806C23B71E1290818645797EED98DB00
                                                                                                                                                                                                    SHA1:8350F1CC7D942CC820A21C0BEDC2F7CBAE013A09
                                                                                                                                                                                                    SHA-256:C237944E55BFDAF3150DCB0CC359846161FD5CD07B68539EDD66D5D9687DA2CB
                                                                                                                                                                                                    SHA-512:498915DBD31C87E34599942DF0FA775983F8D5F1137C6688554EE294AE6CA12A9673F91420B78FAFE456295802E65E70C422CB19A1CC8F4A26CDD39D6213CCCC
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:............ .h...&... .... .........(....... ..... .....@....................../1 ../.../.../.../.../.../.../.../.../.../.../.../...*......i:&..|L@.|L@.|L@.|L@.|L@.|L@.|L@.|L@.|L@.|L@.|L@.|L@.|L@.{K?.$...=(...MA..MA..MA..MA..MA..MA..L@..TJ..........rj..RH.....OD.'...='...K>..L>..L?..L?..M?..L?..K=..VL......LA............~E7.'...<&...E7..F7..F8..F8..F8..F8..E7..PF.....r4%.........v;..}D6.'...;%...?0..?0..>/.~>..~>..~=..}=..~A6...y..E9..........}v.w9).&...;$..y7&.x6%.x4#.r...~H=..MC.q...{<0......`U..bW.w8*.....u4%.&...:#..p-..p,...I>..................QH.k$..m'..n)..p,..k%..q-..&...9"..l%..f...........................e...j"..m#..m#..l#..l&..%...8!..f...b..........................h"..m%..h...c...c...c...%...7 ...G8..D6..........................G:..PB..PB..L>..>..k)..%...6....OB..UJ..........................[P..]P..^Q.._R.._R..SF.%...6....aT..eZ..........................l`..nb..ob..ob..oc..^Q.%...5....nc..ti..sj..zq.......x......uk..zo..zo..zo..zp..{p..g\.$...3....nb..uj..|r..vk..vk..u

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\etc\icon\is-FLA2J.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:MS Windows icon resource - 6 icons, 256x256 with PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced, 32 bits/pixel, -128x-128, 32 bits/pixel
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):101492
                                                                                                                                                                                                    Entropy (8bit):2.83646037035569
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:768:w1ssnssnssnss7333zXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXfPm:GssnssnssnssPnnnrvvvk/r/T7KiZ
                                                                                                                                                                                                    MD5:07B5AA1189C6599C1AF9F113412CFD29
                                                                                                                                                                                                    SHA1:922BE5006B7BABFEA061784B618B12627B21AA72
                                                                                                                                                                                                    SHA-256:108565DCCD2DDAE83278A245078E3514DE5616B074C6AA820CA053AD193251E4
                                                                                                                                                                                                    SHA-512:6BE4E4E0A276B448A385FA21CB1339A27368D9CA8CA8AADA30EA9908D71838C9C4330F6D4A3CD1FD9B740CEF7DDDFEBB6C6758486D11E4D22D87D2C5CD156EF6
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:............ .....f......... .(...l...@@.... .(B......00.... ..%...Q.. .... .....dw........ .h........PNG........IHDR.............\r.f....IDATx....k]u........_.v...TPR(...."......FWn.Hg...@.W.nD..AD..RZ....Z.mq...*Vc#&qz{...|.C86..}.....'..Uv.....o.Z5;;{f5_.].? ....`............&..l....G.>]......>.......w..[...dqq.j...{....@0..`............&..l..}..px.....3]...i..V..\(.....j.o.M..............&..L. ..@...`p{.....Q.;...grr...a5.../..............&..L. ..@..I..x....@?Z.................&..L. ..@0..`.....J}[....z..z?y..?[...W.}jX..m..?]Y.7o.....a...F..jw............&..L. ..@0....?....O......zo........O5...y}._...g........................&..L. ..@0..`...h.z..T...I..j|_..y.k..}..z..8.>.X....!|.}.....'.........u...]..............&..L. ..@0..`....Z...tY......?.c..p.._;Y..-......[.X.......k.P......5...C.:..~W..............z...[.K........&..L. ..@0..`...z....w.....^..[...................7..............u?../......__.{.~....<..S..k.o.+G..L. ..@0..`...........:.W

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\etc\icon\is-I4ETT.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):5430
                                                                                                                                                                                                    Entropy (8bit):6.3793601436419225
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:96:K56CaOAI07PNtViDiR9RRdAlqw2kGNQatNkkH2:K56e07FPRXIlSrVtNkkH2
                                                                                                                                                                                                    MD5:B6FCD87FCBFC6AE8607F2B5D8A0C1D29
                                                                                                                                                                                                    SHA1:5A5328C10D47F1E992C26997B96C005DAFEE9D05
                                                                                                                                                                                                    SHA-256:AEA266A1303CB4033583B5C558EA1DD787429F60FC7BB11114EA132AC6E9E1AC
                                                                                                                                                                                                    SHA-512:299D8D606AD2B7C992E73CE8D2449A4C815FCA6AEF1BC8DF55182D36DD8BF89113D890BA727579E9E120434973B3A3EC585D7784B7C11C2FD947BD9F0C9BE443
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:............ .h...&... .... .........(....... ..... .....@....................../............................................ECBi..............................................................?..?..?..A..@..?..?...@...D..._......................9...<..3..,...;...=...?...<...b...o......................:../..k...4..#...=...<...N...n...r.......................:...$...)......I...2...Q...k......y........................:...$......#..,../...O...}..............................:...$......$..~...1.......r..............................9...$.......0...e..t...7...5...............................:...$.......7...z...u..{...9...H...........................<...2.......8........j.......;...I.........................\...P...,...o............G..%...{...........................t..V..................:.....................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\etc\icon\is-IUEMM.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):5430
                                                                                                                                                                                                    Entropy (8bit):5.954137511303142
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:96:g31rpOb7PEzYUk4LM2iUYUqgtT9/5WzIkX37Tnqa7f7yHvh5vxXRFa+bs:g3CX+YUkgMoq/zDbxf7yH5PLa+bs
                                                                                                                                                                                                    MD5:F8A015CFD6BA992A1C1140E2BDA37BE8
                                                                                                                                                                                                    SHA1:4D8A170DC5E5B1824D4A968B8632E891794D8170
                                                                                                                                                                                                    SHA-256:39589C4D2BEB47E4903579A3C065E03C052FCCD984F4D18B9CEE4891173FAB38
                                                                                                                                                                                                    SHA-512:7CED6B59C6819A9826F6E4884FA08E27A5C6609E4A3B995B9AE6369714F5373D48B0EA3AFB317C2F8EE208D15E0A814030A0BC855255AB32058BBE6F33105C60
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:............ .h...&... .... .........(....... ..... .....@..................."S}?Qi}.Ro...x..u.............q..Y..{Wy.yVm.qF^.Y8H.)..s:Uq..Gk..{....l..u.......................n...b..}=S.l5@.O"&.F*3.^........tS.z80..].....................s...`.........wLc.jGV......rQ......&).....>=:.............qYn.EEb..(-.........0.,.1.....9QZ............./k..................&....bx.|z..........#:B.._h.............6...........%........Pa......cy..59..;E.....#FN.}jv....._ou..z|..Y|.xv..........f............bw......EP.....#JQ.xo......2/3..XR...8.jY.......................r.......r......#JC.wa...........)-.....IRu.....Nnn.b...........................#<C..Md......-:.........1Mj.................%.......;...........#;C..8D..........Zn.....IMf.............@.../.......+a..........#>S..7>.n @.........O....Nd.........?z..U.6.........1i..........#U..k7;.t...t....==..=$...,.....}."...+.A.A.-'J.i...._...N...U..#P..g77.?...L...r...........w...m...I. .A.".".E.d....F...I...W..9a..5)).+...@...C...C...D...@.

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\etc\icon\is-JNVC4.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):5430
                                                                                                                                                                                                    Entropy (8bit):3.8172337977156037
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:48:UGPJ3MuKMb88888888888888888888888sOtQANKuq/72aY+Db74/mjsjvZuzLik:Ur3ZtQ7X7r8mjWBuaAGqTF
                                                                                                                                                                                                    MD5:259E036A127EC3C92099296F4F4F990C
                                                                                                                                                                                                    SHA1:26D5155D7AEAD4C6BF0A9921A8FE050B0C171876
                                                                                                                                                                                                    SHA-256:700C8E40ABE907C559C7F84E6F9B097F5D8C944391BBB5621D4434FB4BBA45A8
                                                                                                                                                                                                    SHA-512:4E1F9A636D26165395F5F836F6974E5409416CAC51DF7BBDC8A614E21A86E3C6B3D99401F582CFE5A8FA8E9000FB6E14AF87618995D66E1ACDE149A8334C21CC
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:............ .h...&... .... .........(....... ..... .....@....................../............................................DDDi............................................................................................................................................F...j0.........................................................F...S..........................................................M...G..........................................................e-..F...zD...k................................................~P..F...O...n....:..Q...t......................................|..F...a&........g...]...q....................................F...W................b..._.....................................I...F................i..._....................................]#..F.............S...^.....................................tC..F...K...h....3..L.......................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\etc\icon\is-K0JLE.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):5430
                                                                                                                                                                                                    Entropy (8bit):5.742855350275551
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:96:SRhN7Z+z0ZZZZZZZZZZZm+XXXXXXXXXXXXXXXXXXXXXXue69wHm5z/W5OkMaKuxB:qhN7Az0ZZZZZZZZZZZmLeAR5zJTaKMhr
                                                                                                                                                                                                    MD5:75E44A55C7E41BBA4030425F252E2BE9
                                                                                                                                                                                                    SHA1:9AE4C57C6EEC99E69B7CC474644C09D0429E05C5
                                                                                                                                                                                                    SHA-256:6036F9FCBB9026E139052FBBD174D9C970801C2AA2EC32ECE16D454C58026558
                                                                                                                                                                                                    SHA-512:6873C55D6CFFA78A81E5048D3AD54E488F5F3CB563DF61840784CE154364F47AA7FF8BE725308EA7ECC9AF7DE39E2C4F3F7B2DCFA9A26BEE88A3FD75A12ED414
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:............ .h...&... .... .........(....... ..... .....@.................../../1!..0.../.../.../.../.../.../.../.../.../.../.../...*......i;'...S...S...S...S...S...S...S...S...S...S...S...S...S...R..$...?*...R...T...V...V...V...T...`....T...z...e..d...U...V...R..'...>)..|P..}S..~V..~V...W............................L.~S..|P..'...=)..yO..zP..zQ..~W..................................Z..yO..'...=)..vM..xN..yN......................................R.vM..'...<(..sK..rI...~N..................^1..e/...z...........h.sK..'...;(..oI..nH.............}]/.b8...m<.|Y%.............wH.oI..'...;'..lF..rO..........lF..e?...d2..h7.pN&.............rO..lF..&...:'..hD..qS......]?..`>...k>..h7.X3..................dB..hD..&...9&..eB..cB..];..dB...xP..kA.gG....a.............gE..dB..eB..&...9&..bA..]A..dL...xQ.^B...tK...x.............kP .\?..^A..bA..%...8&.._?..\=..\>..Y;..`D..................]A..Y:..Z;..Z;.._?..%...7%..\>..[;..Y9..Y;..dH...lE.x`4._C..V8..Y;..Y<..Y<..Y<..\>..%...5$..Z<..Z<..Z<..Z<..Z<..Z<

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\etc\icon\is-KR83M.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):5430
                                                                                                                                                                                                    Entropy (8bit):4.158616714067292
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:48:mee4K5zMb88888888888888888888888sOnegg3k3pz/pumzC4rcUFggTRqG9tU8:Te4K5zZeggaVhumzP59tN
                                                                                                                                                                                                    MD5:FFDB6D1A43963357C82EC085199B604E
                                                                                                                                                                                                    SHA1:33F01A85589D9DD196BF44CD598F5B746AF32955
                                                                                                                                                                                                    SHA-256:22CA7A2FA9871B24C9F53E84025D48C0B186C6CFE2C7BD2248DF221ED4371288
                                                                                                                                                                                                    SHA-512:DB8FF985AAE5032327BE14C390F3D44F105D9FE53E82057C92B627C723171B9572EA8C98EE1FAA6DF63254A64803A0DF5C2AB359AC34CD6CB4495C961D6C2B70
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:............ .h...&... .... .........(....... ..... .....@....................../............................................DDDi.......... ......g.....{...{...z...V................................... ......h.....z...{...y...U................................... ......i.....z...{...y...U..........................................h.....z...{...y...U................................... ......g.....z...{...y...V................................... ......g.....z...{...~........................................ ......g.....y.......................................................f.....~................................................ ......f...................................................... ......f....................................................... ..%...........................................................'............................................................%..............................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\etc\icon\is-LO1BT.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):4286
                                                                                                                                                                                                    Entropy (8bit):2.193962304617272
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:24:suhytRB/sVMkTy3V6U+++2ndlyk5avFQtU4aRw/Ayuiaxaxaxaxaxa3:M/sVk68zyk5quaRB5ccccc
                                                                                                                                                                                                    MD5:E58B8272D6D64BDE0E652BF58D4F57EC
                                                                                                                                                                                                    SHA1:0A678793484446B3B2638A01F6E3254E1838FB65
                                                                                                                                                                                                    SHA-256:1269977833E32E20251A2E9393F40223C22D4A1A8F68D98D8403557E3F59B441
                                                                                                                                                                                                    SHA-512:4AC060123B52B6D15D46F5A46821C5BC5F689D6BAA9F49B50DEB49C85F9FD16853F9654657EB536315280D5BF11AC7CE31FB5CF03A20049FCE345EBDB1E6225B
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:...... .... .........(... ...@..... ..........................&...&...&...&.......I.......w...v...w...v...k....................................P...l...l...j...r...y.....{..............Yg..Yg..Yg..Yg.._[..L~..C...P...N...N...P...E...<...>...>...>...>...>...<...M..Y..U..U..W..K..E...V..G..P..O..O..O.................................................................................................................................................................!...".....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\etc\icon\is-LV3ED.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):5430
                                                                                                                                                                                                    Entropy (8bit):4.614263552707331
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:48:WYMJ51dEJtiypMb88888888888888888888888sOtzM0pSV2TocNILOzkcm8D3fA:gJjdYJpZtTSV2rqhS3f1AAZVqABMF
                                                                                                                                                                                                    MD5:D5E842A98FE9B268125AA78E0336028B
                                                                                                                                                                                                    SHA1:5B9D968A0AF3B12F67BA4F7AAC395CE73E222F68
                                                                                                                                                                                                    SHA-256:0F423E5666B679EED1EF35327E6D68F4B940203DF10FE0F96E100744F60DE276
                                                                                                                                                                                                    SHA-512:D629BFDEAFBCC6E328A423DC47082AF70A9937F2282EA7E4A89D80B411F16B88981EC53AE65C2466EEFFECE559364939C3165F87DB3F1591F0618B72391A74CB
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:............ .h...&... .... .........(....... ..... .....@....................../............................................DDDi......................................................................................6............m.....................................a.................@...u.............................p..x.............s.........................................R,.........................................................Y.......................T4..............................d..Y2..... ..................v..Y6..........................l..V4..~.....................wW..0..............................T-..X3..w...R.............4...0...............................[6..Y3..S/..x.............6...0.................................R*..{....................5..........................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\etc\icon\is-ME0SP.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):5430
                                                                                                                                                                                                    Entropy (8bit):5.133669585773461
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:96:9I/O2hYNNNNNNNNNNMcKCPq/N+WldER5CsNl:WG2hYNNNNNNNNNNMhCS/N+WldmCsN
                                                                                                                                                                                                    MD5:7DD9A2D68279F6DAF680A6CACA79B95C
                                                                                                                                                                                                    SHA1:3C48290DE5871D38A50D83E568515DB80568E642
                                                                                                                                                                                                    SHA-256:377D65FBE97D6BD768184376AD44B82406D6FB5C7D25D2D71863F232894D19B9
                                                                                                                                                                                                    SHA-512:0F7765054ACDF1280B7FEE1470A5E573991AAAB924F33310A4B78777191B68820E0B4CFF1FFC1A41CD96CAB33AF881FCD872FFF6B81A45F77B37E3CA678DC1EB
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:............ .h...&... .... .........(....... ..... .....@...................w8./p5..i2..h2..h2..h2..h2..h2..h2..h2..h2..h2..h2..h2..c0..,..i.@...L...L...L...L...L...L...L...L...L...L...L...L...L...L.._-...A...L...L...L...L...L...L...L...L...L...L...L...L...L...L..a....A...L...L...L...L...L...L...L...L...L...L...L...L...L...L..a....A...L...L...L...L...L...L...L...L...L...L...L...L...L...L..a....A...L...L...L...L...L...L...L...L...L...L...L...L...L...L..a....A...L...L...L...L...L...L...L...L...L...L...L...L...L...L..a....A...L...I...J...J...J...K...L...K...K...J...J...J...J...L..a....A...P..Dx..@z..={..igc..O...P...R...[$.]q{.Gw..Fw..aov..J..a....A.._lr.........ckq..K...O...O...R...Y..._..?............W,.a....A..;|......3....]?.alq..R..zaJ.._<..^3.bv...lN.........Qy..a....A..peW.2...khc.....!....^C.........._7.....ay..E...A~..{bK.a....A...K...L...M...X/..X...X-.igc.igc..U...\=..T ..K...J...J..a....A...L...L...L...K...K...K...J...J...K...K...K...L...L...L..b/...@...L...L...L...L...L...L

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\etc\icon\is-MTIFO.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):5430
                                                                                                                                                                                                    Entropy (8bit):4.128112361584048
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:48:Lbw6QiIU+7Mb88888888888888888888888sOtaCe8Mc2z1mwCAqsmYO5/Y1cMvF:A6QNvZtaCeXlzsE2Yug1cMvAqTF
                                                                                                                                                                                                    MD5:C13DD32AB66D3B65F1C64C3A9B398264
                                                                                                                                                                                                    SHA1:9BCA6BD3268EA9B12D05E8825E524FB432BED024
                                                                                                                                                                                                    SHA-256:0C95883D060E044625348F8A698E942E8D2CF418A0AEDC922B9794342BF18226
                                                                                                                                                                                                    SHA-512:A00CE90CBA80812B9CE4938CDB3CC5D817F6210E2A54C5D8227CBE6FB6AE79C720039E80DA6931CA1DCABDCCB5D318150209B4D7302AE42E506B4714EFD632DD
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:............ .h...&... .... .........(....... ..... .....@....................../............................................DDDi..........................................................................................................................................................................................................................................................................\...l5..............e+..q?/.j-.._..............................e$..n8........................t.i(..._Q........................d(..n5......j;1..qc.........f'..a'.............................h,..j0..................e#..r8!..............................c-..i'.............~H2.`$....u........................[...Y...b"..b"..\...S..........a ..`...`....k`.............................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\etc\icon\is-N78F4.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):5430
                                                                                                                                                                                                    Entropy (8bit):5.045539843945543
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:48:J/ZPHhhmUC3LfTKLKA7Dx80XRx/N+mmL2cKoMWYiEbH8nyZ1F/CMqXBfI:J/HwHLTwKAHu0BDq9Mp8niFdct
                                                                                                                                                                                                    MD5:59FC589C59CDE7DF9940C6A0122A169D
                                                                                                                                                                                                    SHA1:A1780FBCBF5CF85618E957BA78EBC27D957F5E40
                                                                                                                                                                                                    SHA-256:B49AEE5B10E898A7B485CC69639A437EBDFD812B5A54F5BA593A6F316043658C
                                                                                                                                                                                                    SHA-512:DD5EBDB2A5EAA6C552F754BC5F75BE6491C6D8BFAE11D07B37A1EBA220813EF2B4A7240BDF65151CCA80413E3F55E88F808B83E26C13E68D81C4B44593A55A15
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:............ .h...&... .... .........(....... ..... .....@......................?.......................................................xmq.............................................................................................................................................TUS.BDA.>B@.;>:.?DC.ADD.HKK._a`.......................<;5.?A<.EF>.IIA.JKB.DA6.DB8.JIB.FE>.GGB.<>=.<;8.............D@8.VTP.WSK.cdd.beg.bba.]UD.XO?.iij.WXY.llo.VPK.[YU.ID=..un.lje.XTN.`\Y.....}|..xrk.pf^...}.t_V.smb.ska.~zz.UOG.WRM.PJA.dXO....nje.[XU.....[XV.yvp.~TI......9..~me.zwt.ysp.smi.d[T.zum....................WWY......GB......)...wv.....ron.mhc.............................................G8..RF................................................H=......rj..7$.............................................u..!.........../............................................................H7..l_............................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\etc\icon\is-NBH8C.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):5430
                                                                                                                                                                                                    Entropy (8bit):6.543456330376757
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:96:ogW7GQMP7WJ1wJc9nGQUuyx9kUpzPx/fN3Z2BSb6g7Jh:NvSJSJ0nGQH+dZ/l8dgNh
                                                                                                                                                                                                    MD5:02B9882AC2DE159FB49AF9F2D3B4ADBA
                                                                                                                                                                                                    SHA1:899C6BB6253422E3179F7C6A5FB1B3F7811A98D3
                                                                                                                                                                                                    SHA-256:4F1B3402B162480E56F4F0EAA1AE58A402075EFA160110448050B568A142EC19
                                                                                                                                                                                                    SHA-512:FDA84342DD118F0E0767B8450BE9268A337CB818E838685662A47375C00184AB9BD19A83CC0F3F81711F033B1C012FC110C035FB3DECA80AA0AEEB2B7E6693DD
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:............ .h...&... .... .........(....... ..... .....@...................:;:/:::.676.666.666.666.666.666.666.666.666.666.666.666.232....iEFE.%Y...W...@...-...F...3..c...........Uv..B^..Jt......}..../..GHG.![...L.......,...5...>..Cr..p...,>\.y...\...4S......v...010.GHG..V...E...,...2...%...@..K...........n...Y.....*.?}..j...010.GHG..I...5...2...*..'J...4...H...N..i.......Q..... .&P..U...010.GHG..E...3...4....d.}...a....'...G..#J..[...:.....:..;..J...010.GHG.,n..$e..-h..Z... Z..Hu..s....4...6..3q...>....7..O..;Tj.010.GHG.0s..._..#]..p...(;d.Gj..Ql...0...N...F...'{...3.:~..AEG.010.GHG.)a..#a..>...........r...Oj..Z....2...B....^.(d..<k../,).010.GHG. M...H..q.......Uy..Ol......Lz...<...7..2u..%g..0G`. ..010.GHG..F...8..k...a...k.......j...!b.. ]..;...%P..+L..(2E.#"!.010.GHG."Q...J..(g..z...x...K....W...W..4|..6Z...0E...*.5@d.'''.010.GHG..H...M...N...I..(p..8...W...>y..G...Ml..?S..'5b.=U..OW_.010.GHG.1V..3Z..Ac..Rm..]l..eks.gff.adh.R~..o...b...T...Gl..mor.121.EEE.kkh.lkh.lje.kif.jih.jj

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\etc\icon\is-O1QIP.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):5430
                                                                                                                                                                                                    Entropy (8bit):5.477638797355355
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:48:TSylJEkV9tH3GnZvx6kboOOOOOOOOOOFsJ0WBmaXai4ks3su3zpFPQ9NZ3+Nb0/4:XEEP3C7as3BTXa3x/3zE9bQYYtiHX0
                                                                                                                                                                                                    MD5:E61F7D123772E3F90394689B08FD64BE
                                                                                                                                                                                                    SHA1:5D53820591CBBDD10D284B097707A4EAC3F50B40
                                                                                                                                                                                                    SHA-256:0226FD99875EF31590A3587131753ECF89379C11AC32D138DBE18F0C90537571
                                                                                                                                                                                                    SHA-512:06DECCEA3D24273B09899B90D300136E3AD6FBCCAFDBE7BF2516F846A984A98DBA15AFC143FE9D82A0797C3D8915FC33EA9CC8CCE7D618CF0CCFFC82E2E7EB5F
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:............ .h...&... .... .........(....... ..... .....@....................../..........................................}.cG9i.............................................................ys..............................................................~y.........................................Q.k.G.o.............~y..............}U..f<...................:...U...Y...W.|.......~y..........uJ..T...T...T..........f.w...;...X...Y...Y.".Y......~y.........X...T...X...s"...v.....b.s...=...W...Y...Y...Y.....~y.........V...S...t,..9...............@...S...Y...Y...Z.....~y...........c..Y...i...._.............&.M...Q...X...Z...W......~y.........................................@.`...F...J.a.x......~y.....................Z...............'.......................~y.........................................<....................~y.........................................9....................~y.....................O........................................~y...........................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\etc\icon\is-P3L0B.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):5430
                                                                                                                                                                                                    Entropy (8bit):3.4793248844530846
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:48:2gXw6Mb88888888888888888888888sOtLoJ7adam1nRsGz61qqTMrI:2grZtLobsRT61qqTF
                                                                                                                                                                                                    MD5:185B9890BCCABE499B8357073DD28B67
                                                                                                                                                                                                    SHA1:5FD45C23DC15837B49D9334C8628869A42655E42
                                                                                                                                                                                                    SHA-256:8D96C4E1E19B39BB08F8E54E4BBE42BCBEDC08C9C241862B7C5C987B154D3322
                                                                                                                                                                                                    SHA-512:E2781E1467D519FF6F464EF7B259C376B5A13D634FF78AFD45E5E2366C32B901F3D9B59B319B1592B9846617FCAA508AB7F99B41EAB5D746F845B9867799A484
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:............ .h...&... .... .........(....... ..... .....@....................../............................................DDDi....................................................................................................................................................................................................................................................................ua.............yX>.qN2.qN1.............nS.....................zf..........bH..........aH..............mS.....................wb........................yX=...~......mS.....................}k...........m...............w..........mS..................................l................}]D......eK................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\etc\icon\is-UABV5.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):5430
                                                                                                                                                                                                    Entropy (8bit):6.39094211632833
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:96:KgG031He8IX+6BjL7ERSheSh+61KgUfPYe0AavXGjr+LLeis1h29avRfR:JtuX+65heSf1KgUfP5iXAS/ef1h2cvR
                                                                                                                                                                                                    MD5:71D1B7494DF733FCE0AC9AD3045F3CA8
                                                                                                                                                                                                    SHA1:E322A20E95C4D7D3495F7DFF91630BCEED3FF8B6
                                                                                                                                                                                                    SHA-256:61889ED914DB4A160E92492714C84E76250CD7DA27675DB02FF1E92E172B1EA0
                                                                                                                                                                                                    SHA-512:730875F205F2EA4FCAEEB7C1D9B870F59EB321CAFD58DFAAFF3BDBC1DF8E47EEA096670A622D0318DB2D88EF895C74766F49FB2996BA3F4CADC8ED95703FB4DB
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:............ .h...&... .... .........(....... ..... .....@...................uP!.mE..kC..iB..g@..Z8..V6..c=..e?..d>..c>..c>..c=..b=..b=..mN(.yN..rF..pD..oD..c<..Q4..oY?.fA..d=..Y6..`:..g?..f?..f?..e>..mI...W...N..}L..yK..e>..ph^......iE.^8..[@..kL%.pE..qF..qF..pE..wP...^...T...S...P..kM&..........yY.oT3.........tG..{L..zK..yK...U ..j-..W...V...Q..|fJ.............vfQ..........a2..P...O..~N...X!...U..]...W...Q...x`.............ypc...........d..Q...R...Q...["...U..{E.._..}K..ziS..............................Q...U...T...]#...S..{D..{F.|U$..yp.............................~M...V...V..._$...P..x?..s?..}c..................................h:..W...X...a%...K..s9..m9.........................................Q...Y...c'..}F..o2..p>..........................................`&..Y...d)..zB..j+..r=...........................................b..b!..m4..w>..e$..g).............................................|D...[..u:..]...^....i.......................................b..t9...U..G..n{..p{..wy..........

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\etc\icon\is-V4H3M.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):5430
                                                                                                                                                                                                    Entropy (8bit):3.7609111188818263
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:48:05Yaffc04Mb88888888888888888888888sOtK+HRwSpgAocxK7AKi3V87IcpkEk:05YU14ZtK0TvKq3VAIchiAqTF
                                                                                                                                                                                                    MD5:B227552BC9797224D4767C16A69744A8
                                                                                                                                                                                                    SHA1:B7EAEEACEF7C7D28B48733CD37C285F590CE4B62
                                                                                                                                                                                                    SHA-256:EA2FC3F37AAF2B8FDFD3722F438A00FE03EE9CA45A2F2203610208BF882CD7E4
                                                                                                                                                                                                    SHA-512:A44C3B97495ED200B20C68DEF0D0CCC0926229AEEF5A5B73D6E695070283521E5732AD494AEF58B6721974D73DA5FAB95F8E00FE25E7F6DE4013FDF757870009
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:............ .h...&... .... .........(....... ..... .....@....................../............................................DDDi.....................................................................................................................................................U...................k..............................................3..................................................Q.......I...................................................................................................................................................................................................................................................(..............................................................}.......-..........................................................B....... ...i...{...Y..................................................5...........................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\etc\icon\is-V5OGC.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):5430
                                                                                                                                                                                                    Entropy (8bit):6.413762448683329
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:96:L++++++++++XOyN162tV/r4gNVjFYQd77/vvTwk0g:L++++++++++Xz16UV/rtNVFYQZ7/vvT7
                                                                                                                                                                                                    MD5:0914E958FD2FEB87770E31A3F820B1F4
                                                                                                                                                                                                    SHA1:4ACD80235564B1289A699F701A7A702E59D7C56E
                                                                                                                                                                                                    SHA-256:093263DC44273B1700CFB93E24747C626946C795988F2BC5E6F6897DBCADFDE6
                                                                                                                                                                                                    SHA-512:6AE99DDECC19874AFCB09FC7B72F2EFC7C2F05035AEB0E48A35A390DF264C9D25957582F3D4817189830923A52CA846E6A8482A3CA076145181A20C9FFEA6692
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:............ .h...&... .... .........(....... ..... .....@....................../!..."..."..."..."..."..."..."..."..."..."..."..."..........i'....J7..J7..aM..R=..S>..S>..A/..J7..J7..J7..J7..J7..J7..I6.....-....H6..H6.........xB1..H6..H6..H6..H6..H6..H6..H6.....,....F5..F5...........uB2..F5..F5..F5..F5..F5..F5..F5.....+....D3..D3............n>...D3..D3..D3..D3..D3..D3..D3.....*....B1..B1...........l>...RA.tG5.k?..l:,..C3..B1..B1.....)...|?/.|?/...........h<-...w........m.gD4.{A1.|?/.....(...w<-.w<-...........g=-.............`:,.x=......'...r:+.r:+...|.......oG8..xi..........eO.s@3.....&...l7).l7)...v.......oG6.l7)..n\........~b.g7*.....%...h4'.h4'..}j........}a..YD...q........uZ.b2%.....$...c2%.c2%..ra....................XE.c2%.....#..._0$._0$..n_....................v_.c4(._0$....."...[.#.[.#.g8,.~J;.wD6.|K>.|L?..QD.{MA.zL?.f8,.[.#.[.#.[.#.........W,!.X-!.X-!.X-!.X-!.X-

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\etc\icon\is-V65F0.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):5430
                                                                                                                                                                                                    Entropy (8bit):6.534446903772901
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:96:2iaw0rHT0oNv+XXXXXXXXXXXXXXXXXXXXXXeft1iMtfRankQX4OoYUTIpzA40fhL:krHT0qvTtDl9QoBT8pz50fh7BBolgdd7
                                                                                                                                                                                                    MD5:B48DF85230D81D95600737CEC935AB04
                                                                                                                                                                                                    SHA1:A928C5A9A970A270E5C4AC980F6B3A67D2FF6AD4
                                                                                                                                                                                                    SHA-256:D728115E0B4DBC4CFCA32646F7EEAC0B7799A3C3A0269377ED93A76EC7D71ACE
                                                                                                                                                                                                    SHA-512:122E0111C9D89B7D4CA8142362268FBF840A6AA08924D92C5A2EB05975EE87885029FFAA83DF6B87099DB071764F1A66F5BB49FA76630E7243099D59E06F667B
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:............ .h...&... .... .........(....... ..... .....@....................../1 ../.../.../.../.../.../.../.../.../.../.../.../...*......i:&...}[..~\..~[..{Y..|Z..{Y..tT..{Y..zY..|Z..zY...\...\...\.$...=(...}Z..\..wU..oO..fK..gK..bH.._F.yV@..jM..aH..zX..\..\.'...='...yW..vU..vU..xW..{W..yV..qR..zV..xW..xW..|W..wV..uV..~Z.'...<&...tT..tU..rV..wW..uW..wV..tT..sS..xU..rR..pP..vU..uV..|Z.'...;%...v[..v]...c..pX..~b..y\..nQ..oR..pS..rS..qS..sQ..jO..~Y.&...;$....g...m...k..u...q...f..i...`..^..~Z...Z..sU..wX...Z.&...:#...t.....~...s...p...m..~e..y`..uX..qR..oP..pQ..Z..\.&...9".....oZQ........... ....... ...!... ...!..."... .1)&..~Z.%...8!....w.....l[Y.................z..m..c..iS......hL.%...7 ...qh.....4//.?87.>77.>63......}.YG?.H91.H7/.,&$......sQ.%...6....zt.....RKK.|po.ykj.vge....RGD.....]IB.dMC.fM@..gM..[.%...6..........JDE...............TJG......hU..hO..bH..aF..~Y.%...5..........535....................1//........... .&!"..}X.$...3..................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\etc\icon\is-VRGH5.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):5430
                                                                                                                                                                                                    Entropy (8bit):3.5484020380230037
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:48:Z2UeGNIVMb88888888888888888888888sOtPi8Ftrh8+dLrTmD6RsW+EDq+qTM8:ZBe5VZtPi8FtV8Ory6Rr+E2+qTF
                                                                                                                                                                                                    MD5:205703559E284DBFB4650D2360FA8A68
                                                                                                                                                                                                    SHA1:FCE92E28247938909C311B76B0BFCD9EF191A6A5
                                                                                                                                                                                                    SHA-256:76737FAB19F4E3B14CD115DB4D743F87A638A87DBD6C0BB717C137DA3BFF0561
                                                                                                                                                                                                    SHA-512:2C5DF4FE060FC47F7739DCC0B5AD1468A165F9A4C8CF1D420B9F992FC4019CD3B15E7C828E3CEF91616F17EF8BFD23498BE8E71ABA31C17149EA72E8134C1EC1
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:............ .h...&... .... .........(....... ..... .....@....................../............................................DDDi......................................................................................................................................................................................................................................................................................................................................................1...................z......................w...F..........................."...........L..................e.......................................=...s..........................$...............&....................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\etc\is-15AKK.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):14003
                                                                                                                                                                                                    Entropy (8bit):4.7812930982895665
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:PQECdXgAv+YxfZ3JZ6uuJSLUHHxYpAGZCdOsQYixhhxKyGUuWjx1ORNpoYrowRlU:4N592YhZ4lAgRiLEETtDDP2WV8fGc9PU
                                                                                                                                                                                                    MD5:535B2662032DC5AF1F87768F2E686580
                                                                                                                                                                                                    SHA1:6779DC65194B716855B7B1BC89A7516CC7768F27
                                                                                                                                                                                                    SHA-256:45980149530B5D5EEC076F553C3E42A07E5D1A82C2B51C5903FCEB36E2316032
                                                                                                                                                                                                    SHA-512:29E7DA4A68B2A9AF5000E3915734597BB9B0C12DE0A18BCA96BE1D7E33B97EBC4C8504912696A4F62027D303BBF92EC22A9F24C0FBF96192B5032F1D326AE52F
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:<?xml version="1.0" encoding="UTF-8"?>..<ImagingList>.. <Imaging>.. <Name>XVAssistant</Name>.. <Icon>Apteryx.ico</Icon>.. <Manufacturer>Apteryx</Manufacturer>.. <Description>Apteryx</Description>.. <Executable>XVAssistant.exe</Executable>.. <CustomParameters></CustomParameters>.. <Parameters>.. /p$Lname, $Fname::$SSN::$Pid::$MM/DD/YYYY::$Sex.. </Parameters>.. </Imaging>.... <Imaging>.. <Name>XVLite</Name>.. <Icon>Apteryx.ico</Icon>.. <Manufacturer>Apteryx</Manufacturer>.. <Description>Apteryx</Description>.. <Executable>XVLite.exe</Executable>.. <CustomParameters></CustomParameters>.. <Parameters>.. /p"$Lname, $Fname::$SSN::$Pid::$MM/DD/YYYY::$Sex".. </Parameters>.. </Imaging>.... <Imaging>.. <Name>DataGrabber</Name>.. <Icon>Apteryx.ico</Icon>.. <Manufacturer>Apteryx</Manufacturer>.. <Description>Apteryx</Description>.. <Executable>DataGrabber.exe</Executab

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\etc\is-MNIH1.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):71
                                                                                                                                                                                                    Entropy (8bit):4.84828757029471
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:vFWWMNHU8LdgCfpTXSEMLRy:TMVBd/pTX3KRy
                                                                                                                                                                                                    MD5:825CDA711A72A8B8756D7A5EB22300C5
                                                                                                                                                                                                    SHA1:93F05F0AC01E70E9C5E1CE8A36F5C0038D45D158
                                                                                                                                                                                                    SHA-256:56059CF0AEE9938F6D6C3CF614D2C481048FD83A7214F3BC115551142D260071
                                                                                                                                                                                                    SHA-512:2DDA8DACE54CD76FCBF6A426866DBAF55D927D8CC6EC3133C27007DB92D708ADEC097E10E5AFBB35B143753EE694E8B2E600F6ADB611658281D7AE83B39670A3
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:<?xml version="1.0" encoding="UTF-8"?>..<TwainActive>..</TwainActive>..

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\etc\is-NCL96.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):75
                                                                                                                                                                                                    Entropy (8bit):4.841975110917951
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:vFWWMNHU8LdgCfJuk3AbKcZk3Aby:TMVBd/Juw+/Zw+y
                                                                                                                                                                                                    MD5:FA671A3A8AF8266BC3DB608213E52654
                                                                                                                                                                                                    SHA1:7A0C53963A25FC95D2807096438F47A54165F0A1
                                                                                                                                                                                                    SHA-256:1E301E2B03A68BA5F589CE1D034B6C06C12BB341157FBEA9E1152AD8AEB1FB31
                                                                                                                                                                                                    SHA-512:9E4CEB2FFA443619E70750E74A97BD5830F11F4B49B3A6B08299111F7651773081288F4EFF3A1181D98320093823DE5B5F89AE4EFC5C20AD0D65AB328DE7978C
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:<?xml version="1.0" encoding="UTF-8"?>..<ImagingActive>..</ImagingActive>..

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\etc\keystore\iDS_private.keystore (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Java KeyStore
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):2338
                                                                                                                                                                                                    Entropy (8bit):7.77419788778744
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:48:StADvPPXMr/0RNU3+Mz2Dn4wJAMDMObn4wJAMDMBQ2Y8TMEZh47TBIQ2Q:Xrna/P3ltQ2ToShbQ2Q
                                                                                                                                                                                                    MD5:40F3CC0B1E4AC33B90D1E2EEEFD6958D
                                                                                                                                                                                                    SHA1:8D88C79A3700AB7EEE736C083A7B069A11BBAD01
                                                                                                                                                                                                    SHA-256:5EE0D80475EB54C4769665218B0A4ECA25A54BBA988FA65DDA09BCC4516474F6
                                                                                                                                                                                                    SHA-512:8BF51593B72E53818693FE48ED383F652A7A09DB12B66004D849FC65D7ECB1FD47CDD66DA92F9BFFA404FA44D09B7ECB7A70E633E2B88BC02262D17444AFA010
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:..................localgateway.identalsoft.....-.^....0...0...+....*................`..t.. )....&.@i.q...G6M.....\..`..'J...Z.SvV9P..V...X....B."u.......Wyw.. ]71....$.\.g.%...P.%,%.h.;[.Z..f.#y.....S....p.F.l..&f.8S..mk.. ........z.e.;..#(.al...|..%.i...k.......D./...E.*..{............W.R...m..>.|...s......%.{&.|`8...2[k.}.*.B..Zg...2.0..|.x".l...G....D..4.L....v6.t6_.*...1..8,..=......I|].W.MF.-.y..fU.V....iCjL...u..K.W.<.2i-:Sw'...$..n........!_....e.'^..................]}\mT..0..!...#.s-]..Z..Yh..At...60.C......t.eJc.n......p...t?.>.......:.G..._...S.H.......W.+l..5..[.!~W.#r.,Z..SR..R4...N....U..~.B......U..~:.9...l.cf.r..q...p.YD..X.M.fe.3.RY.Z=..C....@....yF...I..q.U....c.W1.:.f.R.".=....K..~...".....-.q.c2......H..4.].y..E|.......1..&.....PO...3!'t"@....N.-B-...lD]...3..v.x.o.........X..G....(.J..N...S...s.....[}{:.*.W...k".h_.J.... g.....j....z@...%6......b*T2;..C...W..9!L$g.....h.0.P.W...8)..9@E..A.R......Zf.".....]..-....s.f.0.E......

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\etc\keystore\is-VP6I3.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Java KeyStore
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):2338
                                                                                                                                                                                                    Entropy (8bit):7.77419788778744
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:48:StADvPPXMr/0RNU3+Mz2Dn4wJAMDMObn4wJAMDMBQ2Y8TMEZh47TBIQ2Q:Xrna/P3ltQ2ToShbQ2Q
                                                                                                                                                                                                    MD5:40F3CC0B1E4AC33B90D1E2EEEFD6958D
                                                                                                                                                                                                    SHA1:8D88C79A3700AB7EEE736C083A7B069A11BBAD01
                                                                                                                                                                                                    SHA-256:5EE0D80475EB54C4769665218B0A4ECA25A54BBA988FA65DDA09BCC4516474F6
                                                                                                                                                                                                    SHA-512:8BF51593B72E53818693FE48ED383F652A7A09DB12B66004D849FC65D7ECB1FD47CDD66DA92F9BFFA404FA44D09B7ECB7A70E633E2B88BC02262D17444AFA010
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:..................localgateway.identalsoft.....-.^....0...0...+....*................`..t.. )....&.@i.q...G6M.....\..`..'J...Z.SvV9P..V...X....B."u.......Wyw.. ]71....$.\.g.%...P.%,%.h.;[.Z..f.#y.....S....p.F.l..&f.8S..mk.. ........z.e.;..#(.al...|..%.i...k.......D./...E.*..{............W.R...m..>.|...s......%.{&.|`8...2[k.}.*.B..Zg...2.0..|.x".l...G....D..4.L....v6.t6_.*...1..8,..=......I|].W.MF.-.y..fU.V....iCjL...u..K.W.<.2i-:Sw'...$..n........!_....e.'^..................]}\mT..0..!...#.s-]..Z..Yh..At...60.C......t.eJc.n......p...t?.>.......:.G..._...S.H.......W.+l..5..[.!~W.#r.,Z..SR..R4...N....U..~.B......U..~:.9...l.cf.r..q...p.YD..X.M.fe.3.RY.Z=..C....@....yF...I..q.U....c.W1.:.f.R.".=....K..~...".....-.q.c2......H..4.].y..E|.......1..&.....PO...3!'t"@....N.-B-...lD]...3..v.x.o.........X..G....(.J..N...S...s.....[}{:.*.W...k".h_.J.... g.....j....z@...%6......b*T2;..C...W..9!L$g.....h.0.P.W...8)..9@E..A.R......Zf.".....]..-....s.f.0.E......

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\iDSBridgeNative.exe (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):52560
                                                                                                                                                                                                    Entropy (8bit):6.004108508692104
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:768:Zs5iGEaao0bDYLsZ8Dp/BZWUVFMz85luozkhtpAV7OliRBEDos:23EhJv6s+xBZZo85luozkFCgiDo
                                                                                                                                                                                                    MD5:1ED16F2085B9AEB0455D4152C4C08E2F
                                                                                                                                                                                                    SHA1:135FE910A3038A38807931F1A01715833D0F5504
                                                                                                                                                                                                    SHA-256:A672FA2D2A94DA626F0535635EB54C3DDEC0234DF1BCB32BB10F58EA082906D7
                                                                                                                                                                                                    SHA-512:5B5E07F56C972C0578D04B8A9B8C544B59615D843A64551BED76C8A0034A2D05E4D95713A1C9CBEE455D0F1D5A44C2F1B59C430B484E63C7FDEE3C93024F5302
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........H.G.)...)...)...Qr..)...A...)...A...)...A...)...A...)...O...)..|@...)...)...)..|@...)..|@...)..|@...)..Rich.)..........PE..L.....\.................B...n.......B.......`....@.......................................@..................................o..........@?..............P...........pd..p............................d..@............`...............................text....A.......B.................. ..`.rdata.......`... ...F..............@..@.data...8............f..............@....rsrc...@?.......@...j..............@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\iDSBridgeNativex64.exe (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):33792
                                                                                                                                                                                                    Entropy (8bit):4.8846115811595165
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:lIfT9TDaxG7HMloZFYyMlf/8Pqc/J5ga2it6QOO2CgWX1N:sUxG728F9Md/8PqcB5grigQOfCh3
                                                                                                                                                                                                    MD5:E215D1590395B9B1611F4C4C491F2A7F
                                                                                                                                                                                                    SHA1:722DE82F4B25EB36A4A24C9D2D7137E45419CE85
                                                                                                                                                                                                    SHA-256:125FABEE4A7D0B436A97443B59818B968B1AB44FB5A32EC1CEBD536FBECD25FF
                                                                                                                                                                                                    SHA-512:B5EC72B3A071608B376CB2F78B898B487A90957FF94D6FAAAA75D517D97922659A6E148C1CA32C50A0905280A36255FC85244FB6E6933297671CA2DBB435530B
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6Y.r8..r8..r8...v,.s8...N*.s8...N..c8...N..v8..{@'.v8...N(.{8..r8..68...N..p8...N..s8...N).s8..Richr8..................PE..d...F..Z.........."...... ...`.......&.........@..........................................@.................................................4<.......p...A...`..................,....2...............................................0..H............................text............ .................. ..`.rdata..P....0.......$..............@..@.data........P.......:..............@....pdata.......`.......<..............@..@.rsrc....A...p...B...@..............@..@.reloc..~...........................@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\iDentalSoft Bridge.lnk

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Icon number=0, Archive, ctime=Thu Oct 3 18:38:47 2024, mtime=Thu Oct 3 18:39:03 2024, atime=Mon Nov 20 21:43:40 2023, length=33104, window=hide
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):2132
                                                                                                                                                                                                    Entropy (8bit):3.6041730660888143
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:24:8nKkEE4dOEAWog8n8BmnvfqAJ8tdnDd5XWUDZZ5XmUUIzqygm:8PX4dORWo5nkmnvfZJ8tdDd0UD3Bsyg
                                                                                                                                                                                                    MD5:26058D2B6125052527B5F70830C2F569
                                                                                                                                                                                                    SHA1:91DAED6D3688446ADD02672903C11397DFA92166
                                                                                                                                                                                                    SHA-256:A6A540C1981C081A49569DBA6E5F21CC29A0E1353A7738228161DEF516E03475
                                                                                                                                                                                                    SHA-512:BE3E059CB3AD1842DDC41C039DF84186A36FC98F428342A281016F312E680BFC8C935BA1324816BC5F29922AFE29705D7A1670AB84011AF75BB67DDE6473AC97
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:L..................F.@.. ....$.......<*......v......P............................P.O. .:i.....+00.../C:\.....................1.....CY...PROGRA~2.........O.ICY.....................V........P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....n.1.....CY....IDENTA~1..V......CY.CY...........................B$..i.D.e.n.t.a.l.S.o.f.t. .B.r.i.d.g.e.....J.1.....CY...bin.8......CY.CY.............................&.b.i.n.....z.2.P...tWt. .IDENTA~1.EXE..^......CY.CY.....a.........................i.D.e.n.t.a.l.S.o.f.t.-.B.r.i.d.g.e...e.x.e.......s...............-.......r.............1......C:\Program Files (x86)\iDentalSoft Bridge\bin\iDentalSoft-Bridge.exe......\.b.i.n.\.i.D.e.n.t.a.l.S.o.f.t.-.B.r.i.d.g.e...e.x.e.-.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.i.D.e.n.t.a.l.S.o.f.t. .B.r.i.d.g.e.\.b.i.n.F.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.i.D.e.n.t.a.l.S.o.f.t. .B.r.i.d.g.e.\.i.c.o.n.\.i.D.e.n.t.a.l._.A.g.e.n.t._.s.m.a.l.l...i.c.o.........%P

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\iDentalSoft-Bridge.exe (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:MS-DOS executable PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, MZ for MS-DOS
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):33104
                                                                                                                                                                                                    Entropy (8bit):7.81661953970717
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:768:exHKmM0qauedFQFtxTXKXAx6ZQgZOgRTw7DNV7OliRBEX:eImMyTcTXfxhgZzTugiDU
                                                                                                                                                                                                    MD5:3A8BD34A555D3F6AE3EE8D35168A5A48
                                                                                                                                                                                                    SHA1:1165F4BCF314D28F5B8A7FBB8A71D82504091C33
                                                                                                                                                                                                    SHA-256:4FD9CF4BFAE33D455E9BE978E4445EB0756134F149D611E6868C4DDE73D62FAE
                                                                                                                                                                                                    SHA-512:E339E2B7883927951BC73DC8F39A6B2D18A68058FDA3CA7767586FB23E0D2A9C6DFC0DE0F5E8E8B0627282909D2C29F3EE6C405D7F1D0AA9CA9F6B8777BFA9F3
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ@.....................................!..L.!Win32 .EXE...$@...PE..L......M...............2..........................@............................................. ...................................................d..P...............................................................@............................MPRESS1.........P.......................MPRESS2Q............R...................rsrc................`..............@..............................................................................v2.17...O.....45..C.c'I...R.6..h..}bM..c.iF....F....].J+...*tk...|.t.....%.T... C9.."..1a.k..<X....6A.k.T..Q......~.`aN.R2.n..../7.S.806.....]..`F.....v.8.=......}......3..1+..v..*4...W........(.B..'..W1......MI.2q...tP.f....a....../..:f......D....X.........f....~.]K..#..8.TM:.e.....%.'.A..MC%:....m7i..k...p.........Y........Z.KrP&N......9..B.*.I..E\.Kpg....Yy!.[.^.r%..c...a.&..$.....V....C....p...h3.x...)...|dW.Y4.+P..;.>vw%.lQ../......e.(.V...u..h.wU..

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\iDentalSoftBridge.jar (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Java archive data (JAR)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):396723
                                                                                                                                                                                                    Entropy (8bit):7.948784383004721
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:12288:KqTL4tLBbdJkxwQV2WKbN1NQLojjA3g+g:XTQhJed7K7eLK8C
                                                                                                                                                                                                    MD5:404880D3C37B333766112977CD5BE144
                                                                                                                                                                                                    SHA1:A40204E2A9325D787D981878A1E544169C88E558
                                                                                                                                                                                                    SHA-256:C3F155862B8DBD700A97D2E70ACA3C524AE1E44B5BB77D4BE717F0551376F7E8
                                                                                                                                                                                                    SHA-512:C5410A8BF5EAEABB1F00A6949A46348279EF1B8008C6D4E7DA199353AF308BA4D22FD707ADA0D444E9A5264F69B0D54CAA5302794C289A29A6F9A888B3CC64FA
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK........p.tW................META-INF/....PK........o.tW.n..............META-INF/MANIFEST.MF.V.n.6....?x...J..L..d...Z...2.d."...~..{.)[/;B. .9....o\....W.+.z.%,.NV.u..x.*f8.....t.d.wb.}~'.O,~..(..f..mx^..6.6.A......*z*....\...P..,3r..l.....^UU)soK...YF.p..8..Y).............%l.bVp.A.\i.....r...Y..Rr.....97...-.KY.&.]t.........5.;#D...+........t...t.Z.h.$..ku.P.pM@^'......U.B..%.).9...H7e....M......[.8a....B..S.s....tR.}>_s.3..A.........-..+..._^e&.B._.......H..R.8...Wmd.MV....{GF."..^......8...9.~K=.)I.x....mz.J........r.E.kY.........uK......k0t.pr..J".1r.d.@.Y.c;.T>..tz$.!B...s......VZ...........(2..G^Jd..U....!...8I{..Ya.....m.....i....@.... .P.....:,.P.[....[fl]D....3m...{...y...,....A/..D....[....x?.6m..3..Q..z..X.R!.g.....l...:.t.V..k..{..n.....y...K...%.bI.4...G.u..QD+............}.G....|o0.F...$..y..q5...../.d#jG.W....v.(m8......Bq?.;'N...oQ.iF..f.5w....|..8.q.*H.Q.xV..R.f..j....f.........%...<m.........WB.%...J.6..........8../.~

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\iDentalSoftBridge.lck

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ.exe
                                                                                                                                                                                                    File Type:ASCII text, with no line terminators
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):10
                                                                                                                                                                                                    Entropy (8bit):2.3709505944546687
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:O4wn:OJ
                                                                                                                                                                                                    MD5:D18DCB518D9135A042DC1220CE7D342A
                                                                                                                                                                                                    SHA1:126EDA8B2162832BE2AA58128B67E9AE26D221C0
                                                                                                                                                                                                    SHA-256:4977A7E5BB3675C438962DFB7F407945964386A321B7F3A1B0A7571F7EBB07FB
                                                                                                                                                                                                    SHA-512:A3264DD7D62E02815418A7AC4DEF5C9D42CEDE2228A0A64F669765C5EA6424BD46A6C617DABB3C080DC1F044F72ADFCEE60C159687A0400FDAD2F67C2B6F50AD
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:Running...

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\icon\iDental_Agent_large.bmp (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PC bitmap, Windows 3.x format, 164 x 314 x 24, image size 154490, resolution 2834 x 2834 px/m, cbSize 154544, bits offset 54
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):154544
                                                                                                                                                                                                    Entropy (8bit):3.0828388167103373
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:768:zGx4iEtk7Abp9WpQji95qJQ/Qe/6wlArQ4Jfyb0CsTt3dQinfrf:zGxEtk7AV9WpQjc5qJQ4e/6iOpJyb0fj
                                                                                                                                                                                                    MD5:4D600858F4AFBD7F5F40EB1589206792
                                                                                                                                                                                                    SHA1:8CBCE253BFE4663698D2518C3F749829D0EAA8A0
                                                                                                                                                                                                    SHA-256:275B3F68A5A66C84C537ACEDE494231A5FC50706BBCE469506F122D2760EF8C1
                                                                                                                                                                                                    SHA-512:2A7E0C5089BF62E71AA80D3B15AA6D4558D25D63B1049D77C9D026A1E8563EDC10A234771C008CC7C0B0447AA45F90FCC60ED46ED85C7CB02D87159CC3CC0AAA
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:BM.[......6...(.......:...........z[....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\icon\iDental_Agent_small.bmp (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PC bitmap, Windows 3.x format, 55 x 58 x 24, image size 9746, resolution 2834 x 2834 px/m, cbSize 9800, bits offset 54
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):9800
                                                                                                                                                                                                    Entropy (8bit):2.337067935347393
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:48:w4gJTTP4a8TTTTTTTTTTTTTTTTTTTTTTTTTTTTTCtmphtYcgQbab6beAwikSY3E5:c+L/6csmXjkSL5
                                                                                                                                                                                                    MD5:B83F2CDE173476C466AA4D94B7B8FF67
                                                                                                                                                                                                    SHA1:49A5ED40A93551E135E3088EADBD2420F17307DD
                                                                                                                                                                                                    SHA-256:8C263B0BCF91F009F345B52692653624DB399DD05CAA0E2A3DDC99FEB0DCF99B
                                                                                                                                                                                                    SHA-512:3E8B7CAF9327BC53973FC97E060D90C41C77224E982113E16A9C1B341B788A5B5319BCF35CECE5E63613634F36D1B95BC375FD6F63827A75E2879A5BCBD9F2B4
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:BMH&......6...(...7...:............&.............................................................................................................................................................................................................8.8.8.8.8.8......................................................................................................................................................8.8.8.8.8.8......................................................................................................................................................8.8.8.8.8.8......................................................................................................................................................8.8.8.8.8.8................................................................................................................................:.....................8.8.8.8.8.8.....................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\icon\iDental_Agent_small.ico (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:MS Windows icon resource - 3 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):15086
                                                                                                                                                                                                    Entropy (8bit):2.850395458265185
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:48:2AQ1JQcxo4K9ZRLek4xsA1qxXH+IjOdu6wQOQrQYQXnFV6fhNXDZBfok:xWCcxk9ZRik4QXefdP7Vcz/slNuk
                                                                                                                                                                                                    MD5:DB9C1F9DE02CFFE2CE6E4D48E605E009
                                                                                                                                                                                                    SHA1:8AFC1CC923493D3E516334835A6249772F8ED833
                                                                                                                                                                                                    SHA-256:9E5327128F10959DC5CF099673887A4A0D04786001BA7DADF1304BC2CA53E690
                                                                                                                                                                                                    SHA-512:2FFE27CD9EB4EFB885637D482C1B950EC4F5AEFCE57A3FC354908C1D8AB354BBD4E0354FEB4578B3AFEA8CF89EC18BC8C1D90FE0287D372F975262611267B526
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:............ .h...6... .... .........00.... ..%..F...(....... ..... .....@........................8+.7U.8%.....................................................8..8..8k.....................................................8..8..8k.....................................................8..8..8k.....................................................8..8..8k.....................................................8..8..8k.....................................................8..8..8k.....................................................8..8..8k.....................................................8..8..8k.....................................................8..8..8k.@1.4..AK.........................u..8..5c.....8A.8..77.@K.4..;.........................KM.4..5..................@K.4..4..A.................S%.7..5..5......8).8{.8#.I).8..4..4..;..Ac.EO.>..6..5..5..?a.....7..8..8......i..>..4..5..4..3..4..4..8..K9.........8..

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\icon\iDental_Bridge.icns (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Mac OS X icon, 79326 bytes, "is32" type
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):79326
                                                                                                                                                                                                    Entropy (8bit):6.957822482612265
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:768:IbCqZX2kmXGkn+u/kgIFwOj611RRXcKxMvD5vnt9YBPAHNRp7Mu2INH4O8zy4c0q:IbCG8XfiFwKI1R9NuFvnZtRp7VzJ4cP/
                                                                                                                                                                                                    MD5:A452042B02C30ABE40D151315223D3A2
                                                                                                                                                                                                    SHA1:A9DB9194C99F0FFE34AC0E4619130DF5C0495D42
                                                                                                                                                                                                    SHA-256:F7A70C4BE5D6729A6BC3F028F5DB44796AA3E29286D2D8F488B2F820D94C9BD9
                                                                                                                                                                                                    SHA-512:323AF9DCC1D2D4DA1D09C14D9787DA1C7B633B1410557C06861A340C9B9F23F96B33A83A976A3A94219C37F3900A650BAB1B360F1E6059746098CDA72D548EDE
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:icns..5.is32.....5.7424.5.1.36.5.645445545321.5.454.5.487.5.44.5.4.5.4'55.4.5545174554/.5.33.5.45,.454..5.0455.3<44.5.2.5.143455343..5.9,)=<5"!-&!..5...5...5...5...5...5...5...........................................................c...........................................................................................................................................................................................................................s8mk.............'.........+.......5...0..M.P...........Qf.q...................,........j.....2............m......_...................................................................................................................................(/.............il32...D.5...9=>5.67$..06cO:...5.;..4/.,:686=9<1621<...5.6673MK6.4.7()3<;8...5..5..6.4.5.4.841621<.5.2:<544.5.445..3?<.5.41744.5.44865@.5.99544.5.44.5.44522.5.4223.5.4.5.3-0.5.3223.5.45;.-.844.5.3(0...3223.5.4622+/,!"54.5.3(0.5.4223.5.45018-sf7 m44.5.3(0.5.323.5.49;8T9.885564.5.3(0.5

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\icon\is-5JQ5J.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PC bitmap, Windows 3.x format, 164 x 314 x 24, image size 154490, resolution 2834 x 2834 px/m, cbSize 154544, bits offset 54
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):154544
                                                                                                                                                                                                    Entropy (8bit):3.0828388167103373
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:768:zGx4iEtk7Abp9WpQji95qJQ/Qe/6wlArQ4Jfyb0CsTt3dQinfrf:zGxEtk7AV9WpQjc5qJQ4e/6iOpJyb0fj
                                                                                                                                                                                                    MD5:4D600858F4AFBD7F5F40EB1589206792
                                                                                                                                                                                                    SHA1:8CBCE253BFE4663698D2518C3F749829D0EAA8A0
                                                                                                                                                                                                    SHA-256:275B3F68A5A66C84C537ACEDE494231A5FC50706BBCE469506F122D2760EF8C1
                                                                                                                                                                                                    SHA-512:2A7E0C5089BF62E71AA80D3B15AA6D4558D25D63B1049D77C9D026A1E8563EDC10A234771C008CC7C0B0447AA45F90FCC60ED46ED85C7CB02D87159CC3CC0AAA
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:BM.[......6...(.......:...........z[....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\icon\is-F3GON.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:MS Windows icon resource - 3 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):15086
                                                                                                                                                                                                    Entropy (8bit):2.850395458265185
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:48:2AQ1JQcxo4K9ZRLek4xsA1qxXH+IjOdu6wQOQrQYQXnFV6fhNXDZBfok:xWCcxk9ZRik4QXefdP7Vcz/slNuk
                                                                                                                                                                                                    MD5:DB9C1F9DE02CFFE2CE6E4D48E605E009
                                                                                                                                                                                                    SHA1:8AFC1CC923493D3E516334835A6249772F8ED833
                                                                                                                                                                                                    SHA-256:9E5327128F10959DC5CF099673887A4A0D04786001BA7DADF1304BC2CA53E690
                                                                                                                                                                                                    SHA-512:2FFE27CD9EB4EFB885637D482C1B950EC4F5AEFCE57A3FC354908C1D8AB354BBD4E0354FEB4578B3AFEA8CF89EC18BC8C1D90FE0287D372F975262611267B526
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:............ .h...6... .... .........00.... ..%..F...(....... ..... .....@........................8+.7U.8%.....................................................8..8..8k.....................................................8..8..8k.....................................................8..8..8k.....................................................8..8..8k.....................................................8..8..8k.....................................................8..8..8k.....................................................8..8..8k.....................................................8..8..8k.....................................................8..8..8k.@1.4..AK.........................u..8..5c.....8A.8..77.@K.4..;.........................KM.4..5..................@K.4..4..A.................S%.7..5..5......8).8{.8#.I).8..4..4..;..Ac.EO.>..6..5..5..?a.....7..8..8......i..>..4..5..4..3..4..4..8..K9.........8..

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\icon\is-F8OU6.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):1150
                                                                                                                                                                                                    Entropy (8bit):3.794684290733173
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:12:DvuxKHrHEC5hbJQOn8RJC6Ff4nrSq55555555555555R:zu49anaN
                                                                                                                                                                                                    MD5:6DF7E952D4401586856835918191F9C9
                                                                                                                                                                                                    SHA1:6657236B2DA7E51FAA2ADA649BF89BF760F3D81D
                                                                                                                                                                                                    SHA-256:7C9199C92043BE7E59E7D263A3E3020DB85A41F84522697CCE498F85424B7B12
                                                                                                                                                                                                    SHA-512:143B3395CF8B3A66DCF5338662FC944A56C0E8D184C85EA8F355658EEF1A7DE2CF606F8133988534EB7B35585E4553F4A6F0417D069704C362774F0A5FF19232
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:............ .h.......(....... ..... .....@.....................3A..3...3...3A..................................................3A..3...3...3A....................hf........Q........RT.......3A..3...3...3A............97..........75..............lm.[......3A..3...3...3A...............-BB..............&&...|.U..........3A..3...3...3A................{x.m............JH...............3A..3...3...3A...............Y...................._\...........3A..3...3...3A............. ......++...oJI..........ZZ.{......3A..3...3...3A............66..*).....Q.......)IF.. ..ig.k......3A..3...3...3A..................................................3A..3...3...3A......................................................................3...3...@.......................6C..3...3.......................3...3...3...D...............8)..3...3...3...3!..3...3...3!......3...3...3...3...5q..5U..3...3...3...3...3_..3...3...3...3.......3...3i..3...3...3...3...3...3...3...6C..3...3q..3...3...3...........3...8/..3...3...

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\icon\is-N3DSD.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PC bitmap, Windows 3.x format, 55 x 58 x 24, image size 9746, resolution 2834 x 2834 px/m, cbSize 9800, bits offset 54
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):9800
                                                                                                                                                                                                    Entropy (8bit):2.337067935347393
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:48:w4gJTTP4a8TTTTTTTTTTTTTTTTTTTTTTTTTTTTTCtmphtYcgQbab6beAwikSY3E5:c+L/6csmXjkSL5
                                                                                                                                                                                                    MD5:B83F2CDE173476C466AA4D94B7B8FF67
                                                                                                                                                                                                    SHA1:49A5ED40A93551E135E3088EADBD2420F17307DD
                                                                                                                                                                                                    SHA-256:8C263B0BCF91F009F345B52692653624DB399DD05CAA0E2A3DDC99FEB0DCF99B
                                                                                                                                                                                                    SHA-512:3E8B7CAF9327BC53973FC97E060D90C41C77224E982113E16A9C1B341B788A5B5319BCF35CECE5E63613634F36D1B95BC375FD6F63827A75E2879A5BCBD9F2B4
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:BMH&......6...(...7...:............&.............................................................................................................................................................................................................8.8.8.8.8.8......................................................................................................................................................8.8.8.8.8.8......................................................................................................................................................8.8.8.8.8.8......................................................................................................................................................8.8.8.8.8.8................................................................................................................................:.....................8.8.8.8.8.8.....................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\icon\is-OG8PJ.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Mac OS X icon, 79326 bytes, "is32" type
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):79326
                                                                                                                                                                                                    Entropy (8bit):6.957822482612265
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:768:IbCqZX2kmXGkn+u/kgIFwOj611RRXcKxMvD5vnt9YBPAHNRp7Mu2INH4O8zy4c0q:IbCG8XfiFwKI1R9NuFvnZtRp7VzJ4cP/
                                                                                                                                                                                                    MD5:A452042B02C30ABE40D151315223D3A2
                                                                                                                                                                                                    SHA1:A9DB9194C99F0FFE34AC0E4619130DF5C0495D42
                                                                                                                                                                                                    SHA-256:F7A70C4BE5D6729A6BC3F028F5DB44796AA3E29286D2D8F488B2F820D94C9BD9
                                                                                                                                                                                                    SHA-512:323AF9DCC1D2D4DA1D09C14D9787DA1C7B633B1410557C06861A340C9B9F23F96B33A83A976A3A94219C37F3900A650BAB1B360F1E6059746098CDA72D548EDE
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:icns..5.is32.....5.7424.5.1.36.5.645445545321.5.454.5.487.5.44.5.4.5.4'55.4.5545174554/.5.33.5.45,.454..5.0455.3<44.5.2.5.143455343..5.9,)=<5"!-&!..5...5...5...5...5...5...5...........................................................c...........................................................................................................................................................................................................................s8mk.............'.........+.......5...0..M.P...........Qf.q...................,........j.....2............m......_...................................................................................................................................(/.............il32...D.5...9=>5.67$..06cO:...5.;..4/.,:686=9<1621<...5.6673MK6.4.7()3<;8...5..5..6.4.5.4.841621<.5.2:<544.5.445..3?<.5.41744.5.44865@.5.99544.5.44.5.44522.5.4223.5.4.5.3-0.5.3223.5.45;.-.844.5.3(0...3223.5.4622+/,!"54.5.3(0.5.4223.5.45018-sf7 m44.5.3(0.5.323.5.49;8T9.885564.5.3(0.5

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\icon\iss_Agent_uninstall.ico (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):1150
                                                                                                                                                                                                    Entropy (8bit):3.794684290733173
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:12:DvuxKHrHEC5hbJQOn8RJC6Ff4nrSq55555555555555R:zu49anaN
                                                                                                                                                                                                    MD5:6DF7E952D4401586856835918191F9C9
                                                                                                                                                                                                    SHA1:6657236B2DA7E51FAA2ADA649BF89BF760F3D81D
                                                                                                                                                                                                    SHA-256:7C9199C92043BE7E59E7D263A3E3020DB85A41F84522697CCE498F85424B7B12
                                                                                                                                                                                                    SHA-512:143B3395CF8B3A66DCF5338662FC944A56C0E8D184C85EA8F355658EEF1A7DE2CF606F8133988534EB7B35585E4553F4A6F0417D069704C362774F0A5FF19232
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:............ .h.......(....... ..... .....@.....................3A..3...3...3A..................................................3A..3...3...3A....................hf........Q........RT.......3A..3...3...3A............97..........75..............lm.[......3A..3...3...3A...............-BB..............&&...|.U..........3A..3...3...3A................{x.m............JH...............3A..3...3...3A...............Y...................._\...........3A..3...3...3A............. ......++...oJI..........ZZ.{......3A..3...3...3A............66..*).....Q.......)IF.. ..ig.k......3A..3...3...3A..................................................3A..3...3...3A......................................................................3...3...@.......................6C..3...3.......................3...3...3...D...............8)..3...3...3...3!..3...3...3!......3...3...3...3...5q..5U..3...3...3...3...3_..3...3...3...3.......3...3i..3...3...3...3...3...3...3...6C..3...3q..3...3...3...........3...8/..3...3...

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\images\idental_agent.png (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):2976
                                                                                                                                                                                                    Entropy (8bit):7.879137258962385
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:48:b/6DocieftI9G9f6A+FIDOWu0lDl+gm7QyTtctIInQSy6IVpqlnBcOD3RMjd:bSDZ/I09Da01l+gmkyTt6Hk8nTBMjd
                                                                                                                                                                                                    MD5:364694FCAF886482CB6BE235B0CACEE5
                                                                                                                                                                                                    SHA1:DA6B03253F23219067530557EED3A24969FA4653
                                                                                                                                                                                                    SHA-256:E543F478AB2D19031DB0905E30DD47A7121DB890F0765F71262E073929229BC0
                                                                                                                                                                                                    SHA-512:40538A479D98E8250DE42C0DE512377B0737FE8518B62B416C804FC5A1FFE03154F19C54750B9ED756B48912A83F170E9EA3CA2F39C28B382CA3E70AAB2AEF8A
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:.PNG........IHDR................a....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+...*..x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D..*.A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\images\is-479MC.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):2976
                                                                                                                                                                                                    Entropy (8bit):7.879137258962385
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:48:b/6DocieftI9G9f6A+FIDOWu0lDl+gm7QyTtctIInQSy6IVpqlnBcOD3RMjd:bSDZ/I09Da01l+gmkyTt6Hk8nTBMjd
                                                                                                                                                                                                    MD5:364694FCAF886482CB6BE235B0CACEE5
                                                                                                                                                                                                    SHA1:DA6B03253F23219067530557EED3A24969FA4653
                                                                                                                                                                                                    SHA-256:E543F478AB2D19031DB0905E30DD47A7121DB890F0765F71262E073929229BC0
                                                                                                                                                                                                    SHA-512:40538A479D98E8250DE42C0DE512377B0737FE8518B62B416C804FC5A1FFE03154F19C54750B9ED756B48912A83F170E9EA3CA2F39C28B382CA3E70AAB2AEF8A
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:.PNG........IHDR................a....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+...*..x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D..*.A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\is-37ER4.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):727029
                                                                                                                                                                                                    Entropy (8bit):6.5015001724386785
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:12288:UTPcYn5c/rPx37/zHBA6a5Ueyp2CrIEROlnrNORuiVbRx9Y1:IPcYn5c/rPx37/zHBA6pDp2mIEiiNRxy
                                                                                                                                                                                                    MD5:EF0AF3E170C66023DDF1C9BCE05754C8
                                                                                                                                                                                                    SHA1:41F0ED5CA288ABEA87F157E913855B08152C00E4
                                                                                                                                                                                                    SHA-256:A91284CF6C26025C045760EB30C8A85FE158935E32237A1E698AA07808C46E0A
                                                                                                                                                                                                    SHA-512:ADD18FA15FE5BD5CD33CA812318245DD607C2837135D72E6A1E3A8884DE20C432F05C9387C110C86D604CD7768920062B5F93FDA802538E7C964F5DF1658F892
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 5%
                                                                                                                                                                                                    Preview:MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................z...n....................@..............................................@...............................%......d3................... ......................................................................................CODE....\y.......z.................. ..`DATA.................~..............@...BSS......................................idata...%.......&..................@....tls.....................................rdata..............................@..P.reloc...... ......................@..P.rsrc...d3.......4..................@..P.....................P..............@..P........................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\is-4RUAM.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):4397384
                                                                                                                                                                                                    Entropy (8bit):7.044986254855662
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:98304:wnXVMSRMlBoIafB/I6A9Xwk2px12CqRe+RM/kXben7XTWwt52n7/YRFLOAkGkzdC:wnX1f2CYo7XTqYRFLOyomFHKnPAT
                                                                                                                                                                                                    MD5:A807596CB3CB377A1A687C9734D67A37
                                                                                                                                                                                                    SHA1:29DD7CA9AF4085C6897788C1AFAADF59DD5D8B0E
                                                                                                                                                                                                    SHA-256:496E1A21645ABAA90FA544C025E6F0DE1CBCBD5D060007A8A9E2FB5787655D0E
                                                                                                                                                                                                    SHA-512:7534CC0BF5CFCF238FEFDBE47FA895E47D08F7545CFE2E9DCEDA703E7652060821E3CFF9F839E5BC78A11205B9A0FD1A5DBA47B845AE83D05A6005F49A224E28
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........._.1...1...1.......1.......1.......1.'....1.......1.......1.......1.......1...0.H.1.....(.1.......1.......1.......1.Rich..1.................PE..L....)_M.........."!......*..d........%.......+....x..........................C.....OdC...@.........................@.*.......).......,.H.............C.H.....@.$..../..................................@...............8.....)......................text...3.*.......*................. ..`.data.........+.......*.............@....rsrc...H.....,.......+.............@..@.reloc...a....@..b....?.............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\is-6BR1D.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):52560
                                                                                                                                                                                                    Entropy (8bit):6.004108508692104
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:768:Zs5iGEaao0bDYLsZ8Dp/BZWUVFMz85luozkhtpAV7OliRBEDos:23EhJv6s+xBZZo85luozkFCgiDo
                                                                                                                                                                                                    MD5:1ED16F2085B9AEB0455D4152C4C08E2F
                                                                                                                                                                                                    SHA1:135FE910A3038A38807931F1A01715833D0F5504
                                                                                                                                                                                                    SHA-256:A672FA2D2A94DA626F0535635EB54C3DDEC0234DF1BCB32BB10F58EA082906D7
                                                                                                                                                                                                    SHA-512:5B5E07F56C972C0578D04B8A9B8C544B59615D843A64551BED76C8A0034A2D05E4D95713A1C9CBEE455D0F1D5A44C2F1B59C430B484E63C7FDEE3C93024F5302
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........H.G.)...)...)...Qr..)...A...)...A...)...A...)...A...)...O...)..|@...)...)...)..|@...)..|@...)..|@...)..Rich.)..........PE..L.....\.................B...n.......B.......`....@.......................................@..................................o..........@?..............P...........pd..p............................d..@............`...............................text....A.......B.................. ..`.rdata.......`... ...F..............@..@.data...8............f..............@....rsrc...@?.......@...j..............@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\is-7HAU4.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):51024
                                                                                                                                                                                                    Entropy (8bit):6.570853299187645
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:768:OzODb0Z75wT6FdYD2l+uYYdsNlc363tjAfdV7OliRBEE:R4Z75rYD2qNzefXgiD3
                                                                                                                                                                                                    MD5:EE5E5A105435298F5D68910762037368
                                                                                                                                                                                                    SHA1:97250A606B3DC63CF5EB01B720F53D0CE1CEA18E
                                                                                                                                                                                                    SHA-256:EE127B4D164DB763FF31A219499E06CC0178FE04EA5C2D5B2C3F155837CA83C5
                                                                                                                                                                                                    SHA-512:3DD75A5BF12DB8F3D759400CF3E1FD7773871491C4DC3C83671E4931D33C9F0D4CCD320FC7EBFCA1B7AD9C3D24B1F157E9321F950E4C9575205D51A1DE09200A
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........q..g...g...g.......g.......g.......g.......g.......g.......g..!....g...g...g..!....g..!....g..!..g..!....g..Rich.g..........................PE..L.....\...........!.....h...B......>d....................................................@.........................0...0...`...........................P...........`...p...................p..........@............................................text...,f.......h.................. ..`.rdata...-...........l..............@..@.data...............................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\is-7J5B1.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):156160
                                                                                                                                                                                                    Entropy (8bit):6.283455442630357
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:1536:nlBCrOYL9l4h701waNCIAs2u2r4lMzgBJVxb0s5x3mSiFaKHRiJ30KIIZEsy+0Iw:nlT634hDa4JsQOxiQbIIasy+0IV
                                                                                                                                                                                                    MD5:6968B37D8062D8EAFFE3D31A9721CDB7
                                                                                                                                                                                                    SHA1:56C94CFA0F863096F2511D620D74A3E9ECBCE6F6
                                                                                                                                                                                                    SHA-256:C802747272F8B92AC5C0D787441AE6F95DE567BF8EF35D8F933A74211CA6F77B
                                                                                                                                                                                                    SHA-512:0619273D877E4F6B4F6E0C41045A6F72649617845CCAC9334B37148A8167FB16FDE5432E9D352B6F2359BE11B494D80937DC590DC777BA34AE6D2AD8CB746747
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........B..o,..o,..o,.....o,......o,.....o,......o,..o-..o,......o,......o,......o,......o,.Rich.o,.........................PE..L...w.Q...........!................'...........................................................................................<....p.. ....................... ...@...............................H...@............................................text...l........................... ..`.rdata.. \.......^..................@..@.data....4... ......................@....tls.........`.......&..............@....rsrc... ....p.......(..............@..@.reloc..N".......$...>..............@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\is-81VOH.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):87360
                                                                                                                                                                                                    Entropy (8bit):6.88438978709945
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:1536:4rcAKWRMbpuRQci+7uXTKLWe+27JofZo0ENm2eK7oJnoUSgpAY8ODcDcm7cIsXg4:4r3KiRQcJ7uj8f7Jofm0ENm2eK7mnoU0
                                                                                                                                                                                                    MD5:B3FBD2F37A60830E6666961255D91EA1
                                                                                                                                                                                                    SHA1:712B9909B1D041EDDF8EDCCE2517CF3201D05E73
                                                                                                                                                                                                    SHA-256:13DF03D586FEEA45FA52DC512DDF9FA5C1C6BBF0D90C6B01F0EC6D73776EADCC
                                                                                                                                                                                                    SHA-512:BF5D66A9A4FB884EF96EC15407F2547C821D7A1A134EB3E9C68F6A5C563F6D28052970CCCF224CBE45DD1F8B1138CCE6238748B716D048CF8686268AFEB30337
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 2%
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....... .id..:d..:d..:..=:f..:m.A:o..:d..:L..:w..;k..:w..;w..:w..;`..:w..;...:w..;e..:w.-:e..:w..;e..:Richd..:........PE..L...*x.Z.........."!......... ..............................................P............@A................................. .......0..................@?...@..H...p ..8............................ ..@............ ...............................text............................... ..`.data...............................@....idata....... ......................@..@.rsrc........0......................@..@.reloc..H....@......................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\is-87KCD.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):4875912
                                                                                                                                                                                                    Entropy (8bit):7.054105439139926
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:98304:0l3vFG3W/RNZbjNysi2Mn9VUfH0i9xCYX6LFLOAkGkzdnEVomFHKnPe8p:S/jjw9Vvi9xCYX6LFLOyomFHKnPe8p
                                                                                                                                                                                                    MD5:ED7F7A91A1E2DA5EDBDD9C365BC733C3
                                                                                                                                                                                                    SHA1:B3E963DFC8246ED1DEF52FD3F6E0E9550CD84340
                                                                                                                                                                                                    SHA-256:A1B9349D4AB78DE0000F0028631CBDB6AA9ED8D815E1A7D5513C773E65CF2CB9
                                                                                                                                                                                                    SHA-512:B757AB9D3F3A0BC202553C778FF5B947A233AFB8130997F6DB18A589E0B7BC2F727EAA87BBAAE888BEF5CE00217BEF2B4C6224D3271B706148A9216747756A6B
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 2%
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......L.............m:.....m<.....m=......Z.............................m&.........................6..........Rich...................PE..L...z{.Z.........."!....../.........`.+......./...............................J.......K...@A........................p.........0......P1..............(J..>....F......>..8...........................04..@.............0..............................text...c./......./................. ..`.data...\...../......./.............@....idata..vT....0..V...r0.............@..@.didat.......@1.......0.............@....rsrc........P1.......0.............@..@.reloc........F......dF.............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\is-8QLJ7.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):55448
                                                                                                                                                                                                    Entropy (8bit):5.190578673559488
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:Y3oaarN79ozVzEFtB26IJICr1q2A8TqOQ6YLt9l0vwxP5mLnAPeo75Y3kmA31dvT:Y3CB26IJICrU2fOOU9Uwxx/2ZrS14U
                                                                                                                                                                                                    MD5:2BF908F9B390DFF77953F913B1DD1BB8
                                                                                                                                                                                                    SHA1:768290E40080B7890219AA76C6DA8479CC626227
                                                                                                                                                                                                    SHA-256:FDB3764F71276B3820549CD4BDC6F14AED1376EDDEEC9B3CFED91A15168FEFC2
                                                                                                                                                                                                    SHA-512:718638377B3095FC5F5CAF912DC56D8D2073479A301A2F1B98100AED3BAD51832D9B82A5B5A5B8497F1A37EF75B9044A293B3CBC094B6BC6562F005169B9B772
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch37\stshfhich37\stshfbi37\deflang1033\deflangfe1033\themelang1033\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\f37\fbidi \fswiss\fcharset0\fprq2{\*\panose 020f0502020204030204}Calibri;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fhimino

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\is-CK4OJ.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):195584
                                                                                                                                                                                                    Entropy (8bit):5.914069453482232
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:VtMyaCTc5KmxjLyW7rSrG4MUcqneqn5EsMLAMS9apK3BAF:BBCV7mwfqneqykpRA
                                                                                                                                                                                                    MD5:733C54657245520CED930D4394A9DD84
                                                                                                                                                                                                    SHA1:700C85671732AAFFFEB73AB2F562F180D95FBFF5
                                                                                                                                                                                                    SHA-256:D1D78E2D7987E9A0C00F012BACA6C276E7548C8C79FD41857A4EC1B4DAF8EB79
                                                                                                                                                                                                    SHA-512:2945D4920918E409BE7C479BB47A6741FED7E25A6CACB4F4A91CC108A089AAEC769E018449CE7B11616A9C4F37AAD3CC3C544DD285FD40AF36C0CF0D5B434A1D
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......b...&..&..&../.N.K../.X.,../.I..../.^.!..&...../.G./../._.'../.Y.'../.\.'..Rich&..........PE..d.....Q.........." ........................................................p......GR.................................................._.......<....@.. ........(...........`...............................E..(....................................................text...&........................... ..`.rdata..............................@..@.data....A....... ..................@....pdata...(.......*..................@..@.tls.........0......................@....rsrc... ....@......................@..@.reloc.......`......................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\is-DQA0M.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):123904
                                                                                                                                                                                                    Entropy (8bit):6.421088035073883
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:+cK2gFTHnt12TqrYSoJZrz6qAsSSqMD/Bm:+nTHtETUYZJF62qO
                                                                                                                                                                                                    MD5:86BA9DA1B5E0336DE8FA52B0308CF990
                                                                                                                                                                                                    SHA1:571C508B775D820AF18530782644BC2572A26B85
                                                                                                                                                                                                    SHA-256:065FDD0DCC05D0F6B4D27E76E67EA1585CC2F873279DFA357091F97396BDBCDC
                                                                                                                                                                                                    SHA-512:FE6262FF432A8E3F7392ED240C2FA09D501323BC133DEB79F8E0AAD70F6C3733B848D46A69E9EA2A53ABB897D53DA983B0CC5E392F25348BEFC5FB5C123CE73B
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......am.J%.k.%.k.%.k.Jz..1.k.Jz..O.k.,t..,.k.%.j.\.k.Jz....k.Jz..$.k.Jz..$.k.Jz..$.k.Rich%.k.................PE..L.....\...........!.....:..................P...............................@..........................................I...L...d....................................R..................................@............P...............................text...G8.......:.................. ..`.rdata...`...P...b...>..............@..@.data....8..........................@....rsrc...............................@..@.reloc...!......."..................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\is-I8D2H.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Java archive data (JAR)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):396723
                                                                                                                                                                                                    Entropy (8bit):7.948784383004721
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:12288:KqTL4tLBbdJkxwQV2WKbN1NQLojjA3g+g:XTQhJed7K7eLK8C
                                                                                                                                                                                                    MD5:404880D3C37B333766112977CD5BE144
                                                                                                                                                                                                    SHA1:A40204E2A9325D787D981878A1E544169C88E558
                                                                                                                                                                                                    SHA-256:C3F155862B8DBD700A97D2E70ACA3C524AE1E44B5BB77D4BE717F0551376F7E8
                                                                                                                                                                                                    SHA-512:C5410A8BF5EAEABB1F00A6949A46348279EF1B8008C6D4E7DA199353AF308BA4D22FD707ADA0D444E9A5264F69B0D54CAA5302794C289A29A6F9A888B3CC64FA
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK........p.tW................META-INF/....PK........o.tW.n..............META-INF/MANIFEST.MF.V.n.6....?x...J..L..d...Z...2.d."...~..{.)[/;B. .9....o\....W.+.z.%,.NV.u..x.*f8.....t.d.wb.}~'.O,~..(..f..mx^..6.6.A......*z*....\...P..,3r..l.....^UU)soK...YF.p..8..Y).............%l.bVp.A.\i.....r...Y..Rr.....97...-.KY.&.]t.........5.;#D...+........t...t.Z.h.$..ku.P.pM@^'......U.B..%.).9...H7e....M......[.8a....B..S.s....tR.}>_s.3..A.........-..+..._^e&.B._.......H..R.8...Wmd.MV....{GF."..^......8...9.~K=.)I.x....mz.J........r.E.kY.........uK......k0t.pr..J".1r.d.@.Y.c;.T>..tz$.!B...s......VZ...........(2..G^Jd..U....!...8I{..Ya.....m.....i....@.... .P.....:,.P.[....[fl]D....3m...{...y...,....A/..D....[....x?.6m..3..Q..z..X.R!.g.....l...:.t.V..k..{..n.....y...K...%.bI.4...G.u..QD+............}.G....|o0.F...$..y..q5...../.d#jG.W....v.(m8......Bq?.;'N...oQ.iF..f.5w....|..8.q.*H.Q.xV..R.f..j....f.........%...<m.........WB.%...J.6..........8../.~

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\is-IH3MV.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):33792
                                                                                                                                                                                                    Entropy (8bit):4.8846115811595165
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:lIfT9TDaxG7HMloZFYyMlf/8Pqc/J5ga2it6QOO2CgWX1N:sUxG728F9Md/8PqcB5grigQOfCh3
                                                                                                                                                                                                    MD5:E215D1590395B9B1611F4C4C491F2A7F
                                                                                                                                                                                                    SHA1:722DE82F4B25EB36A4A24C9D2D7137E45419CE85
                                                                                                                                                                                                    SHA-256:125FABEE4A7D0B436A97443B59818B968B1AB44FB5A32EC1CEBD536FBECD25FF
                                                                                                                                                                                                    SHA-512:B5EC72B3A071608B376CB2F78B898B487A90957FF94D6FAAAA75D517D97922659A6E148C1CA32C50A0905280A36255FC85244FB6E6933297671CA2DBB435530B
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6Y.r8..r8..r8...v,.s8...N*.s8...N..c8...N..v8..{@'.v8...N(.{8..r8..68...N..p8...N..s8...N).s8..Richr8..................PE..d...F..Z.........."...... ...`.......&.........@..........................................@.................................................4<.......p...A...`..................,....2...............................................0..H............................text............ .................. ..`.rdata..P....0.......$..............@..@.data........P.......:..............@....pdata.......`.......<..............@..@.rsrc....A...p...B...@..............@..@.reloc..~...........................@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\is-JCHHI.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):168144
                                                                                                                                                                                                    Entropy (8bit):6.219704762029254
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:WS6D86Zy046did4UfpX5QiixnjQxQY5rr8Lf3M3AA51Tiw/:WS6D86ZyV4idvpXaipV5s6AgiA
                                                                                                                                                                                                    MD5:DCD85D844C1583C61D3AFABD983AA0B5
                                                                                                                                                                                                    SHA1:2675B890400C445FAEB4495884D8E2BBEAB15F2F
                                                                                                                                                                                                    SHA-256:96A87AABDF2AF814785965DE82F25D30F2CD1C1C6755835782AED8000D36E56E
                                                                                                                                                                                                    SHA-512:28BEC5FD6148230F88F49DC929965E8B564690A858B6EDB1A602B86F7B8848493C3790DA717BE5922DF1B925A09108F37E00B7AAC2163865E4970B68FBE9B654
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........,..B..B..B.......B.....B..}9..B..C...B......B.....B.....B.....B.Rich.B.................PE..d...kk.R.........." ................H...............................................~................................................3..I....'..d....................r...............................................................................................text...Z........................... ..`.rdata.............................@..@.data...DI...@...(...(..............@....pdata...............P..............@..@.rsrc................`..............@..@.reloc...............h..............@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\is-JSVPI.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:MS-DOS executable PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, MZ for MS-DOS
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):33104
                                                                                                                                                                                                    Entropy (8bit):7.81661953970717
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:768:exHKmM0qauedFQFtxTXKXAx6ZQgZOgRTw7DNV7OliRBEX:eImMyTcTXfxhgZzTugiDU
                                                                                                                                                                                                    MD5:3A8BD34A555D3F6AE3EE8D35168A5A48
                                                                                                                                                                                                    SHA1:1165F4BCF314D28F5B8A7FBB8A71D82504091C33
                                                                                                                                                                                                    SHA-256:4FD9CF4BFAE33D455E9BE978E4445EB0756134F149D611E6868C4DDE73D62FAE
                                                                                                                                                                                                    SHA-512:E339E2B7883927951BC73DC8F39A6B2D18A68058FDA3CA7767586FB23E0D2A9C6DFC0DE0F5E8E8B0627282909D2C29F3EE6C405D7F1D0AA9CA9F6B8777BFA9F3
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ@.....................................!..L.!Win32 .EXE...$@...PE..L......M...............2..........................@............................................. ...................................................d..P...............................................................@............................MPRESS1.........P.......................MPRESS2Q............R...................rsrc................`..............@..............................................................................v2.17...O.....45..C.c'I...R.6..h..}bM..c.iF....F....].J+...*tk...|.t.....%.T... C9.."..1a.k..<X....6A.k.T..Q......~.`aN.R2.n..../7.S.806.....]..`F.....v.8.=......}......3..1+..v..*4...W........(.B..'..W1......MI.2q...tP.f....a....../..:f......D....X.........f....~.]K..#..8.TM:.e.....%.'.A..MC%:....m7i..k...p.........Y........Z.KrP&N......9..B.*.I..E\.Kpg....Yy!.[.^.r%..c...a.&..$.....V....C....p...h3.x...)...|dW.Y4.+P..;.>vw%.lQ../......e.(.V...u..h.wU..

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\is-KL3FJ.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):21504
                                                                                                                                                                                                    Entropy (8bit):5.190679897153252
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:wmEZyaJHB5X6txYVslslOBDxiPtQzEl+bxNf7PzOlEIbjk:pAyaJhqxmVQsPKE0bxNbzOlT
                                                                                                                                                                                                    MD5:852DF89978F979C1658720607CFA20FF
                                                                                                                                                                                                    SHA1:A6A2EFECF22BB4CD721556896A5FB9B1C3569FC7
                                                                                                                                                                                                    SHA-256:5446575727413241CAB1879EBC8CF97321DED05712C076816349AAFE75C6CE8D
                                                                                                                                                                                                    SHA-512:2C87F003E3AD288790D3EFE3421B4E4C9A3E71286F7748451ED3B2AE10BAECB483E4040E1235F459194AFD05B99E98E559C9CC0B3CD73085933C9B3D5EBFCB98
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9..1}..b}..b}..bt.Ybu..b.Rb|..b..Tb...b..`bq..b..abp..b..Vbx..b}..b...b..ebx..b..Qb|..b..Pb|..b..Wb|..bRich}..b................PE..d....g.Z.........." .....$...,.......#..............................................\.....@.........................................P].......U..........4....p..................,....C...............................................@..X............................text....".......$.................. ..`.rdata.......@... ...(..............@..@.data........`.......H..............@....pdata.......p.......J..............@..@.rsrc...4............N..............@..@.reloc...............R..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\is-PK7TM.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):26112
                                                                                                                                                                                                    Entropy (8bit):5.458252398909699
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:fuhbZsOIfEfc6nLbzdTBKxGPSBr32pgK25o7QbaKU37sOlh6MW:mhGD6LXoGPk32aK25o7O7EIOlHW
                                                                                                                                                                                                    MD5:34C22195F81C8037C6773098E88B193D
                                                                                                                                                                                                    SHA1:27E244108A7457DA0781D9C5E67D821C21DFBFCB
                                                                                                                                                                                                    SHA-256:B512C782D6DE531B5006B6E0B80EAC4FDFDF340BD78407277659703FC04A9CDA
                                                                                                                                                                                                    SHA-512:AAAFA7AFDE705124B1C3F65D7B9134EA043072D71ECE55F4BE1424E50EC766AD5F53F77808AAFCC657CE56FEE7AF5F5377D1EB6A186B0EA269B43F51487851CC
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........].f...f...f....x..f...(s..f....u..f....A..f....w..f...f...f....@..f....D..f....p..f....v..f..Rich.f..................PE..d....g.Z.........." .........4......P3..............................................t.....@..........................................d..i....T..P...............x...............d....................................................@..8............................text....,.......................... ..`.rdata...$...@...&...2..............@..@.data...x....p.......X..............@....pdata..x............\..............@..@.rsrc................`..............@..@.reloc...............d..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\is-Q1K3O.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):770384
                                                                                                                                                                                                    Entropy (8bit):6.908020029901359
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:12288:fQmCy3NeRjkpQmj3oaMtQqjoygfXq3kon9IlbgaOxQdVJJ6j5EBKX8hR5:ImCy3VQs9MtLjTgfa3kon9FaOdEz5
                                                                                                                                                                                                    MD5:67EC459E42D3081DD8FD34356F7CAFC1
                                                                                                                                                                                                    SHA1:1738050616169D5B17B5ADAC3FF0370B8C642734
                                                                                                                                                                                                    SHA-256:1221A09484964A6F38AF5E34EE292B9AFEFCCB3DC6E55435FD3AAF7C235D9067
                                                                                                                                                                                                    SHA-512:9ED1C106DF217E0B4E4FBD1F4275486CEBA1D8A225D6C7E47B854B0B5E6158135B81BE926F51DB0AD5C624F9BD1D09282332CF064680DC9F7D287073B9686D33
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ R.HA<.HA<.HA<.A9..KA<.HA=..A<.'7..@<.'7...A<.'7..|A<.'7...A<.'7..IA<.'7..IA<.'7..IA<.RichHA<.........PE..L.....K.........."!................. ....... .....x.................................S....@..........................I......D...(.......................P....... L..h...8...........................pE..@............................................text............................... ..`.data...|Z... ...N..................@....rsrc................X..............@..@.reloc.. L.......N...\..............@..B........................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\is-QSGEK.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):462120
                                                                                                                                                                                                    Entropy (8bit):6.664534921531032
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:12288:C3QUergtVv7jfIobCFvUkKShUgiW6QR7t5s03Ooc8dHkC2esIs:bUXzv3IoCFvUf03Ooc8dHkC2eJs
                                                                                                                                                                                                    MD5:BB18507C9891BFA94162D3220FC5FFD8
                                                                                                                                                                                                    SHA1:0680F3B4362EFCBF22D8B9D8AA1CB93798A732F0
                                                                                                                                                                                                    SHA-256:A36EB3003B3C7EE57984A26354C80263082305F149318FBF2896B8C3BB5A6D91
                                                                                                                                                                                                    SHA-512:66F19D0A6B62690952EC3063571C61B066D6F50C5955F693370D1349F2B49ED9C7943507C30041898AED0DDFC7A494EE12A43A22D80649A09D6CD35134E56103
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 2%
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........>.$._.w._.w._.w..2w._.w.'Nw._.w._.w._.w.9.v._.w.9.v._.w.9.v._.w.9.v._.w.9.v._.w.9.v._.w.9"w._.w.9.v._.wRich._.w........................PE..L...4x.Z.........."!.....T..........@........p...............................0......y.....@A...................................,.......................(?......`@...w..8............................-..@...................`...@....................text...2R.......T.................. ..`.data...T(...p.......X..............@....idata...............p..............@..@.didat..4...........................@....rsrc...............................@..@.reloc..`@.......B..................@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\is-R217A.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):40960
                                                                                                                                                                                                    Entropy (8bit):6.4074300922448835
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:768:iWLIYIbn1BJnyi3JRzw6utEKiQviGsPUlcsHyGsfoOfKdtX:i6INtJRzw6uyKiohsPUNRsAOfcX
                                                                                                                                                                                                    MD5:3768CE16E471A8FD9C333F65EAFFA284
                                                                                                                                                                                                    SHA1:26FDF02AEA2B37824D57C30BCA0FD5B5E7C73E19
                                                                                                                                                                                                    SHA-256:A69189F195D846D643CDD33733FFACC4CEB8BEC434D28DE6700AD26719378CB5
                                                                                                                                                                                                    SHA-512:172DB2533261885C490A411C8B9FBF426160F9769FAB708B4F6AAAE980D1252EB3ECA5348A5943605975FDA60E0F3185627AC8664CD6CE01062829876D46F082
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......w^KR3?%.3?%.3?%..q..2?%.\I..2?%.\I..??%.\I..7?%.\I..5?%.:G..6?%.3?$..?%.\I..0?%.\I..2?%.\I..2?%.Rich3?%.........................PE..L.....{_...........!.....^...>.......c.......p.......................................d....@.........................p...........d................................... r..................................@............p...............................text....].......^.................. ..`.rdata...-...p.......b..............@..@.data...............................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\is-RQ9QA.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):55296
                                                                                                                                                                                                    Entropy (8bit):5.865736435639137
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:1536:AZTOUyTGQltVHgQiBtEjZlYqeTEc/4JOl8G:gOckSEjZlAT/QJOl8
                                                                                                                                                                                                    MD5:B3C3273757E907EA5F53F4A4819F28F1
                                                                                                                                                                                                    SHA1:73C367E1A65A16F2986284A84F458BF48A5C2BE4
                                                                                                                                                                                                    SHA-256:6CA216586D312F066015BE2957ADF902188225B29B4A8C8D8D68F23F3DDBFAEB
                                                                                                                                                                                                    SHA-512:28BC2954EF5687F2C32C6731E9180B23C572CB822758589BC23B42375843D771C88C529753C9F6151FFB8A159B1B3E224A65A8D5DFFE6D9CF8887B327BB3EB4C
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......oj..+...+...+...E..*...D}..*...D}2.!...D}../...D}3.-..."s......+......D}7.(...D}..*...D}..*...Rich+...........PE..d...6:SZ.........." .........N............................................... ............@.....................................................d...............................h...0................................................................................text.............................. ..`.rdata...=.......>..................@..@.data...H...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\is-T8PP8.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):421200
                                                                                                                                                                                                    Entropy (8bit):6.59808962341698
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:12288:iHEqYsrMWIqz473PTiPoH/aGhUgiW6QR7t5qv3Ooc8UHkC2eKq87:iH9YsIWIW4rPTiPofaDv3Ooc8UHkC2e8
                                                                                                                                                                                                    MD5:03E9314004F504A14A61C3D364B62F66
                                                                                                                                                                                                    SHA1:0AA3CAAC24FDF9D9D4C618E2BBF0A063036CD55D
                                                                                                                                                                                                    SHA-256:A3BA6421991241BEA9C8334B62C3088F8F131AB906C3CC52113945D05016A35F
                                                                                                                                                                                                    SHA-512:2FCFF4439D2759D93C57D49B24F28AE89B7698E284E76AC65FE2B50BDEFC23A8CC3C83891D671DE4E4C0F036CEF810856DE79AC2B028AA89A895BF35ABFF8C8D
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........._d..17..17..17...7..17..7..17..07 .17(..7..17..7..17..7..17..7..17..7..17..7..17..7..17..7..17Rich..17........................PE..L.....K.........."!.................<.............x......................................@.................................`...<.... ...............V..P....0..H;..p................................/..@...............p............................text............................... ..`.data...$:.......,..................@....rsrc........ ......................@..@.reloc...S...0...T..................@..B........................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\is-UPF22.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):28496
                                                                                                                                                                                                    Entropy (8bit):6.5898728199626015
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:0hXAzuA2XgBZUq7tWmzKmtVmiQQ5HkFkSWFbF0sioPn6OZKPV5/2Gs7V7DCl8ZpO:JrgyXBF6sj6OZKdB2GKV7OliRBEH
                                                                                                                                                                                                    MD5:BA56075540813A909A7E303E31CDB290
                                                                                                                                                                                                    SHA1:F720CD8EF99E29F99C7818DC28B11691D1A4AC88
                                                                                                                                                                                                    SHA-256:12C12CDD21A3C7A6BDF18AAD522700E0BDDDACB2EF94E75409EC874E286EB8B2
                                                                                                                                                                                                    SHA-512:D6BCB8E0FF799C89D9973F30EAFD0F16CB2A3CDA0B093C82AF83CD2B1CEF1EA010F247FE4C17353A10D4F712E4247A7FA8C44D5A1E7FE532F2FEB50EB51CA728
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........kY...................E.......................................................................Rich............................PE..L.....{_...........!.....*...*......./.......@............................................@..........................Y.......J..P....................R..P....p.......................................B..@............@...............................text..._(.......*.................. ..`.rdata.......@......................@..@.data........`.......H..............@....reloc..H....p.......J..............@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\COPYRIGHT (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:ISO-8859 text
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):3244
                                                                                                                                                                                                    Entropy (8bit):4.504892344419146
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:96:ikjJXQSqgbiihCrRbo+Q/cV0rDcFBL3P0/r3:icAaOi01E+xV0rDaBL3P0z3
                                                                                                                                                                                                    MD5:3DC1BFBD5BED75D650AD0506A0DF5930
                                                                                                                                                                                                    SHA1:8E79323389B9BC4B6AAD357B8BFAAB6A518FB82E
                                                                                                                                                                                                    SHA-256:621F7616B5E8538ABBC26667F28C25650A5B239A4F1ECA981F5DD60B8DA9B589
                                                                                                                                                                                                    SHA-512:74F077BC149AA459E480B5EE6117876CF67CD17D290E90F0A6045F687C42DD4E9F12133CE2459EAF905BD053E5EBA587C042040C84DA9CD2A26E415FC388B148
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:Copyright . 1993, 2017, Oracle and/or its affiliates..All rights reserved...This software and related documentation are provided under a.license agreement containing restrictions on use and.disclosure and are protected by intellectual property laws..Except as expressly permitted in your license agreement or.allowed by law, you may not use, copy, reproduce, translate,.broadcast, modify, license, transmit, distribute, exhibit,.perform, publish, or display any part, in any form, or by.any means. Reverse usering, disassembly, or.decompilation of this software, unless required by law for.interoperability, is prohibited...The information contained herein is subject to change.without notice and is not warranted to be error-free. If you.find any errors, please report them to us in writing...If this is software or related documentation that is.delivered to the U.S. Government or anyone licensing it on.behalf of the U.S. Government, the following notice is.applicable:..U.S. GOVERNMENT END US

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\LICENSE (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):40
                                                                                                                                                                                                    Entropy (8bit):4.208694969562842
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:c3AXFshzhRSjn:c9hzhgj
                                                                                                                                                                                                    MD5:98F46AB6481D87C4D77E0E91A6DBC15F
                                                                                                                                                                                                    SHA1:3E86865DEEC0814C958BCF7FB87F790BCCC0E8BD
                                                                                                                                                                                                    SHA-256:23F9A5C12FA839650595A32872B7360B9E030C7213580FB27DD9185538A5828C
                                                                                                                                                                                                    SHA-512:AC2C14C56EEA2024FCF7E871D25BCC323A40A2D1D95059C67EC231BCD710ACB8B798A8C107AAD60AAA3F14A64AA0355769AB86A481141D9A185E22CE049A91B7
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:Please refer to http://java.com/license.

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\README.txt (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):46
                                                                                                                                                                                                    Entropy (8bit):4.197049999347145
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:c3AXFshzhRSkU:c9hzhgkU
                                                                                                                                                                                                    MD5:0F1123976B959AC5E8B89EB8C245C4BD
                                                                                                                                                                                                    SHA1:F90331DF1E5BADEADC501D8DD70714C62A920204
                                                                                                                                                                                                    SHA-256:963095CF8DB76FB8071FD19A3110718A42F2AB42B27A3ADFD9EC58981C3E88D2
                                                                                                                                                                                                    SHA-512:E9136FDF42A4958138732318DF0B4BA363655D97F8449703A3B3A40DDB40EEFF56363267D07939889086A500CB9C9AAF887B73EEAD06231269116110A0C0A693
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:Please refer to http://java.com/licensereadme.

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\THIRDPARTYLICENSEREADME-JAVAFX.txt (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Unicode text, UTF-8 (with BOM) text
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):110114
                                                                                                                                                                                                    Entropy (8bit):4.820689169327024
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:1536:Sli851WMeF1vb9nJIa1r+jQ2LpMtzs6CSTmLNUkuiYLOeBWwpZKf:L8P5o9d1r+jxQzP/yZbxQOeowpo
                                                                                                                                                                                                    MD5:AB9DB8D553033C0326BD2D38D77F84C1
                                                                                                                                                                                                    SHA1:D13CAC18FEC0C71D4A5CB550F6FA93FC60C39E45
                                                                                                                                                                                                    SHA-256:38995534DF44E0526F8C8C8D479C778A4B34627CFD69F19213CFBE019A7261BA
                                                                                                                                                                                                    SHA-512:178EABC5D8883E3E0A32F40ACDC8DB5A80CBABFA6689D3902880FE521B1A84425758F22CC7DD236416033B20A3FADCE6ACC03DB579F582BAE2C0AFFC0B2ECA5E
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:.DO NOT TRANSLATE OR LOCALIZE..***************************************************************************..%%The following software may be included in this product:.Microsoft DirectShow - Base Classes..Use of any of this software is governed by the terms of the license below:..MSDN - Information on Terms of Use..Updated: February 13, 2008..ON THIS PAGE.. * ACCEPTANCE OF TERMS. * PRIVACY AND PROTECTION OF PERSONAL INFORMATION. * NOTICE SPECIFIC TO APIs AVAILABLE ON THIS WEB SITE. * NOTICE SPECIFIC TO SOFTWARE AVAILABLE ON THIS WEB SITE. * NOTICE SPECIFIC TO DOCUMENTATION AVAILABLE ON THIS WEB SITE. * NOTICES REGARDING SOFTWARE, DOCUMENTATION, APIS AND SERVICES AVAILABLE ON.THIS WEB SITE. * RESERVATION OF RIGHTS. * MEMBER ACCOUNT, PASSWORD, AND SECURITY. * NO UNLAWFUL OR PROHIBITED USE. * USE OF SERVICES. * MATERIALS PROVIDED TO MICROSOFT OR POSTED AT ANY MICROSOFT WEB SITE. * NOTICES AND PROCEDURE FOR MAKING CLAIMS OF COPYRIGHT INFRINGEMENT. * L

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\THIRDPARTYLICENSEREADME.txt (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Unicode text, UTF-8 text
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):177094
                                                                                                                                                                                                    Entropy (8bit):5.023336784860332
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:Yj33DuJYSqN7amC35q6dNFiG8OH8eowpQcw+4oHHZZvc9HNhJhxe+p/U0UIdKJpi:3qN2p5Jmncw+4o0HMWEyHrNRj
                                                                                                                                                                                                    MD5:745D6DB5FC58C63F74CE6A7D4DB7E695
                                                                                                                                                                                                    SHA1:A816FB5DD09E32D80E1ECF47A458569E3868B975
                                                                                                                                                                                                    SHA-256:C77BA9F668FEE7E9B810F1493E518ADF87233AC8793E4B37C9B3D1ED7846F1C0
                                                                                                                                                                                                    SHA-512:1E452DFD39566F1FF1D7EE9804076F1E0B8050A6D783D2A299788A099428B42544F9CB488D02061A62A3B8A5344252EA8A4FF0B5D4FDEC1D99DDE133DA146A22
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:DO NOT TRANSLATE OR LOCALIZE..-----------------------------..%% This notice is provided with respect to ASM Bytecode Manipulation .Framework v5.0.3, which may be included with JRE 8, and JDK 8, and .OpenJDK 8...--- begin of LICENSE ---..Copyright (c) 2000-2011 France T.l.com.All rights reserved...Redistribution and use in source and binary forms, with or without.modification, are permitted provided that the following conditions.are met:..1. Redistributions of source code must retain the above copyright. notice, this list of conditions and the following disclaimer...2. Redistributions in binary form must reproduce the above copyright. notice, this list of conditions and the following disclaimer in the. documentation and/or other materials provided with the distribution...3. Neither the name of the copyright holders nor the names of its. contributors may be used to endorse or promote products derived from. this software without specific prior written permission...THIS SOFTWAR

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\Welcome.html (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:HTML document, ASCII text
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):955
                                                                                                                                                                                                    Entropy (8bit):5.094001412859534
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:24:INMTdqcxtK4jXQ5VaJ2gjQo4pDW94mKDJn:TTdqIK4jXjJdso4V7B
                                                                                                                                                                                                    MD5:7A329F25E9CC132C673CD134E8134B0D
                                                                                                                                                                                                    SHA1:634D69FDD1E9B824A1E92DA00FDB6201A6D302AC
                                                                                                                                                                                                    SHA-256:6F3F130AA22B3CBEAD959E5CF0F7F626B96539EECA56BED60768E91A77823363
                                                                                                                                                                                                    SHA-512:99C9026924558381CAB0D1CD1F351D977F82953C1AB1BC99DAFE543D81DB702A1F30527DD7E33BD99219CDC21DC05688898C39E8070658AC185F82DAA3F526A4
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:<html>.<head>.<title>.Welcome to the Java(TM) Platform.</title>.</head>.<body>..<h2>Welcome to the Java<SUP><FONT SIZE=-2>TM</FONT></SUP> Platform</h2>.<p> Welcome to the Java<SUP><FONT SIZE=-2>TM</FONT></SUP> Standard Edition Runtime . Environment. This provides complete runtime support for Java applications. .<p> The runtime environment includes the Java<SUP><FONT SIZE=-2>TM</FONT></SUP> . Plug-in product which supports the Java environment inside web browsers. .<h3>References</h3>.<p>.See the <a href="http://download.oracle.com/javase/7/docs/technotes/guides/plugin/">Java Plug-in</a> product.documentation for more information on using the Java Plug-in product..<p> See the <a href=."http://www.oracle.com/technetwork/java/javase/overview/".>Java Platform</a> web site for . more information on the Java Platform. .<hr>.<font size="-2">.Copyright (c) 2006, 2017, Oracle and/or its affiliates. All rights reserved..</font>.<p>.</body>.</html>.

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\JAWTAccessBridge-32.dll (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):14912
                                                                                                                                                                                                    Entropy (8bit):6.137751064213755
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:192:NpQMhRas3XLPVT6wsMPWpRuPUTnYe+PjPriT0fwPa00OQo:NmuR57PVEaWpRuPGnYPLr7NJOb
                                                                                                                                                                                                    MD5:D6587D7BAFEC3E592AD09CCE09A0CA01
                                                                                                                                                                                                    SHA1:3C3E2B390EEA94DF44FB75141ADF2F1848876992
                                                                                                                                                                                                    SHA-256:AFC7E82DBF1AFFBDE6EA417EC74E17FD5E1EBECBB69CC9C9753EADDEA0FDF718
                                                                                                                                                                                                    SHA-512:86A6481591D38E3DA7A86F93035C2B92D9F64F0EB2132DAEF626F1926806EC02976EC3355BD83FF2A1552A506D3F23DBFFE056989AA6517E1EE1CE09F4F2F0BF
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........5.Z.[.Z.[.Z.[.A<..[.[.A<..Q.[.A<.._.[.S...X.[.Z.Z.D.[.A<..Y.[.A<..[.[.A<..[.[.A<..[.[.RichZ.[.................PE..L...KdOX...........!......................... .....m.........................`.......g....@.........................`%......,"..P....@..x............"..@....P.. .... ............................... ..@............ ...............................text............................... ..`.rdata..d.... ......................@..@.data...`....0......................@....rsrc...x....@......................@..@.reloc..^....P....... ..............@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\JavaAccessBridge-32.dll (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):128064
                                                                                                                                                                                                    Entropy (8bit):6.430017675110439
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:JN77TJSG78+5Orcj/K/e2Hrgc6kZAn1yEkBKMKy1Zf22QYHJiuzTl8ShzzM+64m3:JNXd178+5fnZnQTc
                                                                                                                                                                                                    MD5:A46E69A6D38313581CE393D41620FEF0
                                                                                                                                                                                                    SHA1:D526CC02838B1C989EBDAC9CA3C8816EFB5BA3B4
                                                                                                                                                                                                    SHA-256:EC674DB05829E0C8A62B0406F7ECE860DD0F0A3CC5B6EF523C2A4C1C1A6944E3
                                                                                                                                                                                                    SHA-512:D65E6EDCC6AB89E51B2C7954A3F002AC206BA2E0D09BB56C1526A65EA136FA04B1819180ED20406EACD9E737DD64267704D84CC31556DB405EDF9DD328E4155D
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........[d.@:.N@:.N@:.N[..NB:.N[..NB:.N[..NK:.NIB.NE:.N@:.N{:.N[..NG:.N[..NA:.N[..NA:.N[..NA:.NRich@:.N........PE..L...DdOX...........!................#..............m.................................$....@.........................p...........P.......x...............@...........................................p...@............................................text............................... ..`.rdata..............................@..@.data...............................@....rsrc...x...........................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\WindowsAccessBridge-32.dll (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):97856
                                                                                                                                                                                                    Entropy (8bit):6.474274181080949
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:1536:M90yNLbRcbcqgkvZx4iDLvB+k0toX5Oo4ZkS8PAk8Gq8i9RBcszF:GRXkvZxpLv0oOoMfk8GW3BLzF
                                                                                                                                                                                                    MD5:C348CD5D964585C7B639BC1DFD150471
                                                                                                                                                                                                    SHA1:A9FBCCDFF79482EEBFE895BEA1AD32BFE66EE563
                                                                                                                                                                                                    SHA-256:FCB29D0E47F48176D38BB1E1074F1BD8C48FF6349855E227DBEA5005B24F72F9
                                                                                                                                                                                                    SHA-512:BE3507A511E88F42B3C2154AAE862EACC57E50A94FE47463FE6EBC36F834399C06465A38858CD302EB3DFF1F84B8944D4482F854D16551CA417B3F35D8C4ABB5
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......./zR/k.<|k.<|k.<|p..|{.<|p..|2.<|bc.|n.<|k.=|7.<|p..|O.<|p..|j.<|p..|j.<|p..|j.<|Richk.<|........................PE..L...BdOX...........!................At.............o.................................@....@..........................9..A....1..<....................f..@............................................,..@...............@............................text...\........................... ..`.rdata..Qg.......h..................@..@.data...`,...P.......8..............@....rsrc................F..............@..@.reloc..J............N..............@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\awt.dll (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):1182784
                                                                                                                                                                                                    Entropy (8bit):6.628561301073661
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:24576:/yPuNL2MF+C15OJTMEG1yJqkz9BRdFT/22:KkeBBzFD3
                                                                                                                                                                                                    MD5:44C45926A284518F1FA481E6A39E4F26
                                                                                                                                                                                                    SHA1:6C9E983DC537ADB237AAE7B0D3F4E9276DB4AAD2
                                                                                                                                                                                                    SHA-256:19A0C64DADE060E59FC0B076D6F799B411BEEBDE3CC40B9BDB627C6B2F3E212F
                                                                                                                                                                                                    SHA-512:99256D23E812FA59F25DEDD8A9DAC03DEE9FEAE8917E831E7EBF9601623925D8C0D3B6867B610F8D306B3618A031202750D2C40A75D8241187B2A4182DB70EFF
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Q.Q...?...?...?......?.......?.......?.z...?.......?.......?...>.;.?.....s.?.....w.?.......?.......?.......?.Rich..?.........................PE..L...AdOX...........!.................G.............m.........................`.......Y....@.................................,............N..............@....`.........................................@............... ....f..`....................text............................... ..`.rdata.............................@..@.data...8....P...~...4..............@....rsrc....N.......P..................@..@.reloc.......`......................@..B........................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\bci.dll (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):15424
                                                                                                                                                                                                    Entropy (8bit):6.384266768373925
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:mTd3hw/L3kKLnYgIHGOOGsnPV5Pnf4/nYPLr7yo:mzw/bkKLtGUndpnfSC7yo
                                                                                                                                                                                                    MD5:97CBA04A08797BE071F76C5EF909AAAD
                                                                                                                                                                                                    SHA1:94104AD4852791218FF1397F7FA2B65D0722A2ED
                                                                                                                                                                                                    SHA-256:69502F0CD142518E183E93DB88E0B7858BA0637FBC29CFEDCD85628FF62EF612
                                                                                                                                                                                                    SHA-512:8C9840612FDA99846C843A244AAC90EF42DD1E5B38DAE18EBCAA7734B94BCBCEC9D9AC426FD7D24FBADDB959EE2A44581A2FFF2E7DE01AEA9EC004AEE7258430
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........6...W..W..W../x.W...w.W..W..W....s.W...u.W...@.W...A.W...p.W...q.W...v.W..Rich.W..........................PE..L...AdOX...........!......................... .....m.........................`............@..........................'......|$..<....@...............$..@....P....... ..............................8#..@............ ...............................text............................... ..`.rdata..v.... ......................@..@.data...p....0......................@....rsrc........@......................@..@.reloc.......P......."..............@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\client\Xusage.txt (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):1423
                                                                                                                                                                                                    Entropy (8bit):4.176285626070561
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:24:N3ZYKm8fuW6psByGJjR0X46kA2SsGFhD+GbpGCOhLRr3n:mOLUskGJjyltsGFV+GbpGCOTr
                                                                                                                                                                                                    MD5:B3174769A9E9E654812315468AE9C5FA
                                                                                                                                                                                                    SHA1:238B369DFC7EB8F0DC6A85CDD080ED4B78388CA8
                                                                                                                                                                                                    SHA-256:37CF4E6CDC4357CEBB0EC8108D5CB0AD42611F675B926C819AE03B74CE990A08
                                                                                                                                                                                                    SHA-512:0815CA93C8CF762468DE668AD7F0EB0BDD3802DCAA42D55F2FB57A4AE23D9B9E2FE148898A28FE22C846A4FCDF1EE5190E74BCDABF206F73DA2DE644EA62A5D3
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview: -Xmixed mixed mode execution (default). -Xint interpreted mode execution only. -Xbootclasspath:<directories and zip/jar files separated by ;>. set search path for bootstrap classes and resources. -Xbootclasspath/a:<directories and zip/jar files separated by ;>. append to end of bootstrap class path. -Xbootclasspath/p:<directories and zip/jar files separated by ;>. prepend in front of bootstrap class path. -Xnoclassgc disable class garbage collection. -Xincgc enable incremental garbage collection. -Xloggc:<file> log GC status to a file with time stamps. -Xbatch disable background compilation. -Xms<size> set initial Java heap size. -Xmx<size> set maximum Java heap size. -Xss<size> set java thread stack size. -Xprof output cpu profiling data. -Xfuture enable strictest checks, anticipating futur

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\client\classes.jsa (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):12713984
                                                                                                                                                                                                    Entropy (8bit):5.149396758114257
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:98304:fmtwxmQRXPKcCmtVzNi2tfjX7iwxyJBBb+m3d3dS:+tAZRd73RhjX2wiB/rS
                                                                                                                                                                                                    MD5:C4508A7FC4FB9DC34FC8C464C0FE13A7
                                                                                                                                                                                                    SHA1:AA1706CFEB06E258EECA7A65B4057EAF52C361D3
                                                                                                                                                                                                    SHA-256:66BD933D5B578A7B46C86FA8AD65F0713A6F8866A21B08B3B8A8E9FA505D6250
                                                                                                                                                                                                    SHA-512:580427EE802925E43E63B91D6D4F2B877BE5A3D1509C2170A1C265E95C7781BA39BA85F0004307746B594338A858B98E2B66E511EB0B7FB58ED1796CAC0D0555
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:....O8;.............<.m_..............[.....|qJ...]..........?V......N........`... .p...../s......................esJava HotSpot(TM) Client VM (25.121-b13) for windows-x86 JRE (1.8.0_121-b13), built on Dec 12 2016 18:17:00 by "java_re" with MS VC++ 10.0 (VS2010).....I =..........5..............^6.com/sun/java/swing/plaf/motif/MotifEditorPaneUI.classPK.............I-\...{.......@... ..........6C:\Program Files (x86)\Java\jre1.8.0_121\lib\resources.jar;C:\Program Files (x86)\Java\jre1.8.0_121\lib\rt.jar;C:\Program Files (x86)\Java\jre1.8.0_121\lib\sunrsasign.jar;C:\Program Files (x86)\Java\jre1.8.0_121\lib\jsse.jar;C:\Program Files (x86)\Java\jre1.8.0_121\lib\jce.jar;C:\Program Files (x86)\Java\jre1.8.0_121\lib\charsets.jar;C:\Program Files (x86)\Java\jre1.8.0_121\lib\jfr.jar;C:\Program Files (x86)\Java\jre1.8.0_121\classes.....C:\Program Files (x86)\Java\jre1.8.0_121\lib\sunrsasign.jar.....C:\Program Files (x86)\Java\jre1.8.0_121\classes.....C:\Program Files (x86)\Java\jre1.8.0_121\lib\

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\client\is-CPU5F.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):3864128
                                                                                                                                                                                                    Entropy (8bit):6.861558028676015
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:98304:FqMo0KtcJTjtjd3nuuv3jd4eGcv/Gda5uC:sMj3TZd3uuv3m/cv/GQ5uC
                                                                                                                                                                                                    MD5:12DD21DC5E8C8895DB87196E07E93073
                                                                                                                                                                                                    SHA1:B3A8FF9131FC235BD19D680D896946110492E300
                                                                                                                                                                                                    SHA-256:747A16C92E5A8D30B4A925758DC38418D6C984393EDCAC40F01534B302D101CB
                                                                                                                                                                                                    SHA-512:93029B26C53B50926453BBC8103F661BC5E827DD776F622858DF62A3FE023267FD5AC96550E84011C2C6E69A37A47AFAFF9D6A349CB4AC8F4FB20B1E332AE113
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......$..$`|.w`|.w`|.w{.Twb|.w.2Pwf|.w{.Vwl|.w{.bwl|.wi.[wo|.w`|.w~}.w{.cw-~.w{.Swa|.w{.Rwa|.w{.Uwa|.wRich`|.w................PE..L...AdOX...........!......,.........F.+......0,....m..........................<.......;...@.........................p>4......)4......09.(.............:.@....@9..H...6,...............................2.@............0,.T............................text.....,.......,................. ..`.rdata..9....0,.......,.............@..@.data...T....05..*....5.............@....rsrc...(....09......:7.............@..@.reloc..f....@9......@7.............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\client\is-KOJHO.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):1423
                                                                                                                                                                                                    Entropy (8bit):4.176285626070561
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:24:N3ZYKm8fuW6psByGJjR0X46kA2SsGFhD+GbpGCOhLRr3n:mOLUskGJjyltsGFV+GbpGCOTr
                                                                                                                                                                                                    MD5:B3174769A9E9E654812315468AE9C5FA
                                                                                                                                                                                                    SHA1:238B369DFC7EB8F0DC6A85CDD080ED4B78388CA8
                                                                                                                                                                                                    SHA-256:37CF4E6CDC4357CEBB0EC8108D5CB0AD42611F675B926C819AE03B74CE990A08
                                                                                                                                                                                                    SHA-512:0815CA93C8CF762468DE668AD7F0EB0BDD3802DCAA42D55F2FB57A4AE23D9B9E2FE148898A28FE22C846A4FCDF1EE5190E74BCDABF206F73DA2DE644EA62A5D3
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview: -Xmixed mixed mode execution (default). -Xint interpreted mode execution only. -Xbootclasspath:<directories and zip/jar files separated by ;>. set search path for bootstrap classes and resources. -Xbootclasspath/a:<directories and zip/jar files separated by ;>. append to end of bootstrap class path. -Xbootclasspath/p:<directories and zip/jar files separated by ;>. prepend in front of bootstrap class path. -Xnoclassgc disable class garbage collection. -Xincgc enable incremental garbage collection. -Xloggc:<file> log GC status to a file with time stamps. -Xbatch disable background compilation. -Xms<size> set initial Java heap size. -Xmx<size> set maximum Java heap size. -Xss<size> set java thread stack size. -Xprof output cpu profiling data. -Xfuture enable strictest checks, anticipating futur

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\client\is-NHOIF.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):12713984
                                                                                                                                                                                                    Entropy (8bit):5.149396758114257
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:98304:fmtwxmQRXPKcCmtVzNi2tfjX7iwxyJBBb+m3d3dS:+tAZRd73RhjX2wiB/rS
                                                                                                                                                                                                    MD5:C4508A7FC4FB9DC34FC8C464C0FE13A7
                                                                                                                                                                                                    SHA1:AA1706CFEB06E258EECA7A65B4057EAF52C361D3
                                                                                                                                                                                                    SHA-256:66BD933D5B578A7B46C86FA8AD65F0713A6F8866A21B08B3B8A8E9FA505D6250
                                                                                                                                                                                                    SHA-512:580427EE802925E43E63B91D6D4F2B877BE5A3D1509C2170A1C265E95C7781BA39BA85F0004307746B594338A858B98E2B66E511EB0B7FB58ED1796CAC0D0555
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:....O8;.............<.m_..............[.....|qJ...]..........?V......N........`... .p...../s......................esJava HotSpot(TM) Client VM (25.121-b13) for windows-x86 JRE (1.8.0_121-b13), built on Dec 12 2016 18:17:00 by "java_re" with MS VC++ 10.0 (VS2010).....I =..........5..............^6.com/sun/java/swing/plaf/motif/MotifEditorPaneUI.classPK.............I-\...{.......@... ..........6C:\Program Files (x86)\Java\jre1.8.0_121\lib\resources.jar;C:\Program Files (x86)\Java\jre1.8.0_121\lib\rt.jar;C:\Program Files (x86)\Java\jre1.8.0_121\lib\sunrsasign.jar;C:\Program Files (x86)\Java\jre1.8.0_121\lib\jsse.jar;C:\Program Files (x86)\Java\jre1.8.0_121\lib\jce.jar;C:\Program Files (x86)\Java\jre1.8.0_121\lib\charsets.jar;C:\Program Files (x86)\Java\jre1.8.0_121\lib\jfr.jar;C:\Program Files (x86)\Java\jre1.8.0_121\classes.....C:\Program Files (x86)\Java\jre1.8.0_121\lib\sunrsasign.jar.....C:\Program Files (x86)\Java\jre1.8.0_121\classes.....C:\Program Files (x86)\Java\jre1.8.0_121\lib\

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\client\jvm.dll (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):3864128
                                                                                                                                                                                                    Entropy (8bit):6.861558028676015
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:98304:FqMo0KtcJTjtjd3nuuv3jd4eGcv/Gda5uC:sMj3TZd3uuv3m/cv/GQ5uC
                                                                                                                                                                                                    MD5:12DD21DC5E8C8895DB87196E07E93073
                                                                                                                                                                                                    SHA1:B3A8FF9131FC235BD19D680D896946110492E300
                                                                                                                                                                                                    SHA-256:747A16C92E5A8D30B4A925758DC38418D6C984393EDCAC40F01534B302D101CB
                                                                                                                                                                                                    SHA-512:93029B26C53B50926453BBC8103F661BC5E827DD776F622858DF62A3FE023267FD5AC96550E84011C2C6E69A37A47AFAFF9D6A349CB4AC8F4FB20B1E332AE113
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......$..$`|.w`|.w`|.w{.Twb|.w.2Pwf|.w{.Vwl|.w{.bwl|.wi.[wo|.w`|.w~}.w{.cw-~.w{.Swa|.w{.Rwa|.w{.Uwa|.wRich`|.w................PE..L...AdOX...........!......,.........F.+......0,....m..........................<.......;...@.........................p>4......)4......09.(.............:.@....@9..H...6,...............................2.@............0,.T............................text.....,.......,................. ..`.rdata..9....0,.......,.............@..@.data...T....05..*....5.............@....rsrc...(....09......:7.............@..@.reloc..f....@9......@7.............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\dcpr.dll (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):142912
                                                                                                                                                                                                    Entropy (8bit):7.350669814296794
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:8oGzTjLkRPQ9U9NuLqkIscj5ojGylYCE2Iu2jGLF5A9bE8LUeYRr0y:VGz/oRPGLNIrIGgYCE2L1F5A9bEGUe4
                                                                                                                                                                                                    MD5:243102768D347645E101BD390D5E3779
                                                                                                                                                                                                    SHA1:6BFA544A2BC31D0B862C72CCAB9405C63BD7DF6D
                                                                                                                                                                                                    SHA-256:1C01E8C95A297CEBEA13B59C484E30C8004E5A4D9F9C670AB93E5F90DB474A40
                                                                                                                                                                                                    SHA-512:1B59B806891602D604D3C4F1F8C106FA30A8F3DC15477116E1C20F3D379D743FF5A5505C498C4F71A525C8A7B163C3EFA7CB793117C963BDDABD3B70057EE09B
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........k..K.c.K.c.K.c.Br..I.c.P...H.c.P...I.c.P...N.c.K.b.m.c.P...m.c.P...J.c.P...J.c.P...J.c.RichK.c.........................PE..L...AdOX...........!.........Z......V.............Sm.........................@............@.................................,...P.... ..................@....0..........................................@............................................text...n........................... ..`.rdata........... ..................@..@.data....+.......(..................@....rsrc........ ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\decora_sse.dll (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):64064
                                                                                                                                                                                                    Entropy (8bit):6.337716397206902
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:1536:ckh2CQuUlng7qkKi5iO8pm8cN9qfoF3oIy:ckkhu0nTli5jN8cNAfoRNy
                                                                                                                                                                                                    MD5:115EED3EE64059449C9C0A49990C6193
                                                                                                                                                                                                    SHA1:E8A672C318D58C8B445F0C224B4110168EC92214
                                                                                                                                                                                                    SHA-256:3D2C280F1E87921DE93372D64F662DCD22C2B7EEB28ABC87461002A4123A135D
                                                                                                                                                                                                    SHA-512:7062271422E6D9281FC867D1AACA13321C60A4DCC79328A7183F6551B80E250047215B03BEDE50DAAB553B9BDFA0B171EF1317C28580445E79BE288756C8D290
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......?...{.|.{.|.{.|..N..y.|.{.}.g.|.v.x.|.v.y.|.v.w.|.v.y.|....Z.|....z.|.v.z.|....z.|.Rich{.|.........................PE..L...AdOX...........!......... ......_.............Vm......................... ......P.....@.....................................<.......................@...........................................(...@...............t............................text............................... ..`.rdata..............................@..@.data...\...........................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\deploy.dll (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):453184
                                                                                                                                                                                                    Entropy (8bit):6.51900631640757
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:6144:+6rAUVejS41QaMu+2pZw57K0DlFXaz5MLXc/RaemBwTFOBfjPuvxIW1MSjA:+6EUVsSKfMu+2pZwJLEJaemBPuvq+MS8
                                                                                                                                                                                                    MD5:B723948223F1912F0FFC12D8BAFDBBF9
                                                                                                                                                                                                    SHA1:A8098C3F968903C50DA5F5DDCBB37D156E6C9B47
                                                                                                                                                                                                    SHA-256:5FEC252360C6F156820DE8332F84F990EA3A17045299B07A23F8007227CA2546
                                                                                                                                                                                                    SHA-512:769858D18D31791B1E3DCE648FB4458D45C44FA526D2B178DD3E91359B39BA0D89AE56A6D9EDE133B036C373A88DACB1181B20135C97EE8DE67A8419C620123B
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........T...:...:...:.......:.e....:......:......:.....:....:....:...;.`.:......:.......:.......:.......:.Rich..:.................PE..L...BdOX...........!.........:......>.............Xm.................................@....@.........................@....6..............................@........8..................................Xh..@...............X...8........................text.............................. ..`.rdata...;.......<..................@..@.data...............................@....rsrc...............................@..@.reloc..\E.......F..................@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\dt_shmem.dll (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):25152
                                                                                                                                                                                                    Entropy (8bit):6.627911972030489
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:+mgNWEfK0RiS46xqJ856ZEPG5uvbronYPLr7hO:t6WmK0RiSxqC56W+M8C7U
                                                                                                                                                                                                    MD5:374B1CFBE98DD48D6023969ED086F88F
                                                                                                                                                                                                    SHA1:0286D38ACBC47903D66A6844660AAAD796D463F9
                                                                                                                                                                                                    SHA-256:75F5D76F211AB811C489DED61B974F0505533C295DAE8D34BA94D1B233014471
                                                                                                                                                                                                    SHA-512:2C02582378F0165DBAC2D1CE919B037014839EE3F91B19E8351B679121947F242C3FF1ECEA160C962911FA3366257FD17293171DC62E072F70FA21302C43D99A
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........%..cK.cK.cK....cK....cK.cJ.cK....cK....cK....cK....cK....cK....cK.Rich.cK.........PE..L...AdOX...........!.....*...........4.......@....|m.................................g....@......................... M.......H..<....p...............J..@............A...............................F..@............@...............................text....).......*.................. ..`.rdata.......@......................@..@.data........`.......@..............@....rsrc........p.......B..............@..@.reloc..z............F..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\dt_socket.dll (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):21568
                                                                                                                                                                                                    Entropy (8bit):6.599281592336615
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:CwiAYZIxsQbbRLEs5Lt6lrpPVXVqJnYPLr7FBP:ziPZj+bVEmt6lrpdXVyC7n
                                                                                                                                                                                                    MD5:8771DAAB1E3461F919F3D3E7F5A18E39
                                                                                                                                                                                                    SHA1:CF6A66C7D53EB74283CD1E1920BB729D6E8DF1B4
                                                                                                                                                                                                    SHA-256:726D6C73F7FF84746E5C680B2532154C4417500ED671671FACC3F6F692EAD01F
                                                                                                                                                                                                    SHA-512:EE4BEBB3080ADD3CF087DBC97B18532D2DBC48350394F20E1D23F3E2D23E4B7F184E23DC5AC6780B06A42C97B72FFA28DB298F84E4056C508BC6464C6F28498A
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 2%
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......x..<...<...<...'<8.>...'<:.>...'<..>...<...v...5.7.9...'<..1...'<?.=...'<>.=...'<9.=...Rich<...........................PE..L...AdOX...........!.................&.......0....}m.................................F....@..........................A..U....<..P....`...............<..@....p......@1..............................x;..@............0..(............................text............................... ..`.rdata.......0....... ..............@..@.data........P.......2..............@....rsrc........`.......4..............@..@.reloc.......p.......8..............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\dtplugin\deployJava1.dll (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):826432
                                                                                                                                                                                                    Entropy (8bit):6.022189321177478
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:12288:nzl/j3WDOOtht2kOZBr5ROO3s2vk3Pbf2kOvChbOso6C6QJ1eeZfbm5:zl73WDOshtLOZ15ROO3sh3P6kn5
                                                                                                                                                                                                    MD5:497FD957521B024AE9604EE1ED68E94D
                                                                                                                                                                                                    SHA1:97D098B11BE2849C2DE3AE08585332C148B3EC61
                                                                                                                                                                                                    SHA-256:DE28A10D5606EE74B9E4A4CD72FFB28DE889C7E42BBD0A79E74B4681A9CC0186
                                                                                                                                                                                                    SHA-512:EB9DA281FE1677D9226973EF997B40FF80DECAE1FBEDDA9C1F4BD3A3234312875CB2B5F8C19207DC0B7D57C7CF9AFB9A4592C63C2114AF869E72F2E4AE096D4F
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Vu.'...t...t...t..Tt...t.lIt...t.lYt...t...t...t}bat...t..`t...t..at{..t..Qt...t..Pt...t..Wt...tRich...t................PE..L...CdOX...........!..............................`m.....................................@.........................................P..................@....p...].....................................@...............X...........................text.............................. ..`.rdata..(...........................@..@.data....t.......R..................@....rsrc........P......................@..@.reloc..Lr...p...t..................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\dtplugin\is-BK5HC.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):826432
                                                                                                                                                                                                    Entropy (8bit):6.022189321177478
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:12288:nzl/j3WDOOtht2kOZBr5ROO3s2vk3Pbf2kOvChbOso6C6QJ1eeZfbm5:zl73WDOshtLOZ15ROO3sh3P6kn5
                                                                                                                                                                                                    MD5:497FD957521B024AE9604EE1ED68E94D
                                                                                                                                                                                                    SHA1:97D098B11BE2849C2DE3AE08585332C148B3EC61
                                                                                                                                                                                                    SHA-256:DE28A10D5606EE74B9E4A4CD72FFB28DE889C7E42BBD0A79E74B4681A9CC0186
                                                                                                                                                                                                    SHA-512:EB9DA281FE1677D9226973EF997B40FF80DECAE1FBEDDA9C1F4BD3A3234312875CB2B5F8C19207DC0B7D57C7CF9AFB9A4592C63C2114AF869E72F2E4AE096D4F
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Vu.'...t...t...t..Tt...t.lIt...t.lYt...t...t...t}bat...t..`t...t..at{..t..Qt...t..Pt...t..Wt...tRich...t................PE..L...CdOX...........!..............................`m.....................................@.........................................P..................@....p...].....................................@...............X...........................text.............................. ..`.rdata..(...........................@..@.data....t.......R..................@....rsrc........P......................@..@.reloc..Lr...p...t..................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\dtplugin\is-MJAQO.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):908352
                                                                                                                                                                                                    Entropy (8bit):6.15830681968184
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:12288:cQTZwW4Co+tTDZ5zgb+aFys0PdYVNyKhBi+3uJ0ONvATGfAFpd7vChbOso6C6QJv:DCW4CxtTDZ58b+aFysIeyKhB4NvSPFpD
                                                                                                                                                                                                    MD5:64CA0036B2F1AEB7256ADBF5D034FFCA
                                                                                                                                                                                                    SHA1:D8295066FA4CF33C6240DCBF39E0D72D3DC157AF
                                                                                                                                                                                                    SHA-256:84640AF08F5331F32262DA727251565F4816035B3DBF6306D908BEAA51E1BC7B
                                                                                                                                                                                                    SHA-512:70A202E47A755B807058079F13F954CFE992F1B8573D4CDA64AC71BFFEC30B130DFA8DB1AC318EA229A9FC5DD77773A9DF782CE43E2E653710A615A8557D08D9
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 2%
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............x...x...x....k..x...._..x....v..x....f..x...x...y....^..x....^..x....n..x....o..x....h..x..Rich.x..........................PE..L...AdOX...........!.................D.......0....mm......................................@..........................>......."..........................@........c...5..................................@............0..4............................text...<........................... ..`.rdata..t....0......................@..@.data....X...@...6..................@....rsrc................d..............@..@.reloc...g.......h...\..............@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\dtplugin\npdeployJava1.dll (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):908352
                                                                                                                                                                                                    Entropy (8bit):6.15830681968184
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:12288:cQTZwW4Co+tTDZ5zgb+aFys0PdYVNyKhBi+3uJ0ONvATGfAFpd7vChbOso6C6QJv:DCW4CxtTDZ58b+aFysIeyKhB4NvSPFpD
                                                                                                                                                                                                    MD5:64CA0036B2F1AEB7256ADBF5D034FFCA
                                                                                                                                                                                                    SHA1:D8295066FA4CF33C6240DCBF39E0D72D3DC157AF
                                                                                                                                                                                                    SHA-256:84640AF08F5331F32262DA727251565F4816035B3DBF6306D908BEAA51E1BC7B
                                                                                                                                                                                                    SHA-512:70A202E47A755B807058079F13F954CFE992F1B8573D4CDA64AC71BFFEC30B130DFA8DB1AC318EA229A9FC5DD77773A9DF782CE43E2E653710A615A8557D08D9
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 2%
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............x...x...x....k..x...._..x....v..x....f..x...x...y....^..x....^..x....n..x....o..x....h..x..Rich.x..........................PE..L...AdOX...........!.................D.......0....mm......................................@..........................>......."..........................@........c...5..................................@............0..4............................text...<........................... ..`.rdata..t....0......................@..@.data....X...@...6..................@....rsrc................d..............@..@.reloc...g.......h...\..............@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\eula.dll (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):109120
                                                                                                                                                                                                    Entropy (8bit):5.9869354559938515
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:1536:IE9WcstxlDgZ9EYDKg0nc6N3Mi+EpOBfo+SPVTVv:PhspgZPDanhP+EpOBw+SPzv
                                                                                                                                                                                                    MD5:964F57CEAC35386E0A73ABCB5569B50B
                                                                                                                                                                                                    SHA1:9AD4C1C37EC3EE4670148E65F4EAEDC699626D9C
                                                                                                                                                                                                    SHA-256:CCE1E5E82E04BC464C93E39573657F4D786965F12C10412577A7545CA7FF2750
                                                                                                                                                                                                    SHA-512:EAB0D2394E3E3BBA2EE60BF6299D4004493F1CE8398AE39BD52B92F18A3D3EF9E72AC086F16670A16C27C3DA4208C511A8B84915A1E4E5ACBCC289D7E696CF3E
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ot....Z...Z...Z..Z...ZC@.Z...Z..Z...Z..Z...Z.v.Z...Z.v.Z...Z...Z...Z.x.Z...Z..Z...Z..Z...Z..Z...Z..Z...ZRich...Z........................PE..L...AdOX...........!..............................~m......................................@.........................P...J............0...t..............@...........P...............................0...@............... ...d...`....................text............................... ..`.rdata...D.......F..................@..@.data...0...........................@....rsrc....t...0...v..................@..@.reloc...............|..............@..B........................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\fontmanager.dll (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):223296
                                                                                                                                                                                                    Entropy (8bit):6.506710543484946
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:6144:F4qiUabN6Lpg0hiBfDTu9avKd59mFGMReiDDg0oOBLc:F4qiUabN6Lpg0hiBfDTu9avK+GSk
                                                                                                                                                                                                    MD5:71BB242085B6D4218FDD6B33E88F0F6A
                                                                                                                                                                                                    SHA1:6B65DE1A8CA998F9E0B2A22FE74E09C6EB59CD9B
                                                                                                                                                                                                    SHA-256:5DC8933185CF0A488BCCF026B64E04F640CE28DC5C8419CA417DB67B0009E8E9
                                                                                                                                                                                                    SHA-512:ABC51F4440E6B425A498732E646B621FF02EA99D1F0A718563E664BBEF7E9402717120A0587707C1A69BCE31BBCA8FC30607C679C7346B87AB6E498E34ECB3A0
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......wG.s3&. 3&. 3&. .h. 0&. (.. 6&. :^. ;&. (.. 4&. 3&. n&. (.4 n&. (.5 "&. (.. 2&. (.. 2&. (.. 2&. Rich3&. ........PE..L...AdOX...........!.........~.....................m......................................@......................... ;.......1.......`...............P..@....p......................................@...@............................................text...:........................... ..`.rdata...O.......P..................@..@.data........@.......,..............@....rsrc........`.......8..............@..@.reloc..N....p.......<..............@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\fxplugins.dll (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):152640
                                                                                                                                                                                                    Entropy (8bit):6.541653527096044
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:KN8j/p6S/ACuHdirs/THqCy7ToCHsuUVL/Z0js/aJIGiQ1xtRi9:rR6HCGdiA/rPy7ToysnjZTa+LQ1T6
                                                                                                                                                                                                    MD5:25B9E97B82E86E53B464BC604DE768EA
                                                                                                                                                                                                    SHA1:2323FDA131361D0BE59A1B728792B69CE38E12E8
                                                                                                                                                                                                    SHA-256:E49B989FA58AFCDF078EFE7AE0DDD0CEB0267F38D87CEB64AFAA0F2AE3C62C98
                                                                                                                                                                                                    SHA-512:7D66CA51202EA7A4501A54334E9F8DDA6FAD299983ACDC5C3C9BBAD633B8FA01B237EAE18886A058F734C5461217DC25769A257147FE50BC3D554420925B3F84
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................5......7.....................&.......8.......#.....5.........................4......3.....6.....Rich....................PE..L...AdOX...........!................G..............m.........................p............@.............................P... ........@...............<..@....P.. .......................................@...............<............................text............................... ..`.rdata...h.......j..................@..@.data........0......................@....rsrc........@......................@..@.reloc.. ....P......."..............@..B................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\glass.dll (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):200768
                                                                                                                                                                                                    Entropy (8bit):6.4313581000347995
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:NC0MaR3VsSduCCkNlKpZ1lWh6uNcCQZPD64E2B3Fzkmldrrr0D9BpJGOe9bbkrL:k0XRFsYtxWtE2B3uW8BpYOe9bo3
                                                                                                                                                                                                    MD5:CF9ABCC8CC800AFBA3FCC1A5C6F2B195
                                                                                                                                                                                                    SHA1:DC28C355066D61EA4C9DE59FEA1F8157E67B1631
                                                                                                                                                                                                    SHA-256:4272082A7FA59822CF41CCE498C38A6B466DC7C05E3079EF5C4265EEA73A0EAF
                                                                                                                                                                                                    SHA-512:8B735CA56CD7321A349A74F35A9C5EC8645CCC858C65141DD92BC82665811D739A731968B4E33F10181D4B89C6C980F0D9BC8AA93623CB14CAB6D91A1EF7D652
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............g_..g_..g_..._..g_..._..g_..._..g_..._..g_aT._..g_aT._..g_aT._..g_..f_..g_..._..g_.._..g_.._..g_..._..g_.._..g_Rich..g_........................PE..L...AdOX...........!...............................m.........................0.......$....@..........................l..................X&..............@........(......................................@...............<....^.......................text...\........................... ..`.rdata..............................@..@.data...\"..........................@....rsrc...X&.......(..................@..@.reloc...(.......*..................@..B................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\glib-lite.dll (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):400960
                                                                                                                                                                                                    Entropy (8bit):6.16683290545912
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:12288:tnIS5PeQTBQUw1ivWQd6swIp5WhkRk6yK:tnIsWQtidQdmImR6yK
                                                                                                                                                                                                    MD5:4EF371443550968D5FD541AEA73173AE
                                                                                                                                                                                                    SHA1:09B1A717D4A1DC8E5D7D182C53CC5EF81E824564
                                                                                                                                                                                                    SHA-256:BC4C19C2D7E034ACCBA88C93D02F61B4E3CBB6F9F750E6007B4FA2340F5BB655
                                                                                                                                                                                                    SHA-512:71E7112A09DC115DFDD18313E1C24F285AF16F31303F967113B98F507535BCF9BE23B14416A7681B60934A50E2622458014FE2E59494BAA1739BFB81F57E8041
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......j..'..{t..{t..{t.g.t).{t#..t-.{t#..t".{t#..t".{t#..t,.{tS..ty.{t.8.t".{t..zt..{tS..t/.{t#..t/.{tS..t/.{tRich..{t................PE..L...AdOX...........!.....V...........>.......p.....m.........................P.......&....@.............................^...............................@.... ..t'......................................@............p...............................text...:U.......V.................. ..`.rdata...j...p...l...Z..............@..@.data.... ..........................@....rsrc...............................@..@.reloc..t'... ...(..................@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\gstreamer-lite.dll (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):514624
                                                                                                                                                                                                    Entropy (8bit):6.803327440276922
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:12288:1cNqlntBlgP/93G+h1JDE37lorNAn6ztV7+:1cNmXlONG2JDZpA6ZV7+
                                                                                                                                                                                                    MD5:F2EE17949F444BA516D43BD73C0B262E
                                                                                                                                                                                                    SHA1:4FC3FBB1F48C04AA64148ACFEA0E48E1DA14B4C6
                                                                                                                                                                                                    SHA-256:CDCBBFE123B3807C64DBC8E96A0D98F78593E2717D21F35AA2176FA65D6701A3
                                                                                                                                                                                                    SHA-512:76F6DF4AD432D2D1E3BE569882871515E4FBD87319ED738BB656E743CEFC73D6041BF5F52B008FE6D66F8E31CAE7F7799F87EF6590B5193642EC1600480E4A79
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Es.J$..J$..J$....N$..Gv..I$..Gv.G$..Gv..G$..Gv..H$..7]..%$.....B$..7]..H$..J$...%..7]..K$..Gv.K$..7].K$..RichJ$..........PE..L...BdOX...........!...............................m......................................@..........................F.......I..........................@.......hT...................................E..@............................................text...^........................... ..`.rdata..............................@..@.data....0...`..."...F..............@....rsrc................h..............@..@.reloc..hT.......V...l..............@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\hprof.dll (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):132160
                                                                                                                                                                                                    Entropy (8bit):6.72250950397804
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:CGBc2vf2AWlvx+Kre9vVv3CoLORljxWEX9B/gKG0yNG3:txvffVvyo0XDgKv+K
                                                                                                                                                                                                    MD5:56FBECE0995C397FEB540E2EF30382F1
                                                                                                                                                                                                    SHA1:300F0CCB4A3F03AA8F058B7C7B5AD28675CB0465
                                                                                                                                                                                                    SHA-256:4A3A7DED958A4F140D07D92D5371201F00B6A6C3B85C5187F707530AE3D585B8
                                                                                                                                                                                                    SHA-512:1781D47788E2B542E27B3243FC6033A6559B1BC8CE0F6373AA958938B584FD2C0C0AA3F694A47D8FCCB35FE671BD722BF43371034453EE591D2B3F3FB14A2069
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........vu^............8Y...............................o..............................................Rich............................PE..L...AdOX...........!.....z...v......_..............m......................... ............@.............................i...l...d.......................@........................................... ...@...............d............................text...Ny.......z.................. ..`.rdata...M.......N...~..............@..@.data...............................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ.exe (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):191552
                                                                                                                                                                                                    Entropy (8bit):6.744175386210352
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:KqGHPGleIOsEF+ySTk0Cl23+I0IXpcTBf8pdjZqMNj4HcezGN:tGvnsEOTknl23+I0gpcTBgvkYN
                                                                                                                                                                                                    MD5:9F8C5EAF561629D9323720ED6A80E9F8
                                                                                                                                                                                                    SHA1:A139AEE527417CBC6D8FBCD8107D159C18690025
                                                                                                                                                                                                    SHA-256:FF994196D2BB0F3F749C9A6295CCD3317B3C8F153B7AA1F9CED78A083CA72223
                                                                                                                                                                                                    SHA-512:07E10EE64157F45101D2E8FEE8EFDC9F411CD283D5A25A418F0DFF578FB94916C1FC5631DDBAD63D42A25416B3B71B5B948E8498EA87DDE268B4E63B34F6EF25
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........v...%...%...%..w%...%.7D%...%.7q%...%..|%...%...%...%.7E%*..%.7u%...%.7r%...%Rich...%........................PE..L....[OX.....................(....................@..........................0............@.................................\*..d.......................@............................................$..@............................................text.............................. ..`.rdata...t.......v..................@..@.data....4...@......."..............@....rsrc................8..............@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSClientJ.exe (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):191552
                                                                                                                                                                                                    Entropy (8bit):6.744175386210352
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:KqGHPGleIOsEF+ySTk0Cl23+I0IXpcTBf8pdjZqMNj4HcezGN:tGvnsEOTknl23+I0gpcTBgvkYN
                                                                                                                                                                                                    MD5:9F8C5EAF561629D9323720ED6A80E9F8
                                                                                                                                                                                                    SHA1:A139AEE527417CBC6D8FBCD8107D159C18690025
                                                                                                                                                                                                    SHA-256:FF994196D2BB0F3F749C9A6295CCD3317B3C8F153B7AA1F9CED78A083CA72223
                                                                                                                                                                                                    SHA-512:07E10EE64157F45101D2E8FEE8EFDC9F411CD283D5A25A418F0DFF578FB94916C1FC5631DDBAD63D42A25416B3B71B5B948E8498EA87DDE268B4E63B34F6EF25
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........v...%...%...%..w%...%.7D%...%.7q%...%..|%...%...%...%.7E%*..%.7u%...%.7r%...%Rich...%........................PE..L....[OX.....................(....................@..........................0............@.................................\*..d.......................@............................................$..@............................................text.............................. ..`.rdata...t.......v..................@..@.data....4...@......."..............@....rsrc................8..............@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSCompressorJ.exe (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):191552
                                                                                                                                                                                                    Entropy (8bit):6.744175386210352
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:KqGHPGleIOsEF+ySTk0Cl23+I0IXpcTBf8pdjZqMNj4HcezGN:tGvnsEOTknl23+I0gpcTBgvkYN
                                                                                                                                                                                                    MD5:9F8C5EAF561629D9323720ED6A80E9F8
                                                                                                                                                                                                    SHA1:A139AEE527417CBC6D8FBCD8107D159C18690025
                                                                                                                                                                                                    SHA-256:FF994196D2BB0F3F749C9A6295CCD3317B3C8F153B7AA1F9CED78A083CA72223
                                                                                                                                                                                                    SHA-512:07E10EE64157F45101D2E8FEE8EFDC9F411CD283D5A25A418F0DFF578FB94916C1FC5631DDBAD63D42A25416B3B71B5B948E8498EA87DDE268B4E63B34F6EF25
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........v...%...%...%..w%...%.7D%...%.7q%...%..|%...%...%...%.7E%*..%.7u%...%.7r%...%Rich...%........................PE..L....[OX.....................(....................@..........................0............@.................................\*..d.......................@............................................$..@............................................text.............................. ..`.rdata...t.......v..................@..@.data....4...@......."..............@....rsrc................8..............@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSDashboard.exe (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):191552
                                                                                                                                                                                                    Entropy (8bit):6.744175386210352
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:KqGHPGleIOsEF+ySTk0Cl23+I0IXpcTBf8pdjZqMNj4HcezGN:tGvnsEOTknl23+I0gpcTBgvkYN
                                                                                                                                                                                                    MD5:9F8C5EAF561629D9323720ED6A80E9F8
                                                                                                                                                                                                    SHA1:A139AEE527417CBC6D8FBCD8107D159C18690025
                                                                                                                                                                                                    SHA-256:FF994196D2BB0F3F749C9A6295CCD3317B3C8F153B7AA1F9CED78A083CA72223
                                                                                                                                                                                                    SHA-512:07E10EE64157F45101D2E8FEE8EFDC9F411CD283D5A25A418F0DFF578FB94916C1FC5631DDBAD63D42A25416B3B71B5B948E8498EA87DDE268B4E63B34F6EF25
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........v...%...%...%..w%...%.7D%...%.7q%...%..|%...%...%...%.7E%*..%.7u%...%.7r%...%Rich...%........................PE..L....[OX.....................(....................@..........................0............@.................................\*..d.......................@............................................$..@............................................text.............................. ..`.rdata...t.......v..................@..@.data....4...@......."..............@....rsrc................8..............@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSJ.exe (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):191552
                                                                                                                                                                                                    Entropy (8bit):6.744175386210352
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:KqGHPGleIOsEF+ySTk0Cl23+I0IXpcTBf8pdjZqMNj4HcezGN:tGvnsEOTknl23+I0gpcTBgvkYN
                                                                                                                                                                                                    MD5:9F8C5EAF561629D9323720ED6A80E9F8
                                                                                                                                                                                                    SHA1:A139AEE527417CBC6D8FBCD8107D159C18690025
                                                                                                                                                                                                    SHA-256:FF994196D2BB0F3F749C9A6295CCD3317B3C8F153B7AA1F9CED78A083CA72223
                                                                                                                                                                                                    SHA-512:07E10EE64157F45101D2E8FEE8EFDC9F411CD283D5A25A418F0DFF578FB94916C1FC5631DDBAD63D42A25416B3B71B5B948E8498EA87DDE268B4E63B34F6EF25
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........v...%...%...%..w%...%.7D%...%.7q%...%..|%...%...%...%.7E%*..%.7u%...%.7r%...%Rich...%........................PE..L....[OX.....................(....................@..........................0............@.................................\*..d.......................@............................................$..@............................................text.............................. ..`.rdata...t.......v..................@..@.data....4...@......."..............@....rsrc................8..............@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\instrument.dll (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):115776
                                                                                                                                                                                                    Entropy (8bit):6.787006497251625
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:1536:3LHPDcdivqC4xMfl/hAxfZ/t0QHQIM7iVxoQCpGlyirLwIOfnToIfeQrVZagTjf:3rPDco4xMNEfZ1LQG4iXmvTBfeQ7a2b
                                                                                                                                                                                                    MD5:883EBCC75A9C063B6F2B58BE5D69EA56
                                                                                                                                                                                                    SHA1:D38BE42006FA315ABE7D1A4BC7935FAAE486E1C1
                                                                                                                                                                                                    SHA-256:C10C5D1266FB7CC3F6C7B916821DB28E70C9551094FBA3B4828FCD851E1431F8
                                                                                                                                                                                                    SHA-512:4E4C316699D027B79F785A54AD3502D034F3303BC4B640D97C49DEB7BD85CA01DCB5A86F0719D74F47FD605C11CA4D0D72225D9332BEA80F92D541873300BCCD
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........g0...c...c...c..c...c...c...cP..c...c.|.c...c.|.c...c.|.c...c.|.c...c.|.c...c.|.c...cRich...c........PE..L...AdOX...........!........................0.....m......................................@.........................@.......|...(.......................@...........p1.............................. ...@............0..0............................text...L........................... ..`.rdata...f...0...h..................@..@.data....,..........................@....rsrc...............................@..@.reloc..Z...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-03IUI.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):86592
                                                                                                                                                                                                    Entropy (8bit):6.6935188420387375
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:1536:w8lZS4GiZd9lYzFv0TtRsSpFC5X3K7BenAe7C3xWxiKarY5:w8a4F9l6cFpFWueqWxiKqY5
                                                                                                                                                                                                    MD5:041B6BDC1B9D4B1C754CA218DD581FD4
                                                                                                                                                                                                    SHA1:6EA6D3B272FA84711857D60AD884C84C1FF63E2D
                                                                                                                                                                                                    SHA-256:BF24F085660AC8F8E81DFA04C7FD85FAB2586A5883A52AA1259BDC7483C56288
                                                                                                                                                                                                    SHA-512:E2E6F5FE1AB2B163E665199820E4EA4602FA9372359D771CCCB662E0B7F70BF688D82C172157394A6E60B55E023755E68D3F09D2B3241A74D7E24EC77D85370C
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......!3.ueRr&eRr&eRr&...&gRr&eRs&ERr&h..&fRr&h..&oRr&h..&hRr&h..&gRr&.+.&nRr&.+.&dRr&h..&dRr&.+.&dRr&RicheRr&........PE..L...CdOX...........!..............................o................................DM....@........................../..B...D4..<....p...............:..@.......\...................................0...@...............|............................text............................... ..`.rdata..*w.......x..................@..@.data...$....@....... ..............@..._RDATA.......`.......(..............@..@.rsrc........p.......0..............@..@.reloc..\............4..............@..B................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-0UFA0.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):30784
                                                                                                                                                                                                    Entropy (8bit):6.4133234051058725
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:768:rHhfWinfwUFAvnbMTIUY+naSOu9YiQ5aiC7uQ:tuin5FAvATIUY+nbYiQ5Yr
                                                                                                                                                                                                    MD5:68417B588D482A945EA48C9F90AF26C2
                                                                                                                                                                                                    SHA1:CD851EB4C3818E95ACA4523771CEAD06337C3B05
                                                                                                                                                                                                    SHA-256:2E31D26B8DD5CECEFE93ABFC8201483AB29031A13C7DC850DAEA71B482F2B2BF
                                                                                                                                                                                                    SHA-512:27755E1BA693FB7419B85E9695134A3D3113A94449F28AA2DB5C4D81E26C77772B4788F943873A0A80C36B59DE6529473411950D7AC87B4B796670842D85B232
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............I...I...I..HI...I..JI...I..~I...I..GI...I...I..I...I...I..NI...I..II...IRich...I........PE..L....[OX.................0...,.......1.......@....@..................................v....@.................................dR..x....p...............`..@.......t....A...............................P..@............@..p............................text............0.................. ..`.rdata.......@.......4..............@..@.data........`.......N..............@....rsrc........p.......P..............@..@.reloc..p............Z..............@..B........................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-133N7.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):15936
                                                                                                                                                                                                    Entropy (8bit):6.47089309000393
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:Gps65cnCse0mSHhV8/Y1ee84SzaHnYPLr7KRRi:GpshnApS/8/9e8+C7YRi
                                                                                                                                                                                                    MD5:A07322088F339B3CD49230B4BB99618C
                                                                                                                                                                                                    SHA1:A7CD4DCB02D6FC0638EA4D94B6D2AFA0FF5262A7
                                                                                                                                                                                                    SHA-256:5E1D7446F1A8ADE3558CB8BD8B4DF7DDDE24510BD396E357A6636557B2684DEF
                                                                                                                                                                                                    SHA-512:5A508F9A7545AC91D38BF932840E7100735D753A5D8678577D53A07CF830148F222409EAA62A30983D9C8C4074660B71311EC59BBE24909DA3BF6CAF0C4C0C31
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........R%^.<v^.<v^.<vW..v\.<vEx.v_.<vEx.v\.<vEx.v[.<v^.=vo.<vEx.vJ.<vEx.v_.<vEx.v_.<vRich^.<v........PE..L....[OX............................|........ ....@..........................`.......B....@.................................$#..P....@..H............&..@....P....... ...............................!..@............ ...............................text............................... ..`.rdata....... ......................@..@.data........0......................@....rsrc...H....@......................@..@.reloc.......P.......$..............@..B........................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-16G4J.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):52800
                                                                                                                                                                                                    Entropy (8bit):6.453835079331636
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:768:KkRxfoAQAQUEP/EG9uq4QSpXpNMQcTQxtdRcAXl7gS5vMPxDGUVukrV9tbqycqXd:KkQkQp19umWtL6AXxncxDGUwmtbt09Za
                                                                                                                                                                                                    MD5:53493EDE1D3751C19ABC2E9BE5F69B5F
                                                                                                                                                                                                    SHA1:06400FF6BC3F5A2EF10AE952124CF1AE89BA9AC7
                                                                                                                                                                                                    SHA-256:2EB97530113F4CA1B3E2B8481EB69CBAB4BA0E8F5FECE45E2611BA295469F9A1
                                                                                                                                                                                                    SHA-512:E2062AC217E2C1A6F6DE5ABC3D4554A6729C22B000295C5B40F70F0EABA6D365E2FE5547B0485C57EC2FBD0EACB9D98CDB163CB6C1AC5912251E0A9FD2950E56
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......q..D5.w.5.w.5.w..J..7.w.5.v...w.8..6.w.8..6.w.8..9.w.8..7.w.H..2.w.H..4.w.8..4.w.H..4.w.Rich5.w.........................PE..L...BdOX...........!................e..............o......................................@....................................<.......................@...............................................@............................................text............................... ..`.rdata..X...........................@..@.data...L...........................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-1ILMQ.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):16448
                                                                                                                                                                                                    Entropy (8bit):6.489931006106194
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:192:QbMJRa/RbY0pF89SSSQzDY3X3PVR6ygjzqpjybbU4nYe+PjPriT0fwsJEBwy:QbMJqfaS6zDonPV5gyBybbBnYPLr7wOy
                                                                                                                                                                                                    MD5:9643FFC9C7D6F1F548F56BBCC9C88221
                                                                                                                                                                                                    SHA1:89B911E77059ECFFCFD4CC46E5C3CAF13EC7E8C5
                                                                                                                                                                                                    SHA-256:5029BED56FA976D279144D365FEF5045EAD3D69CECD88DBAA67308F5D2B9711F
                                                                                                                                                                                                    SHA-512:C31E2C2BF1D180A50F34E43A6F337706ED7DCC2A12C134B35F3E8376AFC3742750EA219BA1F5887090C104EC843C29C2B2C55685797A22BD703D9627DA6BBFEA
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3...w.x^w.x^w.x^...^v.x^l..^u.x^l..^u.x^l..^u.x^~..^r.x^w.y^[.x^l..^y.x^l..^v.x^l..^v.x^l..^v.x^Richw.x^........PE..L...AdOX...........!.........................0.....m.........................p......8.....@..........................7.......2..P....P...............(..@....`..`....0..............................`1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...h....@....... ..............@....rsrc........P......."..............@..@.reloc.......`.......&..............@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-1K2V4.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):773968
                                                                                                                                                                                                    Entropy (8bit):6.901569696995594
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:12288:yMmCy3nAgPAxN9ueqix/HEmxsvGrif8ZSy+rdQw2QRAtd74/vmYK6H3BV0eAI:dmCy3KxW3ixPEmxsvGrm8Z6r+JQPzV4I
                                                                                                                                                                                                    MD5:BF38660A9125935658CFA3E53FDC7D65
                                                                                                                                                                                                    SHA1:0B51FB415EC89848F339F8989D323BEA722BFD70
                                                                                                                                                                                                    SHA-256:60C06E0FA4449314DA3A0A87C1A9D9577DF99226F943637E06F61188E5862EFA
                                                                                                                                                                                                    SHA-512:25F521FFE25A950D0F1A4DE63B04CB62E2A3B0E72E7405799586913208BF8F8FA52AA34E96A9CC6EE47AFCD41870F3AA0CD8289C53461D1B6E792D19B750C9A1
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:.y.~...~...~...w...}...~.......eD.....eD..+...eD..J...eD......eD......eD......eD......Rich~...................PE..L..."._M.........."!.........................0.....x................................u.....@..........................H......d...(.......................P.......$L...!..8...........................hE..@............................................text...!........................... ..`.data....Z...0...N..................@....rsrc................f..............@..@.reloc..$L.......N...j..............@..B................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-1S91F.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):268864
                                                                                                                                                                                                    Entropy (8bit):6.4320561356319175
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:6144:uFPlS+WohsO0tHsOB0ppGr32DmrP9Dhvk9e:ilBWohsntHsb/Gb2DmZhvk9e
                                                                                                                                                                                                    MD5:03FBBFC587F2D6D06B6F085F2E745EC8
                                                                                                                                                                                                    SHA1:972EAD014E0383CA3668B578778CF54E2DFE19B1
                                                                                                                                                                                                    SHA-256:523C1746D8EBE35A080F4EBE1BE68DE6FB15A3B48825E620916E5123E703A83C
                                                                                                                                                                                                    SHA-512:F6B30830FBF96EC704F6AF9FE8022243C463A502059EB606A641C54B9959AC572587380FBEBA56AD6B46AE81F6519A9D350B7C61CCF3CDDE6B972BB398C7F9CB
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......a..L%...%...%...>c..8...J.4.-...,.......%.......>c5.....>c4.....>c..$...>c..$...Rich%...................PE..L....]OX.................r..........-C............@.................................Z.....@.................................L...x.......................@....... ................................... ...@...............h...T........................text....q.......r.................. ..`.rdata...c.......d...v..............@..@.data............x..................@....rsrc................R..............@..@.reloc..,-..........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-1SC48.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):223296
                                                                                                                                                                                                    Entropy (8bit):6.506710543484946
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:6144:F4qiUabN6Lpg0hiBfDTu9avKd59mFGMReiDDg0oOBLc:F4qiUabN6Lpg0hiBfDTu9avK+GSk
                                                                                                                                                                                                    MD5:71BB242085B6D4218FDD6B33E88F0F6A
                                                                                                                                                                                                    SHA1:6B65DE1A8CA998F9E0B2A22FE74E09C6EB59CD9B
                                                                                                                                                                                                    SHA-256:5DC8933185CF0A488BCCF026B64E04F640CE28DC5C8419CA417DB67B0009E8E9
                                                                                                                                                                                                    SHA-512:ABC51F4440E6B425A498732E646B621FF02EA99D1F0A718563E664BBEF7E9402717120A0587707C1A69BCE31BBCA8FC30607C679C7346B87AB6E498E34ECB3A0
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......wG.s3&. 3&. 3&. .h. 0&. (.. 6&. :^. ;&. (.. 4&. 3&. n&. (.4 n&. (.5 "&. (.. 2&. (.. 2&. (.. 2&. Rich3&. ........PE..L...AdOX...........!.........~.....................m......................................@......................... ;.......1.......`...............P..@....p......................................@...@............................................text...:........................... ..`.rdata...O.......P..................@..@.data........@.......,..............@....rsrc........`.......8..............@..@.reloc..N....p.......<..............@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-1SFSS.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):33344
                                                                                                                                                                                                    Entropy (8bit):6.5475211336265815
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:768:qqdE5A9uLz/EZSd1f2KyVwhxKdd0t2NC7O:NRK/EZS32pVSYc2AO
                                                                                                                                                                                                    MD5:053566FDEC6BF9717C3A21F36D32C723
                                                                                                                                                                                                    SHA1:9B75BBEE077F4B04DBBACB942B6974F6D17BF823
                                                                                                                                                                                                    SHA-256:A7786F02ECF4F70B03CB2E06F1474E5F613120A6591C9500631931B4813AD672
                                                                                                                                                                                                    SHA-512:C279A5EFC5045BCD2123935024FE202E7340DF71DD55DB34E9E1084A61BF45AC48781B411338A821A93E1089B7555E6321042BA2B2FA25F06D58AAA82CA2170B
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\j.29.29.29w..9.29...9.29...9.29..9.29...9.29.39..29...9..29...9.29...9.29...9.29Rich.29........PE..L...BdOX...........!.....,...>......H6.......@.....o................................k.....@..........................T.......K.......................j..@...........pA..............................XJ..@............@..P............................text...^+.......,.................. ..`.rdata...-...@.......0..............@..@.data...@....p.......^..............@....rsrc................`..............@..@.reloc...............d..............@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-2C49U.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):15936
                                                                                                                                                                                                    Entropy (8bit):6.473780081477935
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:Gpsx5cnEsOEmSHhV8/Qeeq4SzianYPLr7/BuG:GpscnG5S/8/leqfC7JuG
                                                                                                                                                                                                    MD5:D644B1241088C3A6DFB233EDB3E8B4F9
                                                                                                                                                                                                    SHA1:FA131F8BF3BD920AE022BAB3F4583807B1C9E36B
                                                                                                                                                                                                    SHA-256:32E1B12A64B3E14DC3B488975C623055CFD25B09BDDBA6A43A371274B8CADC9A
                                                                                                                                                                                                    SHA-512:65DC1740739D7EC1D8E8778FB5A4917391EC7ACAD3D72EA608E8B554700D21966504D3B644304871C5B6351C9FAC6D17ED6142BE915402961CB2E86D3C26E9D1
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........R%^.<v^.<v^.<vW..v\.<vEx.v_.<vEx.v\.<vEx.v[.<v^.=vo.<vEx.vJ.<vEx.v_.<vEx.v_.<vRich^.<v........PE..L....[OX............................|........ ....@..........................`............@.................................$#..P....@..@............&..@....P....... ...............................!..@............ ...............................text............................... ..`.rdata....... ......................@..@.data........0......................@....rsrc...@....@......................@..@.reloc.......P.......$..............@..B........................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-33NBO.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):30784
                                                                                                                                                                                                    Entropy (8bit):6.611714817058123
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:763a8SoqjtggwjekwLPfc2j7JdJFEqyXCwiuG8RPGHvtLny5jnYPLr71:763a8SoRwLPVdJGqyXFtR+VuVC71
                                                                                                                                                                                                    MD5:0CE9F696A77510ED61453DA1ACCAACFB
                                                                                                                                                                                                    SHA1:C9013D81530AD7B8862C3902DA43C849FB6283F2
                                                                                                                                                                                                    SHA-256:CFC1105375E2494B47377EE6ABC5B167F7C57F4B55FD79F34B62D353C6C2B787
                                                                                                                                                                                                    SHA-512:120D55D96C43E84F3E40CA4B3FAD856489B2C0B57C788AF2E3CC874AEA21084A0E7E46D1C6C89F9DE0EAA3A9FAA5CD0CD334DB33AD9EBFF0ADD2812B22248F73
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......U.Nu.h &.h &.h &...&.h &...&.h &...&.h &.h!&_h &...&.h &...&.h &...&.h &...&.h &...&.h &Rich.h &........PE..L...WdOX...........!.....8...(.......A.......P.....o................................`.....@.........................P^.......V..P....................`..@...........`Q...............................U..@............P..D............................text...66.......8.................. ..`.rdata.. ....P.......<..............@..@.data...$....p.......V..............@....rsrc................X..............@..@.reloc...............\..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-3C7AJ.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):25152
                                                                                                                                                                                                    Entropy (8bit):6.627911972030489
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:+mgNWEfK0RiS46xqJ856ZEPG5uvbronYPLr7hO:t6WmK0RiSxqC56W+M8C7U
                                                                                                                                                                                                    MD5:374B1CFBE98DD48D6023969ED086F88F
                                                                                                                                                                                                    SHA1:0286D38ACBC47903D66A6844660AAAD796D463F9
                                                                                                                                                                                                    SHA-256:75F5D76F211AB811C489DED61B974F0505533C295DAE8D34BA94D1B233014471
                                                                                                                                                                                                    SHA-512:2C02582378F0165DBAC2D1CE919B037014839EE3F91B19E8351B679121947F242C3FF1ECEA160C962911FA3366257FD17293171DC62E072F70FA21302C43D99A
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........%..cK.cK.cK....cK....cK.cJ.cK....cK....cK....cK....cK....cK....cK.Rich.cK.........PE..L...AdOX...........!.....*...........4.......@....|m.................................g....@......................... M.......H..<....p...............J..@............A...............................F..@............@...............................text....).......*.................. ..`.rdata.......@......................@..@.data........`.......@..............@....rsrc........p.......B..............@..@.reloc..z............F..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-3G5EA.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):64064
                                                                                                                                                                                                    Entropy (8bit):6.337716397206902
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:1536:ckh2CQuUlng7qkKi5iO8pm8cN9qfoF3oIy:ckkhu0nTli5jN8cNAfoRNy
                                                                                                                                                                                                    MD5:115EED3EE64059449C9C0A49990C6193
                                                                                                                                                                                                    SHA1:E8A672C318D58C8B445F0C224B4110168EC92214
                                                                                                                                                                                                    SHA-256:3D2C280F1E87921DE93372D64F662DCD22C2B7EEB28ABC87461002A4123A135D
                                                                                                                                                                                                    SHA-512:7062271422E6D9281FC867D1AACA13321C60A4DCC79328A7183F6551B80E250047215B03BEDE50DAAB553B9BDFA0B171EF1317C28580445E79BE288756C8D290
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......?...{.|.{.|.{.|..N..y.|.{.}.g.|.v.x.|.v.y.|.v.w.|.v.y.|....Z.|....z.|.v.z.|....z.|.Rich{.|.........................PE..L...AdOX...........!......... ......_.............Vm......................... ......P.....@.....................................<.......................@...........................................(...@...............t............................text............................... ..`.rdata..............................@..@.data...\...........................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-4957E.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):160256
                                                                                                                                                                                                    Entropy (8bit):6.469605160049269
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:/2lpElIhbyyH3c1CX766zKELxKZDqOSnjZqMNolGl2:/2rE+xdW+76DEVKZHwv
                                                                                                                                                                                                    MD5:81D7B975684B0669A2EDDFC26444F773
                                                                                                                                                                                                    SHA1:691C7B4A0027CEEE617908E8D8CCA803546E6FCF
                                                                                                                                                                                                    SHA-256:71869824A1073745D81775BE8A5993B2C76C0804A7B09653F3B003A82B47AD41
                                                                                                                                                                                                    SHA-512:208827E244E37F59FE064ED54DBE89262D6E3D108E31109415726EF8F53624DDF27E119866B72952E7BF239DA21A1B4B91F03750402FE97CE40CDCBB8563A783
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......d6.. We. We. We.;...9We.;...We.)/..)We. Wd..We.O!.(We.;...We.;...!We.;...!We.;...!We.Rich We.........................PE..L...X^OX...........!.....r...........q....................................................@.............................Z.......d.... ..............................@...................................@............................................text....p.......r.................. ..`.rdata..jH.......J...v..............@..@.data...,3..........................@....rsrc........ ......................@..@.reloc..@............T..............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-4LN6F.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):17472
                                                                                                                                                                                                    Entropy (8bit):6.406821273109915
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:192:mgp64394shTV8+5nwzp5GmL3X+PVR6ymx3doEUnnYe+PjPriT0fwZg:5ThTm+5niD5zOPV5i3doEqnYPLr7n
                                                                                                                                                                                                    MD5:81CACC8ADF951956BC66081CEF52C94A
                                                                                                                                                                                                    SHA1:3DC2E1CEA0CFAF7E44977752A00B258594D5DF93
                                                                                                                                                                                                    SHA-256:1242274BA80CF3F5918E62372E9C3EA40E7BF4B8A2CD3CA70B1FA60659C15A12
                                                                                                                                                                                                    SHA-512:AB0FA1FED99BC5DDB10AD913E4D3B60254721632B1287C10AFE13DC835C9EB3B7D2E3327C0008D74AED60380842FB238EDE43982DA511E9C19B3C542825D5B8D
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............w...w...w....@..w..O9K..w....O..w...w...w....M..w....x..w....y..w....H..w....I..w....N..w..Rich.w..........PE..L...CdOX...........!................)........0.....o.........................p......e.....@..........................7.._....3..<....P...............,..@....`.......0...............................2..@............0...............................text...>........................... ..`.rdata..O....0......................@..@.data...X....@......."..............@....rsrc........P.......$..............@..@.reloc.......`.......(..............@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-4MQ70.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):152640
                                                                                                                                                                                                    Entropy (8bit):6.541653527096044
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:KN8j/p6S/ACuHdirs/THqCy7ToCHsuUVL/Z0js/aJIGiQ1xtRi9:rR6HCGdiA/rPy7ToysnjZTa+LQ1T6
                                                                                                                                                                                                    MD5:25B9E97B82E86E53B464BC604DE768EA
                                                                                                                                                                                                    SHA1:2323FDA131361D0BE59A1B728792B69CE38E12E8
                                                                                                                                                                                                    SHA-256:E49B989FA58AFCDF078EFE7AE0DDD0CEB0267F38D87CEB64AFAA0F2AE3C62C98
                                                                                                                                                                                                    SHA-512:7D66CA51202EA7A4501A54334E9F8DDA6FAD299983ACDC5C3C9BBAD633B8FA01B237EAE18886A058F734C5461217DC25769A257147FE50BC3D554420925B3F84
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................5......7.....................&.......8.......#.....5.........................4......3.....6.....Rich....................PE..L...AdOX...........!................G..............m.........................p............@.............................P... ........@...............<..@....P.. .......................................@...............<............................text............................... ..`.rdata...h.......j..................@..@.data........0......................@....rsrc........@......................@..@.reloc.. ....P......."..............@..B................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-55073.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):14912
                                                                                                                                                                                                    Entropy (8bit):6.137751064213755
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:192:NpQMhRas3XLPVT6wsMPWpRuPUTnYe+PjPriT0fwPa00OQo:NmuR57PVEaWpRuPGnYPLr7NJOb
                                                                                                                                                                                                    MD5:D6587D7BAFEC3E592AD09CCE09A0CA01
                                                                                                                                                                                                    SHA1:3C3E2B390EEA94DF44FB75141ADF2F1848876992
                                                                                                                                                                                                    SHA-256:AFC7E82DBF1AFFBDE6EA417EC74E17FD5E1EBECBB69CC9C9753EADDEA0FDF718
                                                                                                                                                                                                    SHA-512:86A6481591D38E3DA7A86F93035C2B92D9F64F0EB2132DAEF626F1926806EC02976EC3355BD83FF2A1552A506D3F23DBFFE056989AA6517E1EE1CE09F4F2F0BF
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........5.Z.[.Z.[.Z.[.A<..[.[.A<..Q.[.A<.._.[.S...X.[.Z.Z.D.[.A<..Y.[.A<..[.[.A<..[.[.A<..[.[.RichZ.[.................PE..L...KdOX...........!......................... .....m.........................`.......g....@.........................`%......,"..P....@..x............"..@....P.. .... ............................... ..@............ ...............................text............................... ..`.rdata..d.... ......................@..@.data...`....0......................@....rsrc...x....@......................@..@.reloc..^....P....... ..............@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-5IL4D.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):191552
                                                                                                                                                                                                    Entropy (8bit):6.744175386210352
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:KqGHPGleIOsEF+ySTk0Cl23+I0IXpcTBf8pdjZqMNj4HcezGN:tGvnsEOTknl23+I0gpcTBgvkYN
                                                                                                                                                                                                    MD5:9F8C5EAF561629D9323720ED6A80E9F8
                                                                                                                                                                                                    SHA1:A139AEE527417CBC6D8FBCD8107D159C18690025
                                                                                                                                                                                                    SHA-256:FF994196D2BB0F3F749C9A6295CCD3317B3C8F153B7AA1F9CED78A083CA72223
                                                                                                                                                                                                    SHA-512:07E10EE64157F45101D2E8FEE8EFDC9F411CD283D5A25A418F0DFF578FB94916C1FC5631DDBAD63D42A25416B3B71B5B948E8498EA87DDE268B4E63B34F6EF25
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........v...%...%...%..w%...%.7D%...%.7q%...%..|%...%...%...%.7E%*..%.7u%...%.7r%...%Rich...%........................PE..L....[OX.....................(....................@..........................0............@.................................\*..d.......................@............................................$..@............................................text.............................. ..`.rdata...t.......v..................@..@.data....4...@......."..............@....rsrc................8..............@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-64C6H.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):15936
                                                                                                                                                                                                    Entropy (8bit):6.477783118037472
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:GpsW5cnusImSHhV82+Aeek4SzSdnYPLr7S6:GpstnTS/8P1ekoC7S6
                                                                                                                                                                                                    MD5:8D07726A3CC4AE3835FFC6DBE9584468
                                                                                                                                                                                                    SHA1:D6A6C0C5B040F3EE687662F3A612BB41C2060C5D
                                                                                                                                                                                                    SHA-256:9B4178478D2C6AF8C39C95680697E9011C62A9980F1D999BB325EDD6F1A735DB
                                                                                                                                                                                                    SHA-512:191A89AEE7DD967EB35A1449907509CC44655ECCE7FF970DA0DA3B0039A4964F29E281F3C375485F0C02DF756703741FA9E062909BD570B261349640572DA73D
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........R%^.<v^.<v^.<vW..v\.<vEx.v_.<vEx.v\.<vEx.v[.<v^.=vo.<vEx.vJ.<vEx.v_.<vEx.v_.<vRich^.<v........PE..L....[OX............................|........ ....@..........................`......kg....@.................................4#..P....@..H............&..@....P....... ...............................!..@............ ...............................text............................... ..`.rdata....... ......................@..@.data........0......................@....rsrc...H....@......................@..@.reloc.......P.......$..............@..B........................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-6PM4K.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):142912
                                                                                                                                                                                                    Entropy (8bit):7.350669814296794
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:8oGzTjLkRPQ9U9NuLqkIscj5ojGylYCE2Iu2jGLF5A9bE8LUeYRr0y:VGz/oRPGLNIrIGgYCE2L1F5A9bEGUe4
                                                                                                                                                                                                    MD5:243102768D347645E101BD390D5E3779
                                                                                                                                                                                                    SHA1:6BFA544A2BC31D0B862C72CCAB9405C63BD7DF6D
                                                                                                                                                                                                    SHA-256:1C01E8C95A297CEBEA13B59C484E30C8004E5A4D9F9C670AB93E5F90DB474A40
                                                                                                                                                                                                    SHA-512:1B59B806891602D604D3C4F1F8C106FA30A8F3DC15477116E1C20F3D379D743FF5A5505C498C4F71A525C8A7B163C3EFA7CB793117C963BDDABD3B70057EE09B
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........k..K.c.K.c.K.c.Br..I.c.P...H.c.P...I.c.P...N.c.K.b.m.c.P...m.c.P...J.c.P...J.c.P...J.c.RichK.c.........................PE..L...AdOX...........!.........Z......V.............Sm.........................@............@.................................,...P.... ..................@....0..........................................@............................................text...n........................... ..`.rdata........... ..................@..@.data....+.......(..................@....rsrc........ ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-6SK0G.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):400960
                                                                                                                                                                                                    Entropy (8bit):6.16683290545912
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:12288:tnIS5PeQTBQUw1ivWQd6swIp5WhkRk6yK:tnIsWQtidQdmImR6yK
                                                                                                                                                                                                    MD5:4EF371443550968D5FD541AEA73173AE
                                                                                                                                                                                                    SHA1:09B1A717D4A1DC8E5D7D182C53CC5EF81E824564
                                                                                                                                                                                                    SHA-256:BC4C19C2D7E034ACCBA88C93D02F61B4E3CBB6F9F750E6007B4FA2340F5BB655
                                                                                                                                                                                                    SHA-512:71E7112A09DC115DFDD18313E1C24F285AF16F31303F967113B98F507535BCF9BE23B14416A7681B60934A50E2622458014FE2E59494BAA1739BFB81F57E8041
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......j..'..{t..{t..{t.g.t).{t#..t-.{t#..t".{t#..t".{t#..t,.{tS..ty.{t.8.t".{t..zt..{tS..t/.{t#..t/.{tS..t/.{tRich..{t................PE..L...AdOX...........!.....V...........>.......p.....m.........................P.......&....@.............................^...............................@.... ..t'......................................@............p...............................text...:U.......V.................. ..`.rdata...j...p...l...Z..............@..@.data.... ..........................@....rsrc...............................@..@.reloc..t'... ...(..................@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-70VRK.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):65600
                                                                                                                                                                                                    Entropy (8bit):6.467531778100052
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:1536:alvSH88S2YYJAOd8O3nY4ZIWEQFWCdDAZO2ntOZdUKyi:mvq88sLOt3nrcQFWCdDAZO2nYZR3
                                                                                                                                                                                                    MD5:EB361320622E189EC3FAFA9AA87879E0
                                                                                                                                                                                                    SHA1:82760DDA2CF2B1ADFFB25A7E2404033808532A46
                                                                                                                                                                                                    SHA-256:8E2EDF9E342C70D4CE79AFB2712BD55EDA7585BE2924C40EFF2BF4839C67809E
                                                                                                                                                                                                    SHA-512:E7FE96792B9F58413768116749927654D18E4E4D40E37CCB381B51F2E921E386237A39BF130254B78377FDA52FF5DFC634FA82E1F73D9E56E38B9B5A31BDBA06
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........D.H%..H%..H%..A]).J%...k".I%..S.$.L%..S...D%..S.&.O%..H%..w%..S...A%..S.!.I%..S. .I%..S.'.I%..RichH%..........PE..L...BdOX...........!.........L......-..............o......................... .......y....@.....................................d.......................@...........................................p...@............................................text...>........................... ..`.rdata...-..........................@..@.data...............................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-80MMG.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):23616
                                                                                                                                                                                                    Entropy (8bit):6.618680932232422
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:Tp2dG5pC/ujTc8ZrEnrZm8WXbEnPV5niLQVnYPLr7Yb7G:fvCGjJ0Q8ndYLIC7YHG
                                                                                                                                                                                                    MD5:1A0A8C7BAC65D3655B39CF9B7EAD4F5A
                                                                                                                                                                                                    SHA1:39432B42ECFF57361C1D97273B5EB54A368B640D
                                                                                                                                                                                                    SHA-256:7438A6D79019E645BBCAFF7C21E83943642B6C9E1DF61C15631C71548730E3C1
                                                                                                                                                                                                    SHA-512:6C8E61C678525DAF66208BCCEB5F86BF517A5CDD780C39A97F319E854F284116C11B1299DC195FF37827F0E1CDDE6D83E2A660DCDC3C730D99CEADF554989E6F
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......2..v...v...v.....+.t...m'$.u...v...\...m'&.w...m'..t...m'..{...m'#.w...m'".w...m'%.w...Richv...................PE..L...IdOX...........!.....*...........4.......@.....m......................................@..........................I..|....E..<....`...............D..@....p.......@...............................D..@............@...............................text....).......*.................. ..`.rdata.......@......................@..@.data...(....P.......:..............@....rsrc........`.......<..............@..@.reloc..^....p.......@..............@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-81F63.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):455328
                                                                                                                                                                                                    Entropy (8bit):6.698367093574994
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:12288:uZ/8wcqw2oe+Z3VrfwfNOOoWhUgiW6QR7t5ss3Ooc8DHkC2e77/:W/8wVwHZFTwFOOos3Ooc8DHkC2e77/
                                                                                                                                                                                                    MD5:FD5CABBE52272BD76007B68186EBAF00
                                                                                                                                                                                                    SHA1:EFD1E306C1092C17F6944CC6BF9A1BFAD4D14613
                                                                                                                                                                                                    SHA-256:87C42CA155473E4E71857D03497C8CBC28FA8FF7F2C8D72E8A1F39B71078F608
                                                                                                                                                                                                    SHA-512:1563C8257D85274267089CD4AEAC0884A2A300FF17F84BDB64D567300543AA9CD57101D8408D0077B01A600DDF2E804F7890902C2590AF103D2C53FF03D9E4A5
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......o...+.N+.N+.N.3wN).N+.N..Nm.aN(.Nm.cN#.Nm.]N..Nm.\Ne.Nm.YN-.Nm.`N*.Nm.gN*.Nm.bN*.NRich+.N........................PE..L....|OR.........."!.........................0.......................................x....@..........................W..L...<...<........................>.......D...................................K..@...............<............................text...<........................... ..`.data....^...0...0... ..............@....idata...............P..............@..@.rsrc................j..............@..@.reloc...D.......F...n..............@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-8B5J9.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):16448
                                                                                                                                                                                                    Entropy (8bit):6.382180875681361
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:Gps0Anv+dsQmSHhV8FUeenc2tnYPLr7eD:Gps1nWQS/8FRe3C7W
                                                                                                                                                                                                    MD5:6EDF068A2741192CB8C297FC4004AA6B
                                                                                                                                                                                                    SHA1:C513BDE60791C2923BEFAEE0006C36F51A6D6F50
                                                                                                                                                                                                    SHA-256:8F0E318A14A11BD18AFF3F655A9CF05FD1D778B22C29A4047666A52A381AC576
                                                                                                                                                                                                    SHA-512:A58BBEFAF6DDA705012ACCD5D0C146D5D6303DB86795FCF131AE4461627F05D4EB39A5DC9D3275A7ECE556B9909F3BB0946E6E4A66BA856C050A429286C97624
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........R%^.<v^.<v^.<vW..v\.<vEx.v_.<vEx.v\.<vEx.v[.<v^.=vo.<vEx.vJ.<vEx.v_.<vEx.v_.<vRich^.<v........PE..L....[OX............................z........ ....@..........................`.......3....@..................................#..P....@..H............(..@....P....... ..............................h"..@............ ...............................text............................... ..`.rdata....... ......................@..@.data........0......................@....rsrc...H....@......................@..@.reloc.......P.......&..............@..B........................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-8R81H.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):574528
                                                                                                                                                                                                    Entropy (8bit):6.505383213382561
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:12288:VgOd513xASJ4yvhwKF1FbaFLYKZxL/ooG6+WkAI4i8MaJ4LctiGolste8Q8Nw38X:VgOd513SSJ4yvhwKF1FbaF0KZioG8kAR
                                                                                                                                                                                                    MD5:2A9F651B6394AAFFA4F454C9880B7F94
                                                                                                                                                                                                    SHA1:DB5CE34660CDF84BBDDFF9B800D224BB14848B6C
                                                                                                                                                                                                    SHA-256:C849E1C1989896EB4103FD717200D3545DD3ECEDA81E3BAE95DB0A6309647562
                                                                                                                                                                                                    SHA-512:5819014214563D6A6A8B04F81CD261C5E042C76B2F8D82E67932E6594E3FEC8C6B0C92D9CA5402A28C095156D26BA457227C8B0969C3CF5C8F72DB50B3E5D0C2
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Y...8i.8i.8i.@..8i....8i.8h.8i....8i....8i.....8i....8i....8i....8i.Rich.8i.........PE..L...BdOX...........!...............................o.................................p....@......................... ..."......<.......................@...........................................p...@............................................text............................... ..`.rdata..B...........................@..@.data...,...........................@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-8S5P9.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):115776
                                                                                                                                                                                                    Entropy (8bit):6.787006497251625
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:1536:3LHPDcdivqC4xMfl/hAxfZ/t0QHQIM7iVxoQCpGlyirLwIOfnToIfeQrVZagTjf:3rPDco4xMNEfZ1LQG4iXmvTBfeQ7a2b
                                                                                                                                                                                                    MD5:883EBCC75A9C063B6F2B58BE5D69EA56
                                                                                                                                                                                                    SHA1:D38BE42006FA315ABE7D1A4BC7935FAAE486E1C1
                                                                                                                                                                                                    SHA-256:C10C5D1266FB7CC3F6C7B916821DB28E70C9551094FBA3B4828FCD851E1431F8
                                                                                                                                                                                                    SHA-512:4E4C316699D027B79F785A54AD3502D034F3303BC4B640D97C49DEB7BD85CA01DCB5A86F0719D74F47FD605C11CA4D0D72225D9332BEA80F92D541873300BCCD
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........g0...c...c...c..c...c...c...cP..c...c.|.c...c.|.c...c.|.c...c.|.c...c.|.c...c.|.c...cRich...c........PE..L...AdOX...........!........................0.....m......................................@.........................@.......|...(.......................@...........p1.............................. ...@............0..0............................text...L........................... ..`.rdata...f...0...h..................@..@.data....,..........................@....rsrc...............................@..@.reloc..Z...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-8SMD0.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):514624
                                                                                                                                                                                                    Entropy (8bit):6.803327440276922
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:12288:1cNqlntBlgP/93G+h1JDE37lorNAn6ztV7+:1cNmXlONG2JDZpA6ZV7+
                                                                                                                                                                                                    MD5:F2EE17949F444BA516D43BD73C0B262E
                                                                                                                                                                                                    SHA1:4FC3FBB1F48C04AA64148ACFEA0E48E1DA14B4C6
                                                                                                                                                                                                    SHA-256:CDCBBFE123B3807C64DBC8E96A0D98F78593E2717D21F35AA2176FA65D6701A3
                                                                                                                                                                                                    SHA-512:76F6DF4AD432D2D1E3BE569882871515E4FBD87319ED738BB656E743CEFC73D6041BF5F52B008FE6D66F8E31CAE7F7799F87EF6590B5193642EC1600480E4A79
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Es.J$..J$..J$....N$..Gv..I$..Gv.G$..Gv..G$..Gv..H$..7]..%$.....B$..7]..H$..J$...%..7]..K$..Gv.K$..7].K$..RichJ$..........PE..L...BdOX...........!...............................m......................................@..........................F.......I..........................@.......hT...................................E..@............................................text...^........................... ..`.rdata..............................@..@.data....0...`..."...F..............@....rsrc................h..............@..@.reloc..hT.......V...l..............@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-9044A.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):14912
                                                                                                                                                                                                    Entropy (8bit):6.38285429926287
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:192:7WdrN32+sPFlC13XLPVlD6s+N9F5o4VUInYe+PjPriT0fwJBsRbwcKB:74Gd0p7PVlSV5nYPLr76eULB
                                                                                                                                                                                                    MD5:79AD5610814D5C9DA7F9FDF1A66814D9
                                                                                                                                                                                                    SHA1:3B6DED495AFD575B4A5FA8D332BF6DC2D5CC9C97
                                                                                                                                                                                                    SHA-256:3FB679D51CDD2F8434FB7177553F7276C98FD4E7BCF60A0AB21BB4298158A2AE
                                                                                                                                                                                                    SHA-512:329154B6C127EF7CF88DAA7735FF898C9B9032C4A4082EFD53521851F1D9BD8F7DBBE870A4EF7F53EEDC6E53E8C027EE8FD3F5C3707EFDADD931EB61AEB06DD7
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Z>Mg._#4._#4._#4.'.4._#4..4._#4..4._#4..4._#4._"4>_#4..4._#4..4._#4..4._#4..4._#4Rich._#4................PE..L...BdOX...........!......................... .....o.........................`.......E....@..........................%......\"..d....@..............."..@....P..D.... ...............................!..@............ ...............................text............................... ..`.rdata....... ......................@..@.data...`....0......................@....rsrc........@......................@..@.reloc.......P....... ..............@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-AN89T.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):80960
                                                                                                                                                                                                    Entropy (8bit):6.679744509090023
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:1536:djPA2UOEe31bRlX1iZ0Y/cbq+sLdx2uuzrUWLoaj3SnGo/:d735pNbq9eoajJo/
                                                                                                                                                                                                    MD5:1A15D876CF7676920E87EADBE62E9E27
                                                                                                                                                                                                    SHA1:7C0D907A6FD5A4DD369991FD233FF361EA478210
                                                                                                                                                                                                    SHA-256:0CD5AD5A0A69EE8BA160012A0A97BBBD603DE2BEB3C8D90C30E97AF29BFD2172
                                                                                                                                                                                                    SHA-512:EA83E9EBD01BD8D2D348BE7C7832E68051240381D4FB8EFBCDC1CF053D87780715C1A80F1EB94BDBB67DB19C6ABB2B65F6377DA9A3C7F57895B101504F744C75
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......!..Ke.}.e.}.e.}.~'..d.}.~'..g.}.....f.}.~'..c.}.e.|..}.l...b.}.l...d.}.~'..D.}.~'..d.}.~'..d.}.~'..d.}.Riche.}.................PE..L...BdOX...........!.........l......r..............o.........................`.......6....@.........................P...1............0...............$..@....@...... ...............................P...@.......................`....................text...^........................... ..`.rdata...L.......N..................@..@.data........ ......................@....rsrc........0......................@..@.reloc..V....@......................@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-BB5PB.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):57408
                                                                                                                                                                                                    Entropy (8bit):6.67262433613941
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:768:/g/KC7qdFarGYmLP8FnqsdlxkJavvo8N+hwBBwaa3rpe8ZmI6aSTGBqwiw8E2ISl:m6arRmcnq2lxm+Na6C7HITeT8E2p/wS7
                                                                                                                                                                                                    MD5:91B1CA2FAE5D877F561C39FDBD3B620F
                                                                                                                                                                                                    SHA1:28DE0E055C50FF31F77AAE4937B1F72C5617BE75
                                                                                                                                                                                                    SHA-256:106A02DB62D616C9C3677350F72D1FCC74D15BE3B13FE0CCF4D209ACD531D7D6
                                                                                                                                                                                                    SHA-512:1E1201165DDB9531D9F8A51C5190C487BC03B554E72E4D86C0F4D713FB6A0805869DD377CF8E58B555C236F6D8F5659C86B115873E5DD482C06C1ED03AA519BE
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................I2.......(.......*.....................\.:.....\.>...............................)...............+.....Rich............PE..L...FdOX...........!.....r...V.......w.............m................................W.....@.........................@...x...............................@.......8.......................................@...............4............................text....p.......r.................. ..`.rdata...@.......B...v..............@..@.data...............................@....rsrc...............................@..@.reloc..8...........................@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-BSD0S.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):116288
                                                                                                                                                                                                    Entropy (8bit):5.788900294640214
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:6XSOejykUroCJGBhzla+uHMg9glgFvcfgfgzgG4g9XTXDXp+RuXGXlXdY9vXTXvv:WSOeGkUrVJShKc1b
                                                                                                                                                                                                    MD5:B9F99AFF9D768E5C8CA214B41963D84E
                                                                                                                                                                                                    SHA1:0823B7C6539F3FC120C3EF69C45AF90DE007644F
                                                                                                                                                                                                    SHA-256:867F8159D07B0E1089F2CD301698590B3B00063BE4D6004C3CFD6E993EC7C56A
                                                                                                                                                                                                    SHA-512:71C80DABC0695A0C1631599BBCB171C8C95895998A20E35C4E84A8BE014056C4FB5593ADBB509E9CD16938BDF04DE59A0AAA546CAC686796D01570872DA0C518
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........tm....X...X...X.G.X...X.G.X...X.G.X...X.G.X...XR..X...X...X...X.l.X...X.l.X...X.G.X...X.l.X...XRich...X........PE..L...BdOX...........!................=..............o.................................f....@.........................0...K...|...d.......................@....... ......................................@...............4............................text.............................. ..`.rdata..X...........................@..@.data...............................@....rsrc...............................@..@.reloc.. ...........................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-BSU7H.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):970912
                                                                                                                                                                                                    Entropy (8bit):6.9649735952029515
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:12288:LBmFyjLAOQaYkxGXPfY7eiWWcpOKnpTVOIxhK765qlRRb6x4pI23IbJQV:dmFyjLF847eiWWcoGZVOIxh/WxIAIbGV
                                                                                                                                                                                                    MD5:034CCADC1C073E4216E9466B720F9849
                                                                                                                                                                                                    SHA1:F19E9D8317161EDC7D3E963CC0FC46BD5E4A55A1
                                                                                                                                                                                                    SHA-256:86E39B5995AF0E042FCDAA85FE2AEFD7C9DDC7AD65E6327BD5E7058BC3AB615F
                                                                                                                                                                                                    SHA-512:5F11EF92D936669EE834A5CEF5C7D0E7703BF05D03DC4F09B9DCFE048D7D5ADFAAB6A9C7F42E8080A5E9AAD44A35F39F3940D5CCA20623D9CAFE373C635570F7
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......S9...XlA.XlA.XlA..A.XlA.XmA.XlAQ..A.ZlAQ..AvXlAQ..A!XlAQ..A.XlAQ..A.XlAQ..A.XlAQ..A.XlARich.XlA........PE..L....|OR.........."!................D............................................... .....@.........................`........R..(....p...................>......d]..@...8...........................H...@............P...............................text............................... ..`.data...4e.......V..................@....idata.......P......................@....rsrc........p.......0..............@..@.reloc..d].......^...4..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-C2SKN.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):51264
                                                                                                                                                                                                    Entropy (8bit):6.578462341166279
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:1536:FrOHh9t7/GAzqHcGxAnMRrZT9ixHDyo/r0rV9LrBH1bjPEwhEdheBwHWQFgE/Xu2:l+9t7/qHcGv1Xt/i
                                                                                                                                                                                                    MD5:991743210DEDC8FD20BA130071257769
                                                                                                                                                                                                    SHA1:0A7344B66A70360A3406524E26D2368397C8CAED
                                                                                                                                                                                                    SHA-256:FD2F996B930EE9BB597AF6FBB2DB9DEF2063752CEE906C74C415F32FA312D7B1
                                                                                                                                                                                                    SHA-512:8BFAF9974C10817B55492A82C5475841B83B2E079F74DC74EDB0FC7E4CBDC800DA0080634CBCA1C4147E17DB4358DDA6DF10E4234B0FFEF5882D0E5AC20C26CB
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......O^;w.?U$.?U$.?U$.G.$.?U$...$.?U$.?T$&?U$...$.?U$...$.?U$...$.?U$...$.?U$...$.?U$...$.?U$Rich.?U$........................PE..L...AdOX...........!.....v...8......l..............m................................E.....@.............................u...l...<.......................@.......................................... ...@............................................text...~t.......v.................. ..`.rdata...&.......(...z..............@..@.data...............................@....rsrc...............................@..@.reloc..V...........................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-C36CL.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):127040
                                                                                                                                                                                                    Entropy (8bit):6.803901404249545
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:SeaQK12mW/peEXhPZSifrzahsIn/vsNrwJdG3kz9m:pK1sPZPdC0e9m
                                                                                                                                                                                                    MD5:D2AA977E549AACFE82F4C20DBA14D231
                                                                                                                                                                                                    SHA1:D9ED19AB15A685ACB4E285A7EDE540EE668047CC
                                                                                                                                                                                                    SHA-256:21DA10C45206C5535FCBE5278886869561D0B0DCF9FAF1F16AACA5B323856CFB
                                                                                                                                                                                                    SHA-512:498BFD3257586CC21B39E8D4CE8F20118615E89D72AD079F7BCAEA7BDD8C1A695AB5C5BE8A6200249EBDE5CE75528E8FD1C2F81F2610F319B61181C6A718B901
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........!..r..r..r.W.r..r.W(r..r...r..r..(r..r...r..r.W.r..r..r..r.W)r..r.W.r..r.W.r..r.W.r..rRich..r................PE..L...CdOX...........!..... ...........*.......0.....m.................................Z....@.........................@u...B...U..........................@....... ....5...............................S..@............0......\U..@....................text............ .................. ..`.rdata.......0.......$..............@..@.data...............................@....rsrc...............................@..@.reloc..h...........................@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-C8J3S.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):200768
                                                                                                                                                                                                    Entropy (8bit):6.4313581000347995
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:NC0MaR3VsSduCCkNlKpZ1lWh6uNcCQZPD64E2B3Fzkmldrrr0D9BpJGOe9bbkrL:k0XRFsYtxWtE2B3uW8BpYOe9bo3
                                                                                                                                                                                                    MD5:CF9ABCC8CC800AFBA3FCC1A5C6F2B195
                                                                                                                                                                                                    SHA1:DC28C355066D61EA4C9DE59FEA1F8157E67B1631
                                                                                                                                                                                                    SHA-256:4272082A7FA59822CF41CCE498C38A6B466DC7C05E3079EF5C4265EEA73A0EAF
                                                                                                                                                                                                    SHA-512:8B735CA56CD7321A349A74F35A9C5EC8645CCC858C65141DD92BC82665811D739A731968B4E33F10181D4B89C6C980F0D9BC8AA93623CB14CAB6D91A1EF7D652
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............g_..g_..g_..._..g_..._..g_..._..g_..._..g_aT._..g_aT._..g_aT._..g_..f_..g_..._..g_.._..g_.._..g_..._..g_.._..g_Rich..g_........................PE..L...AdOX...........!...............................m.........................0.......$....@..........................l..................X&..............@........(......................................@...............<....^.......................text...\........................... ..`.rdata..............................@..@.data...\"..........................@....rsrc...X&.......(..................@..@.reloc...(.......*..................@..B................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-D65PD.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):15936
                                                                                                                                                                                                    Entropy (8bit):6.477502829409479
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:GpsR5cnts8mSHhV8xeee84SzSPnYPLr7Tn0X:Gps8nQS/8xDe8iC7D0X
                                                                                                                                                                                                    MD5:347EF202FD465A219020FC2BFB1DEFAA
                                                                                                                                                                                                    SHA1:9AF54E67F5B7C4FC61E6E4D6015FA7E43F7ED2A0
                                                                                                                                                                                                    SHA-256:51B4638BF220A2C57F44F0555C11F59DE806C7AB811A5B7CE9C60CE0456C1F8E
                                                                                                                                                                                                    SHA-512:FD0E812DE2FCDB6F7FE311D45D31AE64D5C22A0AB716056D0FEC54D6ABACE4E950568F0C79F7BFCC1FBF81B9B0246A95DFC5D243639FD2D0F4DF2DB4406D5162
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........R%^.<v^.<v^.<vW..v\.<vEx.v_.<vEx.v\.<vEx.v[.<v^.=vo.<vEx.vJ.<vEx.v_.<vEx.v_.<vRich^.<v........PE..L....[OX............................|........ ....@..........................`.......x....@.................................4#..P....@..H............&..@....P....... ...............................!..@............ ...............................text............................... ..`.rdata....... ......................@..@.data........0......................@....rsrc...H....@......................@..@.reloc.......P.......$..............@..B........................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-DDN6J.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):128064
                                                                                                                                                                                                    Entropy (8bit):6.430017675110439
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:JN77TJSG78+5Orcj/K/e2Hrgc6kZAn1yEkBKMKy1Zf22QYHJiuzTl8ShzzM+64m3:JNXd178+5fnZnQTc
                                                                                                                                                                                                    MD5:A46E69A6D38313581CE393D41620FEF0
                                                                                                                                                                                                    SHA1:D526CC02838B1C989EBDAC9CA3C8816EFB5BA3B4
                                                                                                                                                                                                    SHA-256:EC674DB05829E0C8A62B0406F7ECE860DD0F0A3CC5B6EF523C2A4C1C1A6944E3
                                                                                                                                                                                                    SHA-512:D65E6EDCC6AB89E51B2C7954A3F002AC206BA2E0D09BB56C1526A65EA136FA04B1819180ED20406EACD9E737DD64267704D84CC31556DB405EDF9DD328E4155D
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........[d.@:.N@:.N@:.N[..NB:.N[..NB:.N[..NK:.NIB.NE:.N@:.N{:.N[..NG:.N[..NA:.N[..NA:.N[..NA:.NRich@:.N........PE..L...DdOX...........!................#..............m.................................$....@.........................p...........P.......x...............@...........................................p...@............................................text............................... ..`.rdata..............................@..@.data...............................@....rsrc...x...........................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-DFA5D.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):1182784
                                                                                                                                                                                                    Entropy (8bit):6.628561301073661
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:24576:/yPuNL2MF+C15OJTMEG1yJqkz9BRdFT/22:KkeBBzFD3
                                                                                                                                                                                                    MD5:44C45926A284518F1FA481E6A39E4F26
                                                                                                                                                                                                    SHA1:6C9E983DC537ADB237AAE7B0D3F4E9276DB4AAD2
                                                                                                                                                                                                    SHA-256:19A0C64DADE060E59FC0B076D6F799B411BEEBDE3CC40B9BDB627C6B2F3E212F
                                                                                                                                                                                                    SHA-512:99256D23E812FA59F25DEDD8A9DAC03DEE9FEAE8917E831E7EBF9601623925D8C0D3B6867B610F8D306B3618A031202750D2C40A75D8241187B2A4182DB70EFF
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Q.Q...?...?...?......?.......?.......?.z...?.......?.......?...>.;.?.....s.?.....w.?.......?.......?.......?.Rich..?.........................PE..L...AdOX...........!.................G.............m.........................`.......Y....@.................................,............N..............@....`.........................................@............... ....f..`....................text............................... ..`.rdata.............................@..@.data...8....P...~...4..............@....rsrc....N.......P..................@..@.reloc.......`......................@..B........................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-E01S9.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):191040
                                                                                                                                                                                                    Entropy (8bit):6.750064335659946
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:3C41UmIXZO4TsRjcUizRQrQBMWKm/3TBf8/LjZqMNqyqovZc:y4+XsRjAzqrQBMWL/3TBAvtqP
                                                                                                                                                                                                    MD5:068F32452896883AC346F82C0F3C4652
                                                                                                                                                                                                    SHA1:CA384CC7786818ADC92EC9A38CFCAAAD0FBD0EAB
                                                                                                                                                                                                    SHA-256:5AFB5DF8C32E760EC9113F3F94EB641ADD98A595A84EA825E2300E5EF4E7E9B9
                                                                                                                                                                                                    SHA-512:502A19D59BAB7D27E88BFFA101DF6A40ED3B54E90F3343972833EA98D88A70C3960778730955AF3616396BE2DC7612ACFD72AE1139E7E6590650961D26B966B7
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........+H..E...E...E.L.....E..E....E..E....E......E...D...E..E..{.E..E....E..E....E.Rich..E.........PE..L....[OX.....................&....................@..........................0......2.....@.................................L*..d.......................@............................................$..@............................................text...n........................... ..`.rdata...s.......t..................@..@.data....4...@....... ..............@....rsrc................6..............@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-E34MU.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):158784
                                                                                                                                                                                                    Entropy (8bit):6.821119748025329
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:Hc079x1nIIS/NK+n9o20HCa++96TBf1Vuk3w:807lIIwKn20HCaP96TBO/
                                                                                                                                                                                                    MD5:A71D40B8F13C132FF90244BD5DCE0E05
                                                                                                                                                                                                    SHA1:1387B7490B2C871D4CE14DFBDF80D76714963EEF
                                                                                                                                                                                                    SHA-256:E7FB9B479D185FCAB7F4DF601B0BC111B7760F0358E28959941655421DBC44F1
                                                                                                                                                                                                    SHA-512:DEA331D024FDDEC351E56E46B6862E83C1139B8BD4F7A31A8131F5BD61B9646A16DDF0B445EC8AF29A470994C0CBD4486459218FDBD360353451F6BC93B3597A
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................6...........0.....=............7....5.....4.....3....Rich............PE..L...QdOX...........!...............................o................................Z~....@..........................3..m....*..d....................T..@............................................#..@............................................text...n........................... ..`.rdata...u.......v..................@..@.data....4...@......."..............@....rsrc................6..............@..@.reloc.."............:..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-E7OLP.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):115264
                                                                                                                                                                                                    Entropy (8bit):6.58808255551864
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:L+cINiJd/beFJ0cirPgyiciH/oQr0a6xoy2W3G6vAwC4S:pTOJ0cirPgyl2Nj6vby
                                                                                                                                                                                                    MD5:CB55308227A6F08FEC49AC770A3022F0
                                                                                                                                                                                                    SHA1:56831191C945E803E0E43BE1221BFEEE39DF5CCC
                                                                                                                                                                                                    SHA-256:F4F28C1DC39241DE0011C371137B43A2E1FC8B2E7390156D8524CDC67CDCC889
                                                                                                                                                                                                    SHA-512:4FFD8D03FC12B5C8789EEA292F0C25257C85A489BD9A31F633562F5ABF4A1F8ADA030017E9CDB12A3E32501A9914EF83598B685ED7104F1A827E3A04387192A5
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............l..l..l..>7..l..>...l..>5..l..>...l...#..l..5..l..l.zl.....l.....l..4..l..>3..l..6..l.Rich.l.........PE..L...OdOX...........!.........|.......,.......@.....m.....................................@.....................................x.......................@............................................h..@............@...............................text....-.......................... ..`.rdata..4Z...@...\...2..............@..@.data...4...........................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-E9ND9.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):22592
                                                                                                                                                                                                    Entropy (8bit):6.619822012231737
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:YT4Z7lZRiY3PB6cGgOpem1zq2oRtSnPV5iYxIDLfCnYPLr7n9:44PZRiY3PB6cVAGbRMnd52DLaC79
                                                                                                                                                                                                    MD5:7CB51179FE1B2B6A296C04384D346D41
                                                                                                                                                                                                    SHA1:EFD492D022871D1672B391619079B0895BA7338B
                                                                                                                                                                                                    SHA-256:28A330C2312C5DDFEBDEF4061C9BAA41ADD1D47D8B20728EBBF07A81FB1CB811
                                                                                                                                                                                                    SHA-512:ABE2FF072EF5BFB221837C051F46C394BEDFEE05979CBDBAE4A79D745EA216CDA5F3996D0C61913AA5AE91BEFF836410498C29953E61BA9F8D8EC8F171E03D64
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........6...W..W..W../j.W...e.W..W..W....a.W...g.W...R.W...S.W...b.W...c.W...d.W..Rich.W..........PE..L...NdOX...........!........."......T&.......0.....m................................./....@.........................`>.......:..<....`...............@..@....p.. ....0...............................9..@............0...............................text...^........................... ..`.rdata..p....0....... ..............@..@.data........P.......6..............@....rsrc........`.......8..............@..@.reloc.......p.......<..............@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-EC551.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):195136
                                                                                                                                                                                                    Entropy (8bit):6.809611745177281
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:+NBDRSwyhM0HT6La7zite7ckwjxqR7+WDpa7ozGGDLylUIJ2qIcWYEfQQxIYh59I:SkwyhffKteQ3yLUGIUdljUwOJ
                                                                                                                                                                                                    MD5:4CAD2D27ECC32A6EFA49B29BB4C3A3EE
                                                                                                                                                                                                    SHA1:24B50301C0D36810E00C6A662FCE9E913550A0B6
                                                                                                                                                                                                    SHA-256:92B499CCA582CAF7C3221FD9C59997CFF2C6F57DBEADA41A80BE2E39F6725188
                                                                                                                                                                                                    SHA-512:64A0AB92B837ADE3BF39596168ECD52161CD99FDB925BB48DEDC6D171144D4EE2CC20C8F3F934FD92C6E1E8CD90D98C53824309033D1DFBBC40B1E4437264225
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......`.zS$...$...$...-..&...?>..'...?>..!...$.......?>.. ...?>......?>..%...?>..%...?>..%...Rich$...................PE..L...BdOX...........!.....f...........p.............o......................... ......U.....@.............................f...\...P.......................@...............................................@............................................text....e.......f.................. ..`.rdata..v[.......\...j..............@..@.data...............................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-EK3KP.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):185920
                                                                                                                                                                                                    Entropy (8bit):6.5164171249812854
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:uqIxSXvf/q46Z6TmdGPnp2gpsSAp8xnfoTWqn0JUd38C5/9euzV2M:ZwSX1leGPXq/p8xop3v5zj
                                                                                                                                                                                                    MD5:9369C5D802A5B46CD0FAEC2B395A520D
                                                                                                                                                                                                    SHA1:B641A2F1E24ADEFD90A30ED01F9CB1BB2BB5BE0A
                                                                                                                                                                                                    SHA-256:14675693C8B341F8D242F7A5137199F18B77354235D959EBB50AB5FCCC2ECBE6
                                                                                                                                                                                                    SHA-512:A5662FBC6DE7D621A61BDC673ED17548E97172F82CE00CA64CE5B2ED2D263D60FD4786B04A2561624A94A17FE07585D7CA1DB402E25DBF407D6A388E61D824AE
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......AE.m.$z>.$z>.$z>.\.>.$z>...>.$z>...>.$z>...>.$z>.${>T$z>...>"$z>...>.$z>...>.$z>...>.$z>Rich.$z>........................PE..L...BdOX...........!.................&.......0.....o................................{H....@..........................P..h...<K..d.......................@.......(... 1...............................I..@............0...............................text............................... ..`.rdata..8#...0...$... ..............@..@.data....h...`...\...D..............@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-ERD4S.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):13888
                                                                                                                                                                                                    Entropy (8bit):6.275240867244967
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:192:aDGnvnNcX3XLPVlD6iVUfnYe+PjPriT0fwSuj:a6W7PVlFV+nYPLr7M
                                                                                                                                                                                                    MD5:D30293BB469DCE96EFAB1E879DC3F5F4
                                                                                                                                                                                                    SHA1:0A12272C8AA7C74692D08F59F8C8916E30B9B624
                                                                                                                                                                                                    SHA-256:63CFB511B30B7DB1480166C950FBE429958C04BF495566538D7210D50D959B5D
                                                                                                                                                                                                    SHA-512:D391F648B37463BE07D6375ACEF7DF41383824451C8F0AF9637E211C2E5B71581886B20DE19435A3F7A989BF0C2495DBF0DBFC35768FB9CD2D6F77F3718D54C8
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X"._9LR_9LR_9LRD..R^9LRD..RS9LRD..RZ9LRVA.R]9LR_9MR|9LRD..R\9LRD..R^9LRD..R^9LRD..R^9LRRich_9LR........PE..L...JdOX...........!......................... .....m.........................`......b@....@..........................&..J...L"..P....@..................@....P..@.... ...............................!..@............ ...............................text............................... ..`.rdata..J.... ......................@..@.data...`....0......................@....rsrc........@......................@..@.reloc..t....P......................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-G9F45.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):16448
                                                                                                                                                                                                    Entropy (8bit):6.488899272271987
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:NBY/8p65fb7c2coymhiqCyRoPV5shr1nYPLr7l:NI5fxXodiXC7l
                                                                                                                                                                                                    MD5:679A0D3F0330181CA4D2E919E3F0042B
                                                                                                                                                                                                    SHA1:ED1C5C602C449FDA771D2561764F0B944D8AC1D4
                                                                                                                                                                                                    SHA-256:4ABEF1B47DA71751B110F2BA976E2ACC7F6E7E52149860E49367D5F02CC3B910
                                                                                                                                                                                                    SHA-512:6CB94B0B485B50A14C89030DE52F3F00B1A05BF8AB48B99A2E8F42C084F4F98BD2146ACBF844EE4FCA3A31F2F37A6A74F278B50902F43DA941D658E927C5D864
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........{.m..d>..d>..d>.b.>..d>...>..d>..e>..d>...>..d>...>..d>...>..d>...>..d>...>..d>...>..d>Rich..d>........................PE..L...VdOX...........!.........................0.....o.........................p............@.........................P8..:....4..<....P...............(..@....`.......0...............................3..@............0...............................text............................... ..`.rdata.......0......................@..@.data...`....@....... ..............@....rsrc........P......."..............@..@.reloc.......`.......&..............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-GAQUC.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):83008
                                                                                                                                                                                                    Entropy (8bit):6.595362235920887
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:1536:IUV1TXKvcwKOuFqlgOt6s07VahQrt2TEQSOzMMC+CQ2z6GswY:zV1DxwCggOwDVaIt2TEQSOoGCRz6GswY
                                                                                                                                                                                                    MD5:BF6BCC0BC35AE1E1CC220DD13D0C14DB
                                                                                                                                                                                                    SHA1:D8E6F6ACE318B44C045D5940D3BBD08B94D30926
                                                                                                                                                                                                    SHA-256:3B4D3BB632242351EDC4C08E67FE320B00808E469B14B4CCA9735F88DDDDECB6
                                                                                                                                                                                                    SHA-512:FD50644F2F4577888788B926F0095E449B3D495E813330C0C8FDB4B97DAB7A2B790D3DAD7AF8890C824E2C4E8E322F1A1407C2116C92E54BDDF9659AC8807ADF
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-..C..C..C.....C.....C.v...C.....C..B.Y.C.....C.....C......C.....C.....C.Rich.C.................PE..L...N^OX............................q.............@.......................................@.....................................x....`..H............,..@....p..|...................................@...@...................0........................text.............................. ..`.rdata...C.......D..................@..@.data...$0... ......................@....rsrc...H....`......................@..@.reloc.......p......................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-GO27Q.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):19008
                                                                                                                                                                                                    Entropy (8bit):6.371891410300335
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:PTxbNok/0AfE0Q7TPVlx3B+ASZQ4NNN7F32nYPLr7z6Te:PNhr/w0QfdJSz78C7z6a
                                                                                                                                                                                                    MD5:B2BD172A35C5FA6F7373534C0F7B1F41
                                                                                                                                                                                                    SHA1:C38CF2262B575DCE7938A90C666587C33AD48EB8
                                                                                                                                                                                                    SHA-256:FA49F1189824020B2AAD63D8463169227F8DEC7493F252F7E2A23930D8C326E3
                                                                                                                                                                                                    SHA-512:2FA7CD0DE6A382A2ED7BE97941FD74BBEECA36D6383BDDEE8EC397A9A422F05E665998E060588A5F992771CFD529A78B787E450E4542A400E29B9D5C6F12D923
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............~fQ.~fQ.~fQ...Q.~fQ...Q.~fQ...Q.~fQ...Q.~fQ.~gQ.~fQ...Q.~fQ...Q.~fQ...Q.~fQ...Q.~fQ...Q.~fQRich.~fQ................PE..L...SdOX...........!.........................0.....o.........................p......+.....@..........................8......43..P....P...............2..@....`.......1..............................P1..@............0.......2..@....................text............................... ..`.rdata..T....0......................@..@.data........@.......&..............@....rsrc........P.......*..............@..@.reloc..J....`......................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-GPUOT.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):191552
                                                                                                                                                                                                    Entropy (8bit):6.744175386210352
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:KqGHPGleIOsEF+ySTk0Cl23+I0IXpcTBf8pdjZqMNj4HcezGN:tGvnsEOTknl23+I0gpcTBgvkYN
                                                                                                                                                                                                    MD5:9F8C5EAF561629D9323720ED6A80E9F8
                                                                                                                                                                                                    SHA1:A139AEE527417CBC6D8FBCD8107D159C18690025
                                                                                                                                                                                                    SHA-256:FF994196D2BB0F3F749C9A6295CCD3317B3C8F153B7AA1F9CED78A083CA72223
                                                                                                                                                                                                    SHA-512:07E10EE64157F45101D2E8FEE8EFDC9F411CD283D5A25A418F0DFF578FB94916C1FC5631DDBAD63D42A25416B3B71B5B948E8498EA87DDE268B4E63B34F6EF25
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........v...%...%...%..w%...%.7D%...%.7q%...%..|%...%...%...%.7E%*..%.7u%...%.7r%...%Rich...%........................PE..L....[OX.....................(....................@..........................0............@.................................\*..d.......................@............................................$..@............................................text.............................. ..`.rdata...t.......v..................@..@.data....4...@......."..............@....rsrc................8..............@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-GTIIP.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):15936
                                                                                                                                                                                                    Entropy (8bit):6.474805310471259
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:GpsS5Bn1sCmSHhV8Teeet4SzvBGnYPLr7EBs:Gps0nGS/8TDetJ0C7EBs
                                                                                                                                                                                                    MD5:6791321A5CFEB19A85CC4265D368A0A0
                                                                                                                                                                                                    SHA1:608BBC705ABCA303DBEC6AE5015FB5BE1D2E4A8F
                                                                                                                                                                                                    SHA-256:2D55D5C5B139A319BD5B8550B2540AD4A38A7BF3C5795AE62B95EA2A219CBC91
                                                                                                                                                                                                    SHA-512:D2D0952BEE2F4EE16973F11CD1BD9AADD3A7D9C0CE0FE15920C37A22C7AAA8EA5386ACBF40EC10C77783B5DFA89D0ADCD6023546AC2C68D5D3675528805F78B7
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........R%^.<v^.<v^.<vW..v\.<vEx.v_.<vEx.v\.<vEx.v[.<v^.=vo.<vEx.vJ.<vEx.v_.<vEx.v_.<vRich^.<v........PE..L....[OX............................|........ ....@..........................`............@.................................D#..P....@..h............&..@....P....... ...............................!..@............ ...............................text............................... ..`.rdata....... ......................@..@.data........0......................@....rsrc...h....@......................@..@.reloc.......P.......$..............@..B........................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-H1N8H.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):52800
                                                                                                                                                                                                    Entropy (8bit):6.367692661513199
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:1536:aIofovBbS9KMvRe0cz6QsTPOXw2iT90ci:aIYpYX0cz6QsTPOXxiJ0R
                                                                                                                                                                                                    MD5:1C3EF5399F815FDC3C47D41CC529BCE8
                                                                                                                                                                                                    SHA1:852DC6CA36FBF7E29B84578106AD43C4C8DF1B0D
                                                                                                                                                                                                    SHA-256:EBBFEDDE9F35B321D4CC68B1FA0CF47573792A7155FFA7D2E50E25D403241655
                                                                                                                                                                                                    SHA-512:C3CBFAFBAEA0F72F120BE5847E3B889A33F20869DFACF20781E13416595B635D16E8559F7A929DFD2F46045FDDDFE4DD45A08BBF7BA822CC39EF936616FAAF34
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Hi.m...>...>...>..u>...>.Fq>...>..w>...>..C>...>.pj>...>.pz>...>...>...>c~B>...>..B>...>..s>...>..t>...>Rich...>........PE..L....^OX.................f...R.......i............@.................................L.....@.....................................x.......................@.......X...@...............................P...@...................`........................text....e.......f.................. ..`.rdata...5.......6...j..............@..@.data...............................@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-H4RTI.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):19520
                                                                                                                                                                                                    Entropy (8bit):6.44944953930419
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:4EkF/QP8xkI6DgWIE0PVlXHSZlnYPLr7O7ho8c:4FqP7I61kdByPC7O7hoV
                                                                                                                                                                                                    MD5:4857C5578655DDA0A3A49873318B55AB
                                                                                                                                                                                                    SHA1:D208DF1ABE40C64EAF9D8DC579111218765E5563
                                                                                                                                                                                                    SHA-256:07748ADFF44390AEE7B5D1F4A168C9276D5FC8C1E187E17D4B505B91549B9B9A
                                                                                                                                                                                                    SHA-512:0048E88115D8790CB010021473B1D924975FFD5C733A2180A93F3D8EE975A9540EABADEF993F1BD8AC8CA3D86F50181C6DBCEBAF36E614435B24AD8C3A99E848
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......."..|fl./fl./fl./}.(/dl./}.*/gl./}../dl./o.'/al./fl./_l./}../kl./}.//gl./}../gl./}.)/gl./Richfl./................PE..L...BdOX...........!.........................0.....m.........................p......6!....@..........................=.......8..d....P...............4..@....`..\....1...............................6..@............0...............................text............................... ..`.rdata..w....0......................@..@.data...`....@.......*..............@....rsrc........P.......,..............@..@.reloc.......`.......0..............@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-IDVTK.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):132160
                                                                                                                                                                                                    Entropy (8bit):6.72250950397804
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:CGBc2vf2AWlvx+Kre9vVv3CoLORljxWEX9B/gKG0yNG3:txvffVvyo0XDgKv+K
                                                                                                                                                                                                    MD5:56FBECE0995C397FEB540E2EF30382F1
                                                                                                                                                                                                    SHA1:300F0CCB4A3F03AA8F058B7C7B5AD28675CB0465
                                                                                                                                                                                                    SHA-256:4A3A7DED958A4F140D07D92D5371201F00B6A6C3B85C5187F707530AE3D585B8
                                                                                                                                                                                                    SHA-512:1781D47788E2B542E27B3243FC6033A6559B1BC8CE0F6373AA958938B584FD2C0C0AA3F694A47D8FCCB35FE671BD722BF43371034453EE591D2B3F3FB14A2069
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........vu^............8Y...............................o..............................................Rich............................PE..L...AdOX...........!.....z...v......_..............m......................... ............@.............................i...l...d.......................@........................................... ...@...............d............................text...Ny.......z.................. ..`.rdata...M.......N...~..............@..@.data...............................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-IFNEP.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):15936
                                                                                                                                                                                                    Entropy (8bit):6.478103043828708
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:GpsF5cnUsBmSHhV8/Ceek4SzSKnYPLr7c6A:GpsQn8S/8/vekzC71A
                                                                                                                                                                                                    MD5:5CF6A00237CF6318819FE63644210693
                                                                                                                                                                                                    SHA1:44A70F8428610EC6F8D1D2B9F40CC768A33D5AC9
                                                                                                                                                                                                    SHA-256:EABE64D651D5912A8296F08DA2930E42DA47C6168BA44D5F1C730EBF1A7B393E
                                                                                                                                                                                                    SHA-512:DEFF59B40DCCD080A0DC58B72C0DB33D01F90527A44D14502DB3588EB447F1107E168F1F6B19981139DFA40E479E6FD144B8EE3DD1506F603D92CDC3B33C7EE2
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........R%^.<v^.<v^.<vW..v\.<vEx.v_.<vEx.v\.<vEx.v[.<v^.=vo.<vEx.vJ.<vEx.v_.<vEx.v_.<vRich^.<v........PE..L....[OX............................|........ ....@..........................`.......,....@.................................4#..P....@..H............&..@....P....... ...............................!..@............ ...............................text............................... ..`.rdata....... ......................@..@.data........0......................@....rsrc...H....@......................@..@.reloc.......P.......$..............@..B........................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-IPPDT.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):69696
                                                                                                                                                                                                    Entropy (8bit):6.901580195725612
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:1536:UCpYhdRItqEkQIN0X3lzaQoIOwIOpVnToIfcC5yTgrb:ERUkN+rump9TBfcCY8rb
                                                                                                                                                                                                    MD5:983F2D039CD2268692EF5858A9CE2DBE
                                                                                                                                                                                                    SHA1:FB0D00AA0C8C9E1E965B4EA84E1159EF04C240D2
                                                                                                                                                                                                    SHA-256:0BB5481B4E21E549D5997E095362F6B2C93C8E6630B3355CD9E26371EB8980E1
                                                                                                                                                                                                    SHA-512:7DD17818DC09278CA4FDD370B7D42E407718DBFB64DD309DBA695FE49D347D15B629C8DDD9AF2F46914662667202B9797A9053CD1B13614EF582A573C7BECD55
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........H....................2.................4.....................5.............................Rich............PE..L...BdOX...........!.........h.....................o.........................0.......(....@.................................L...d.......................@.... ..X...0...................................@............................................text............................... ..`.rdata..wV.......X..................@..@.data...............................@....rsrc...............................@..@.reloc....... ......................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-J3KRM.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):126016
                                                                                                                                                                                                    Entropy (8bit):6.6094532025284085
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:kOxjjADzd+aeaPB9JhjxkM2wzGdXJbD/JjewPa:kcKzeaPB9JhjxknwzG5JbDxqwC
                                                                                                                                                                                                    MD5:B19474A46B4BE376477EBC3F6840E5D6
                                                                                                                                                                                                    SHA1:9A645B4CD4E7168683528CE704A88124AEF3706B
                                                                                                                                                                                                    SHA-256:2AC18D69137A1ECB4CC9BB140C931E22BDC68960240800596373C11F5D177581
                                                                                                                                                                                                    SHA-512:F5E29B9C6A7E5483FF0B39E785A841E4B95F106E0BD99D933AAD6D1FD2F40B4864B34C8C772246A5C3DCA446B9BB35DFE483F455FBDFBE3E81383AF24DF11F1D
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........y.r.*.r.*.r.*O..*.r.*.r.*.r.*. .*.r.*. .*.r.*. 0*.r.*. 1*.r.*..0*.r.*...*.r.*. .*.r.*...*.r.*Rich.r.*........PE..L...HdOX...........!.........:.....................m.................................>....@.....................................<.......................@.......\...................................0...@............................................text... ........................... ..`.rdata..8(.......*..................@..@.data...............................@....rsrc...............................@..@.reloc..\...........................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-JJBC3.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):191552
                                                                                                                                                                                                    Entropy (8bit):6.744175386210352
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:KqGHPGleIOsEF+ySTk0Cl23+I0IXpcTBf8pdjZqMNj4HcezGN:tGvnsEOTknl23+I0gpcTBgvkYN
                                                                                                                                                                                                    MD5:9F8C5EAF561629D9323720ED6A80E9F8
                                                                                                                                                                                                    SHA1:A139AEE527417CBC6D8FBCD8107D159C18690025
                                                                                                                                                                                                    SHA-256:FF994196D2BB0F3F749C9A6295CCD3317B3C8F153B7AA1F9CED78A083CA72223
                                                                                                                                                                                                    SHA-512:07E10EE64157F45101D2E8FEE8EFDC9F411CD283D5A25A418F0DFF578FB94916C1FC5631DDBAD63D42A25416B3B71B5B948E8498EA87DDE268B4E63B34F6EF25
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........v...%...%...%..w%...%.7D%...%.7q%...%..|%...%...%...%.7E%*..%.7u%...%.7r%...%Rich...%........................PE..L....[OX.....................(....................@..........................0............@.................................\*..d.......................@............................................$..@............................................text.............................. ..`.rdata...t.......v..................@..@.data....4...@......."..............@....rsrc................8..............@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-K28U7.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):178240
                                                                                                                                                                                                    Entropy (8bit):6.802695940538205
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:e1Wd97Kl2KtpdhEnG5RKNyfCBxFaTUct/OuSsWPjT9JC1pBSCq:yQ2ltpdhEn0CBSTbtmPj65W
                                                                                                                                                                                                    MD5:82F488CA868FE602E2170AE7A9A62C5A
                                                                                                                                                                                                    SHA1:570117F879342FB17EDCD4DE90457F9BCBD3BE70
                                                                                                                                                                                                    SHA-256:EFA38A458AE50007257E7A218808310AE5D10314D3E10D9952FCB0412ACF3C44
                                                                                                                                                                                                    SHA-512:69CBA55C451FF7DD6E62F4DE26D595A81523912B805A667A5C923F0BBC5B8F3CFC403C5A0621761B49BCF90E4DF0B9A2C9169DF0995C8DBD493F680E1BC72CA9
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........:..di..di..di.k.i..di.k.i..di...i..di.k.i..di..ei..di.k.i..di.k.i..di.k.i..di.k.i..diRich..di................PE..L...BdOX...........!.....^...F.......g.......p.....o.................................|....@.............................d....x..P.......h...............@....... ...`q..............................pw..@............p..H............................text....\.......^.................. ..`.rdata.......p.......b..............@..@.data................v..............@....rsrc...h...........................@..@.reloc.. ...........................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-K3O7L.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):15936
                                                                                                                                                                                                    Entropy (8bit):6.475995282201349
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:GpsG5cnJsGmSHhV8yk8eeU4SzKjnYPLr75p:Gps9naS/8yk5eUmC75p
                                                                                                                                                                                                    MD5:28048A3ED6A2E3DE080FAAD19A432356
                                                                                                                                                                                                    SHA1:DBF149C56EFA85FBF0200C4E016CED7244F729A1
                                                                                                                                                                                                    SHA-256:21A4B05D25F8DF26F5B383834D4DDE970CB5B38500EEE6CD1568A4E1BAD2CA18
                                                                                                                                                                                                    SHA-512:7F3EFD375B4551CD345BECEEBA989365C02CA3EEE059AFF37C62FCD13C31A8147C530D1AA6C40669CB6CC535F7420AF7068EA126CF454B876CF3ADC99F1F40F5
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........R%^.<v^.<v^.<vW..v\.<vEx.v_.<vEx.v\.<vEx.v[.<v^.=vo.<vEx.vJ.<vEx.v_.<vEx.v_.<vRich^.<v........PE..L....[OX............................|........ ....@..........................`......,4....@.................................4#..P....@..T............&..@....P....... ...............................!..@............ ...............................text............................... ..`.rdata....... ......................@..@.data........0......................@....rsrc...T....@......................@..@.reloc.......P.......$..............@..B........................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-K7HEV.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):21568
                                                                                                                                                                                                    Entropy (8bit):6.599281592336615
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:CwiAYZIxsQbbRLEs5Lt6lrpPVXVqJnYPLr7FBP:ziPZj+bVEmt6lrpdXVyC7n
                                                                                                                                                                                                    MD5:8771DAAB1E3461F919F3D3E7F5A18E39
                                                                                                                                                                                                    SHA1:CF6A66C7D53EB74283CD1E1920BB729D6E8DF1B4
                                                                                                                                                                                                    SHA-256:726D6C73F7FF84746E5C680B2532154C4417500ED671671FACC3F6F692EAD01F
                                                                                                                                                                                                    SHA-512:EE4BEBB3080ADD3CF087DBC97B18532D2DBC48350394F20E1D23F3E2D23E4B7F184E23DC5AC6780B06A42C97B72FFA28DB298F84E4056C508BC6464C6F28498A
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......x..<...<...<...'<8.>...'<:.>...'<..>...<...v...5.7.9...'<..1...'<?.=...'<>.=...'<9.=...Rich<...........................PE..L...AdOX...........!.................&.......0....}m.................................F....@..........................A..U....<..P....`...............<..@....p......@1..............................x;..@............0..(............................text............................... ..`.rdata.......0....... ..............@..@.data........P.......2..............@....rsrc........`.......4..............@..@.reloc.......p.......8..............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-L256E.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):163904
                                                                                                                                                                                                    Entropy (8bit):6.517540235798898
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:2LjX8c87qs2YGheBQIaMDL6SeroQTrlFA5gNyb:2Lj8c87L2BheBQIaMXyJTrlFAL
                                                                                                                                                                                                    MD5:CC4A4D5DECE7766C2C74BEBF0B00D0F0
                                                                                                                                                                                                    SHA1:BD7F34F7A8EA918BC85D867FE6552041AA13E234
                                                                                                                                                                                                    SHA-256:A22D1A4EC035BF00EC5479C4BE533E6B72AFA12BBEC5416AFF462439598E7655
                                                                                                                                                                                                    SHA-512:8E5727FE93D52A44848886CAF468412532981E47894A544116D6B1A0A2BFE097C961195C1724F19B5A4677461D3547F66BB9DECA52C36062907E7B64A27085C2
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........5...T.^.T.^.T.^..)^.T.^../^.T.^...^&T.^.".^.T.^.,2^.T.^.,"^.T.^.T.^MT.^...^.T.^..*^.T.^..+^.T.^..,^.T.^Rich.T.^................PE..L...DdOX...........!...............................o................................2_....@.................................D........p..P............h..@.......d...................................P...@.......................@....................text............................... ..`.rdata...d.......f..................@..@.data...`@... ..."..................@....rsrc...P....p.......(..............@..@.reloc..~/.......0...8..............@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-L4EVF.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):25664
                                                                                                                                                                                                    Entropy (8bit):6.5367372882532315
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:GdZqjlfs7ZLd8RTou2L23sNmUMh16jelFBOuJIjkzIPV5UKlW5bbonYPLr7LbB:zlcHBu2q8NmUMTlFsBjk8dbyb0C7LbB
                                                                                                                                                                                                    MD5:0893E135F3F304C58CCC8A7D216097E8
                                                                                                                                                                                                    SHA1:7A7C140C50A7F0283E5B3CE011B6FACB1FD67EC6
                                                                                                                                                                                                    SHA-256:93B41671694A845445EE548622860D951B3BFF226DB8DC35582069AEF8EC5B34
                                                                                                                                                                                                    SHA-512:48EEE1E6BF8A1B9B0D31AECBCED1B81F8D3C432A7F1D83C152316ADED3CC521448EF67DE9DD77E514A09BF62DCF5C0F16F4D1A5B35E7111F7F98CFC7DFD139A5
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........O.............................;......V...............:..........................Rich....................PE..L...DdOX...........!.....(...".......3.......@.....o......................................@.........................`O.......G..d....p...............L..@...........PA..............................8D..@............@..4............................text....'.......(.................. ..`.rdata..8....@.......,..............@..@.data...`....`.......B..............@....rsrc........p.......D..............@..@.reloc..f............H..............@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-NLQ51.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):15936
                                                                                                                                                                                                    Entropy (8bit):6.473030915765446
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:Gps05cnKs1mSHhV8PeeeX4SziInYPLr704:GpsDniS/8PDeXhC71
                                                                                                                                                                                                    MD5:C985AF01EA996411BC9D7A13137EE457
                                                                                                                                                                                                    SHA1:C2E29EFE207081E54AD2ED22F3383D084021C11D
                                                                                                                                                                                                    SHA-256:2CA8BB2980D12A83888E1D6B568C772A649BFD7927A617780A6456F0D8C0B8D3
                                                                                                                                                                                                    SHA-512:0B4E3BC3DC1413EC9186282812DC468142BDE43E882162668052F8D2F3E8E957A3CC78E87C2C9C2F90CB9F7619A9FC3E87F2748DBAAE5CA24C7E90487243E150
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........R%^.<v^.<v^.<vW..v\.<vEx.v_.<vEx.v\.<vEx.v[.<v^.=vo.<vEx.vJ.<vEx.v_.<vEx.v_.<vRich^.<v........PE..L....[OX............................|........ ....@..........................`............@.................................4#..P....@..h............&..@....P....... ...............................!..@............ ...............................text............................... ..`.rdata....... ......................@..@.data........0......................@....rsrc...h....@......................@..@.reloc.......P.......$..............@..B........................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-O8F6O.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):15424
                                                                                                                                                                                                    Entropy (8bit):6.384266768373925
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:mTd3hw/L3kKLnYgIHGOOGsnPV5Pnf4/nYPLr7yo:mzw/bkKLtGUndpnfSC7yo
                                                                                                                                                                                                    MD5:97CBA04A08797BE071F76C5EF909AAAD
                                                                                                                                                                                                    SHA1:94104AD4852791218FF1397F7FA2B65D0722A2ED
                                                                                                                                                                                                    SHA-256:69502F0CD142518E183E93DB88E0B7858BA0637FBC29CFEDCD85628FF62EF612
                                                                                                                                                                                                    SHA-512:8C9840612FDA99846C843A244AAC90EF42DD1E5B38DAE18EBCAA7734B94BCBCEC9D9AC426FD7D24FBADDB959EE2A44581A2FFF2E7DE01AEA9EC004AEE7258430
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........6...W..W..W../x.W...w.W..W..W....s.W...u.W...@.W...A.W...p.W...q.W...v.W..Rich.W..........................PE..L...AdOX...........!......................... .....m.........................`............@..........................'......|$..<....@...............$..@....P....... ..............................8#..@............ ...............................text............................... ..`.rdata..v.... ......................@..@.data...p....0......................@....rsrc........@......................@..@.reloc.......P......."..............@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-OU1MJ.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):31896640
                                                                                                                                                                                                    Entropy (8bit):6.4081450765614125
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:393216:SPzJaMux3ZMo56qxqseJwDKRlDsqXCagQZhzvilh2Wlq7ORW:qzxOOLJRvUW
                                                                                                                                                                                                    MD5:E1CCBC17F87124177E89A9211170E17D
                                                                                                                                                                                                    SHA1:F4C22602CEF90EA12643378A13CC902217232181
                                                                                                                                                                                                    SHA-256:A386D0C2639E126E355A383D7EA71A62B96BD703A6751333B91E28A691AEECBC
                                                                                                                                                                                                    SHA-512:5364FAFCE53E4EDFF879A9408C1D76F681A724FCCF5EA87FBAAB2CA82FF39795677EED8D59B415D67465EDD4741E4E9ED833ACFBC3B8A723631003694732A41D
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$........}.,..c...c...c.e.....c..N....c..N....c..e....c..j....c...c...c..N..d.c..N....c.&....c...b...c..e....c..e....c..N....c.......c..e....c.Rich..c.........................PE..L...PdOX...........!...............................m.................................?....@.........................`\...@......x.... ..h...............@....0......................................s..@............................................text............................... ..`.rdata.............................@..@.data...XG.......V..................@....unwante............................@..@.rsrc...h.... ......................@..@.reloc......0......................@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-P7IK9.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):191552
                                                                                                                                                                                                    Entropy (8bit):6.744175386210352
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:KqGHPGleIOsEF+ySTk0Cl23+I0IXpcTBf8pdjZqMNj4HcezGN:tGvnsEOTknl23+I0gpcTBgvkYN
                                                                                                                                                                                                    MD5:9F8C5EAF561629D9323720ED6A80E9F8
                                                                                                                                                                                                    SHA1:A139AEE527417CBC6D8FBCD8107D159C18690025
                                                                                                                                                                                                    SHA-256:FF994196D2BB0F3F749C9A6295CCD3317B3C8F153B7AA1F9CED78A083CA72223
                                                                                                                                                                                                    SHA-512:07E10EE64157F45101D2E8FEE8EFDC9F411CD283D5A25A418F0DFF578FB94916C1FC5631DDBAD63D42A25416B3B71B5B948E8498EA87DDE268B4E63B34F6EF25
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........v...%...%...%..w%...%.7D%...%.7q%...%..|%...%...%...%.7E%*..%.7u%...%.7r%...%Rich...%........................PE..L....[OX.....................(....................@..........................0............@.................................\*..d.......................@............................................$..@............................................text.............................. ..`.rdata...t.......v..................@..@.data....4...@......."..............@....rsrc................8..............@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-P9TA9.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):177216
                                                                                                                                                                                                    Entropy (8bit):6.910362272973599
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:pKiXfM0EZunzwimqWjJPo8LeEhANKl7FkGI07xmaVB9TBf5baT:oiX0L4nzoZANKT607xmaVB9TBBi
                                                                                                                                                                                                    MD5:2D8C8D7BEC612C2A1A0491E9A523FD0C
                                                                                                                                                                                                    SHA1:75F1A6C6EBA8FF1D9DC913C2611925692598FD4F
                                                                                                                                                                                                    SHA-256:0EE4E7023E17048A581368F2337DF4E67C8DD66ED616A8B06C86C3E1823657D0
                                                                                                                                                                                                    SHA-512:E8BEA855D6C674368BD896CC6E4EB1CE11461D390821E49055182AC82104C257AAA4B2F9BE2EEE40A2A95D6D9EA312988932C17EDC1D7F9EF0237223CE10926E
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................8h....z.l.....8j.....8_......_......g.......h....8^......8o.....8n.....8i....Rich...........................PE..L...BdOX...........!...............................o................................/.....@.........................P...........P.......................@...........`...................................@...............D...l...@....................text............................... ..`.rdata..M...........................@..@.data....1..........................@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-PH1HN.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):15936
                                                                                                                                                                                                    Entropy (8bit):6.473180362325704
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:GpsY5cnCsTmSHhV8voeeU4SzitnYPLr7PeBJ:GpsHn8S/8vdeUkC7Pe3
                                                                                                                                                                                                    MD5:5CE9A44FAAEC31DECA6CE7A368F6BE7F
                                                                                                                                                                                                    SHA1:9C526AC517E61E2DF15DD71C1E00B3075D3FC752
                                                                                                                                                                                                    SHA-256:4AD51A372F82EE11AC9B3C94903E5877E52659AC1519F471D4F8FBA04CB54B6D
                                                                                                                                                                                                    SHA-512:F0D49B742AF36685E77EEA2A858BCD187721648F1A35E465CDB002458D3BBCE194D9351A25DF3506064BDA299C8E2AF6C0BA8829CF7C4554D3850AEA48C641F2
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........R%^.<v^.<v^.<vW..v\.<vEx.v_.<vEx.v\.<vEx.v[.<v^.=vo.<vEx.vJ.<vEx.v_.<vEx.v_.<vRich^.<v........PE..L....[OX............................|........ ....@..........................`......L.....@.................................4#..P....@..T............&..@....P....... ...............................!..@............ ...............................text............................... ..`.rdata....... ......................@..@.data........0......................@....rsrc...T....@......................@..@.reloc.......P.......$..............@..B........................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-PP5E3.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):191552
                                                                                                                                                                                                    Entropy (8bit):6.744175386210352
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:KqGHPGleIOsEF+ySTk0Cl23+I0IXpcTBf8pdjZqMNj4HcezGN:tGvnsEOTknl23+I0gpcTBgvkYN
                                                                                                                                                                                                    MD5:9F8C5EAF561629D9323720ED6A80E9F8
                                                                                                                                                                                                    SHA1:A139AEE527417CBC6D8FBCD8107D159C18690025
                                                                                                                                                                                                    SHA-256:FF994196D2BB0F3F749C9A6295CCD3317B3C8F153B7AA1F9CED78A083CA72223
                                                                                                                                                                                                    SHA-512:07E10EE64157F45101D2E8FEE8EFDC9F411CD283D5A25A418F0DFF578FB94916C1FC5631DDBAD63D42A25416B3B71B5B948E8498EA87DDE268B4E63B34F6EF25
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........v...%...%...%..w%...%.7D%...%.7q%...%..|%...%...%...%.7E%*..%.7u%...%.7r%...%Rich...%........................PE..L....[OX.....................(....................@..........................0............@.................................\*..d.......................@............................................$..@............................................text.............................. ..`.rdata...t.......v..................@..@.data....4...@......."..............@....rsrc................8..............@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-Q65KF.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):21568
                                                                                                                                                                                                    Entropy (8bit):6.48227716192687
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:IodIxzB8AzVR8kIo1vLmiW9LEiGTHb6hVXbS7fLsD5bGGNET7T7T7T7L6yFoynPO:JdIxz2A4q1SiW9LEiGTHb6hVXbS7QbGM
                                                                                                                                                                                                    MD5:E02145CB2D7977FDBDF0142B8CDD3665
                                                                                                                                                                                                    SHA1:D4DBD6981679BCB51875CDD8531AB66D18072060
                                                                                                                                                                                                    SHA-256:A47F187DC087DC300367AFD0F60DB02069F15C81F0B6FD249A1D4EFD58A2AD17
                                                                                                                                                                                                    SHA-512:2CE312FA0392051D72DE75B70AB95F43B04278E9FB81CE80F8DC96C2799BCC7AE29ACA12675EE46DD7A593C48C1D336C392BD73B665E1EBF92734E9BE72364E5
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......D..3..`..`..`.E.`..`.E.`..`.E `..`...`..`..`2.`.E!`..`.E.`..`.E.`..`.E.`..`Rich..`........................PE..L...BdOX...........!.........".......#.......0.....o......................................@.........................0B.......<..x....`...............<..@....p.......0...............................;..@............0...............................text............................... ..`.rdata..&....0......................@..@.data........P.......2..............@....rsrc........`.......4..............@..@.reloc..&....p.......8..............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-QBLLD.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):164416
                                                                                                                                                                                                    Entropy (8bit):6.7703850324284405
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:dkCW5Se5+EaGPjPc4QclwUsoIHTKDS42jPie9s1sx:eC6Se5+EaG74TKm4uPias4
                                                                                                                                                                                                    MD5:B18115260C97A515963132BFF6F1D940
                                                                                                                                                                                                    SHA1:AD0482896D36EF1C4049DD156BD3F5EC88A046CF
                                                                                                                                                                                                    SHA-256:8880300161E17540EB4B63BFB0D190B4D5E4AD958E626195317D0234D985E2BD
                                                                                                                                                                                                    SHA-512:B2E4BDE770EDE6539E87F69BD09D64D43D38CC01B8F0519C903A5F7D0BC6796926E82A0E868949A9D5612AF2CBC61CCA9E65A29620D763C0C0D11EC2565252D5
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........#..cp..cp..cp...p..cp...p..cp.D.p..cp..bp..cp.D.p..cp.D.p..cp.D.p..cp.D.p..cp.D.p..cp.D.p..cpRich..cp........................PE..L...MdOX...........!................&..............m................................^.....@..........................?..h....9..<....`...............j..@....p...)..@................................8..@...............,............................text............................... ..`.rdata...`.......b..................@..@.data...0....P.......6..............@....rsrc........`.......:..............@..@.reloc...+...p...,...>..............@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-QGJIJ.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):159296
                                                                                                                                                                                                    Entropy (8bit):6.025878791890928
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:+ruq5zbJEeMW19gFbIFhgnkTj99TBfYEaf9zQ6NlI6xr:LgMcKUh2kLTBgEaf9zQ6Np
                                                                                                                                                                                                    MD5:62128FBE88671C6CBAC00B82E16F0071
                                                                                                                                                                                                    SHA1:F771617B24C5529543811C5513BEBBE1CF9E0529
                                                                                                                                                                                                    SHA-256:DCF4A425779F8BBB5085C156E7979FD1BBFA3EE0D9B8E39EAF20E058C7922B44
                                                                                                                                                                                                    SHA-512:86A4C7FD237040EDE2A666D9AF5770EE722B186A761A3491A811E8818C61D0038000A58990D0BA81EBC369A0ED8E6E977016A8F1C7FB70716EE1CB690228BB4A
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......ar.:%..i%..i%..i,kKi'..i.]@i&..i>.Di&..i%..in..i>.Fi ..i>.ri8..i>.si,..i>.Bi$..i>.Ei$..iRich%..i........PE..L....[OX............................J.............@......................................@..................................p..<....................V..@........... ...............................h6..@............q...............................text............................... ..`.rdata.............................@..@.data........P.......(..............@....idata..D....p.......8..............@....rsrc................B..............@..@.reloc...............J..............@..B........................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-QTCMC.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):15936
                                                                                                                                                                                                    Entropy (8bit):6.47578383777715
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:GpsY5Bnr2sLmSHhV8Uo1eet4SzvBanYPLr7/EJK:Gpsinr8S/8UNetJkC7OK
                                                                                                                                                                                                    MD5:AB263A4210AE7104C31E0179AAF09721
                                                                                                                                                                                                    SHA1:7B32F5A0D53FB5772A4D46B9572D4CA1BDD25FD7
                                                                                                                                                                                                    SHA-256:215A1F849B635529566449E9ECA76AC21ACFED1C2B79E4DD8C45986FF93A4D04
                                                                                                                                                                                                    SHA-512:4F187241CBC89AF7C80EE277B6DAA78BCCF18CD2D84637806EFDEA81D21127B5A593A390B65F60E75E71F56EC458E35F29767A604B92729BE21A3EA0E3BBE3AC
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........R%^.<v^.<v^.<vW..v\.<vEx.v_.<vEx.v\.<vEx.v[.<v^.=vo.<vEx.vJ.<vEx.v_.<vEx.v_.<vRich^.<v........PE..L....[OX............................|........ ....@..........................`............@.................................D#..P....@..h............&..@....P....... ...............................!..@............ ...............................text............................... ..`.rdata....... ......................@..@.data........0......................@....rsrc...h....@......................@..@.reloc.......P.......$..............@..B........................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-QTFL4.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):207424
                                                                                                                                                                                                    Entropy (8bit):6.64291956597798
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:6144:iw/LSFAn1V6nC2E04bKcbPQa6OB1njm1P39HnY0ix:iw/LSG1h2E0mKcEjY0y
                                                                                                                                                                                                    MD5:4C7A9B695DFA9E768270B0EA93F827FD
                                                                                                                                                                                                    SHA1:FDBAFF79D649B57281CF2145BE758085F2B2E441
                                                                                                                                                                                                    SHA-256:10547D3D1803B7FA6F7DF5C4E52B2B80F8D8ACD78DDDE2B581018F42E00309C0
                                                                                                                                                                                                    SHA-512:8D47BB5FCC6190647ED01C32389DDC8DB8C569111661928EFF61001CF8C7D5B07034D75D057A15039A8FBAFA7DE577CBDEF7934AA45F35279055364C78D3914A
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........D.*...*...*.......*.......*.;....*.......*.......*...+...*.......*.......*.......*.......*.......*.......*.Rich..*.........................PE..L...RdOX...........!.........>.....................o.........................P.......>....@............................................................@......../...................................C..@...............|...........................text...O........................... ..`.rdata..............................@..@.data....-.......&..................@....rsrc...............................@..@.reloc...6.......8..................@..B........................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-RFJLV.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):27712
                                                                                                                                                                                                    Entropy (8bit):6.629316342102385
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:768:1WeFz9Yu22rM0Z6uHB72ZWreX06OMi423nDIN5sgvYWW/2YSXqqzTgNj2Qdq2jCs:1WW296eAj2d2+Y
                                                                                                                                                                                                    MD5:A725581D6C80BC5D204379FC2BDC0E04
                                                                                                                                                                                                    SHA1:FDA84702E40CCD52D565D07697DF2F36624A2E42
                                                                                                                                                                                                    SHA-256:1FF9875CCA81E82221CFDA40EA2A3FB1176120662945D1019931ACBADE56775A
                                                                                                                                                                                                    SHA-512:DFFB52EDA5A2C856004C8DC8A0FE01DAFE8D72D8E748E7D693E5C7D3B0203DDD9BF463C1AFDA989BF66F7AED4B6B94FCA73B8E1B586E9E40325DD96B2CD36D4E
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............q...q...q.......q.......q.......q...q...q....=..q....<..q.......q.......q.......q..Rich.q..........................PE..L...XdOX...........!.....6...$.......?.......P.....o......................................@.........................0Y.......S.......p...............T..@.......0....Q...............................R..@............P...............................text...v4.......6.................. ..`.rdata.......P.......:..............@..@.data...L....`.......J..............@....rsrc........p.......L..............@..@.reloc...............P..............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-RHOV8.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):186944
                                                                                                                                                                                                    Entropy (8bit):6.611946209956476
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:SP6DHprimIoybZ6jpLbPJNJEcO09ccffPSBHab3YoDIx:SPWphe69/PJXEc/yc3PSYI5
                                                                                                                                                                                                    MD5:3C397EC3D573997FE4D6FF487D91A2F9
                                                                                                                                                                                                    SHA1:A01EE12A84D21B582CFD5331B9DF5D98FCD0FE53
                                                                                                                                                                                                    SHA-256:29CC5D8ADE3B798302C041CB3153E5F446879DC8D347329020688F5824C8A557
                                                                                                                                                                                                    SHA-512:32650071677A8EF93989DFCA61749621C77AE4DE082184F2FB7174C0BCAE2B889F48DC4A22B2B06EA2523A9836F28D001B404165197AF43F8711412AC8D6FF48
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B.+.#.x.#.x.#.x.mGx.#.x..Ax.#.x..ux3#.x.[Lx.#.x.[\x.#.x.#.x #.x.Utx.#.x..tx.#.x..Dx.#.x..Ex.#.x..Bx.#.xRich.#.x................PE..L...TdOX...........!................k........ .....o......................................@.....................................d.......................@............"...............................f..@............ ..P...<|.......................text...|........................... ..`.rdata...m... ...n..................@..@.data....5...........z..............@....rsrc...............................@..@.reloc...%.......&..................@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-RLB9D.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):15936
                                                                                                                                                                                                    Entropy (8bit):6.461148159920509
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:Gpsf3nDAsimSHhV8wSees0fnYPLr74kMf:Gpsf3nzS/8wfesSC74
                                                                                                                                                                                                    MD5:9F5FA433B4892218EEAE24C79126EEB3
                                                                                                                                                                                                    SHA1:BA5A52386BDFAF3BA79BDC138624F65A288C5BF0
                                                                                                                                                                                                    SHA-256:9D55FDDAAF113FDDB28F70A965DCD3FA136AF8336A1F89082CFD7A69E3CFBA02
                                                                                                                                                                                                    SHA-512:6D09E3AAB4BE308FEF0464529968054BACA10441F0470C893ECA169573F4D9BC72A57A910089BACA4639BE9A1EC9FF80EC065A0626A25CEF831678CFE22167BF
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........R%^.<v^.<v^.<vW..v\.<vEx.v_.<vEx.v\.<vEx.v[.<v^.=vo.<vEx.vJ.<vEx.v_.<vEx.v_.<vRich^.<v........PE..L....[OX..................................... ....@..........................`............@.................................."..P....@..\............&..@....P....... ...............................!..@............ ...............................text............................... ..`.rdata..j.... ......................@..@.data........0......................@....rsrc...\....@......................@..@.reloc.......P.......$..............@..B........................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-RODTM.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):145984
                                                                                                                                                                                                    Entropy (8bit):6.690501176691597
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:Pst3E0KkDBMUwgLlevLVnTmD7DBSndvinxQildB2tVonELM:Pst3EWKvulevLx6DvB/xQildB0VoEI
                                                                                                                                                                                                    MD5:EF6413CBD73BF706CCD9EC45A6E23E39
                                                                                                                                                                                                    SHA1:0BDB6F07D55E1927134883E0382C46FD91C143D3
                                                                                                                                                                                                    SHA-256:9D95566FCB03BF04CC6E37D1C2ADD6689787493B1661D1631D0CDFC2B98C148C
                                                                                                                                                                                                    SHA-512:6F6B0E28E99E3BC452D3AF6CB852A4616BE003F44ED87426C8E5CB645395017571B619B09C23106B00EA32E0FABA3C4466A87C7ED8575EE39AF6B8DAEDC05710
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........:.j.i.j.i.j.i..5i.j.i..8i.j.i...i.j.i..:i.j.i.j.i.j.i...i.j.i..=i.j.i..<i.j.i..;i.j.iRich.j.i................PE..L...UdOX...........!.........P......)..............o.........................`............@.........................."..X.......P....@..............."..@....P..........................................@............................................text...N........................... ..`.rdata...9.......:..................@..@.data........0......................@....rsrc........@......................@..@.reloc..4....P......................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-RR4DS.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):70208
                                                                                                                                                                                                    Entropy (8bit):6.353194726218584
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:768:pFVfr2k521ZnrawwMmqPXt+rPsb/9/YMCH0OpPOrEE14iVHLAuDeGJiqrmehiVSV:lxioMmqF+70MOR9Vq7qjh3rmKPNewuI
                                                                                                                                                                                                    MD5:E9383995672CF0B911AD652A2D5469CF
                                                                                                                                                                                                    SHA1:6B3A5FF1EF9950C627DD6ECA3179074291BA8EAC
                                                                                                                                                                                                    SHA-256:DB776CA0FD3E9EDF8B36FB5EFE7730D9A43C3DCFF1A6AA3CB21408CD9EFD8D3C
                                                                                                                                                                                                    SHA-512:08744D6CC9F93415BF1994A99B7CC8AA5E0E59201B3EFD8E44A741F0615481DF8135E6AE2A847776E838A98AF9AE978D1C2D3D7D017F3AF33EB6E19D3D6E42FD
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........._...1...1...1..9....1.j...1..9....1..9...1.....1...0.q.1.....1..9....1..9....1..9....1.Rich..1.................PE..L...^^OX.................B...........B.......`....@..........................@.......k....@..................................}..x.......................@....0.......b...............................u..@............`......@{.......................text...,@.......B.................. ..`.rdata..x'...`...(...F..............@..@.data................n..............@....rsrc................p..............@..@.reloc.......0......................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-RRNSM.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):191552
                                                                                                                                                                                                    Entropy (8bit):6.744175386210352
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:KqGHPGleIOsEF+ySTk0Cl23+I0IXpcTBf8pdjZqMNj4HcezGN:tGvnsEOTknl23+I0gpcTBgvkYN
                                                                                                                                                                                                    MD5:9F8C5EAF561629D9323720ED6A80E9F8
                                                                                                                                                                                                    SHA1:A139AEE527417CBC6D8FBCD8107D159C18690025
                                                                                                                                                                                                    SHA-256:FF994196D2BB0F3F749C9A6295CCD3317B3C8F153B7AA1F9CED78A083CA72223
                                                                                                                                                                                                    SHA-512:07E10EE64157F45101D2E8FEE8EFDC9F411CD283D5A25A418F0DFF578FB94916C1FC5631DDBAD63D42A25416B3B71B5B948E8498EA87DDE268B4E63B34F6EF25
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........v...%...%...%..w%...%.7D%...%.7q%...%..|%...%...%...%.7E%*..%.7u%...%.7r%...%Rich...%........................PE..L....[OX.....................(....................@..........................0............@.................................\*..d.......................@............................................$..@............................................text.............................. ..`.rdata...t.......v..................@..@.data....4...@......."..............@....rsrc................8..............@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-RUP3V.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):453184
                                                                                                                                                                                                    Entropy (8bit):6.51900631640757
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:6144:+6rAUVejS41QaMu+2pZw57K0DlFXaz5MLXc/RaemBwTFOBfjPuvxIW1MSjA:+6EUVsSKfMu+2pZwJLEJaemBPuvq+MS8
                                                                                                                                                                                                    MD5:B723948223F1912F0FFC12D8BAFDBBF9
                                                                                                                                                                                                    SHA1:A8098C3F968903C50DA5F5DDCBB37D156E6C9B47
                                                                                                                                                                                                    SHA-256:5FEC252360C6F156820DE8332F84F990EA3A17045299B07A23F8007227CA2546
                                                                                                                                                                                                    SHA-512:769858D18D31791B1E3DCE648FB4458D45C44FA526D2B178DD3E91359B39BA0D89AE56A6D9EDE133B036C373A88DACB1181B20135C97EE8DE67A8419C620123B
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........T...:...:...:.......:.e....:......:......:.....:....:....:...;.`.:......:.......:.......:.......:.Rich..:.................PE..L...BdOX...........!.........:......>.............Xm.................................@....@.........................@....6..............................@........8..................................Xh..@...............X...8........................text.............................. ..`.rdata...;.......<..................@..@.data...............................@....rsrc...............................@..@.reloc..\E.......F..................@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-S1BEV.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):51264
                                                                                                                                                                                                    Entropy (8bit):6.566239798664522
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:1536:as+mn0yrrdv14NVnsXC76G8Y2i4UqASi/wF:asfn3LOay+G8Y2iDqAFS
                                                                                                                                                                                                    MD5:741AD004E3B11B6A1C6A089ACEFE0109
                                                                                                                                                                                                    SHA1:8144144E27B4A6BD348ECCC6A1A35A113D37EF3E
                                                                                                                                                                                                    SHA-256:79947E56B8AD1256F07107194112E6CA94D3B51812034C0BBA49C277DB1B6014
                                                                                                                                                                                                    SHA-512:7D8CEA8B1EABAB2A435141641DACFDF1F5F0A85038F46B0BAD11C7D4AABA2754D3950F13C12011C99664E8D2185B9A644CCA61CCE97328D5D4A3C3AB72D68EC6
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......J!...@..@..@...@..@...u..@...B..@..@..@..8M..@...t..@...E..@...D..@...C..@.Rich.@.........PE..L...BdOX...........!.....V...Z......9_.......p.....o................................c.....@..............................+..L|..........................@.......t....r...............................{..@............p...............................text...TT.......V.................. ..`.rdata...F...p...H...Z..............@..@.data...(...........................@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-TES04.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):473152
                                                                                                                                                                                                    Entropy (8bit):5.528589615049839
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:6144:0CrIfR5ApLfU6Nb4rxNXMwy5C6YEmYDqneyuRvdLY+RNBu0GxH:FkfUJs6Nb4rUwyxYEmYmeyu1oxH
                                                                                                                                                                                                    MD5:21B8DA80D65276AE5511858525FCCC88
                                                                                                                                                                                                    SHA1:A47BA73456EDD43CB638945DF3B80209473A252F
                                                                                                                                                                                                    SHA-256:E124CF7232981D211F5670647B123EF669BCA36C3D6BDFBA225F44168D18A594
                                                                                                                                                                                                    SHA-512:EE1B055B59B284DF4D7A600BB664F2AF258F6AE86ECE18BB7290F2720F2626BEB4678D36A500962A25AF7BF09B57B2E9644B79E2E2A7C7FD53FEC98A90B0780D
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......@.....@..@..@..4@..@.u2@..@.u.@..@../@..@..?@..@..@:.@k..@..@.u.@\.@.u7@..@.u6@..@.u1@..@Rich..@........PE..L...BdOX...........!.....^........... .......p.....o.........................p......E.....@.........................0D.......+...........s........... ..@.... ..46...t..................................@............p.......(.......................text...l\.......^.................. ..`.rdata.......p.......b..............@..@.data....I...P...*...8..............@....rsrc....s.......t...b..............@..@.reloc...H... ...J..................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-THDCJ.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):97856
                                                                                                                                                                                                    Entropy (8bit):6.474274181080949
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:1536:M90yNLbRcbcqgkvZx4iDLvB+k0toX5Oo4ZkS8PAk8Gq8i9RBcszF:GRXkvZxpLv0oOoMfk8GW3BLzF
                                                                                                                                                                                                    MD5:C348CD5D964585C7B639BC1DFD150471
                                                                                                                                                                                                    SHA1:A9FBCCDFF79482EEBFE895BEA1AD32BFE66EE563
                                                                                                                                                                                                    SHA-256:FCB29D0E47F48176D38BB1E1074F1BD8C48FF6349855E227DBEA5005B24F72F9
                                                                                                                                                                                                    SHA-512:BE3507A511E88F42B3C2154AAE862EACC57E50A94FE47463FE6EBC36F834399C06465A38858CD302EB3DFF1F84B8944D4482F854D16551CA417B3F35D8C4ABB5
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......./zR/k.<|k.<|k.<|p..|{.<|p..|2.<|bc.|n.<|k.=|7.<|p..|O.<|p..|j.<|p..|j.<|p..|j.<|Richk.<|........................PE..L...BdOX...........!................At.............o.................................@....@..........................9..A....1..<....................f..@............................................,..@...............@............................text...\........................... ..`.rdata..Qg.......h..................@..@.data...`,...P.......8..............@....rsrc................F..............@..@.reloc..J............N..............@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-TJRKV.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):109120
                                                                                                                                                                                                    Entropy (8bit):5.9869354559938515
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:1536:IE9WcstxlDgZ9EYDKg0nc6N3Mi+EpOBfo+SPVTVv:PhspgZPDanhP+EpOBw+SPzv
                                                                                                                                                                                                    MD5:964F57CEAC35386E0A73ABCB5569B50B
                                                                                                                                                                                                    SHA1:9AD4C1C37EC3EE4670148E65F4EAEDC699626D9C
                                                                                                                                                                                                    SHA-256:CCE1E5E82E04BC464C93E39573657F4D786965F12C10412577A7545CA7FF2750
                                                                                                                                                                                                    SHA-512:EAB0D2394E3E3BBA2EE60BF6299D4004493F1CE8398AE39BD52B92F18A3D3EF9E72AC086F16670A16C27C3DA4208C511A8B84915A1E4E5ACBCC289D7E696CF3E
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ot....Z...Z...Z..Z...ZC@.Z...Z..Z...Z..Z...Z.v.Z...Z.v.Z...Z...Z...Z.x.Z...Z..Z...Z..Z...Z..Z...Z..Z...ZRich...Z........................PE..L...AdOX...........!..............................~m......................................@.........................P...J............0...t..............@...........P...............................0...@............... ...d...`....................text............................... ..`.rdata...D.......F..................@..@.data...0...........................@....rsrc....t...0...v..................@..@.reloc...............|..............@..B........................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-TTFAR.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):446528
                                                                                                                                                                                                    Entropy (8bit):6.602914880166649
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:12288:KP+a1CtswnTrxYYCOO/H0Aw4+pfyptfiP+AeDyPKX8pGSvlgl:KPh1CP7pUyPKX8pvlgl
                                                                                                                                                                                                    MD5:0A6FA5CEA5289578E884DFD876AB9A5F
                                                                                                                                                                                                    SHA1:EFF846F977E55D354E405F98E62D95AF40C42025
                                                                                                                                                                                                    SHA-256:6147B83DBA649BF0AFC8F524FC205E766E492748EEB2B6EE9AADBFFBC39C20CB
                                                                                                                                                                                                    SHA-512:52068BF75BF6A8C4CD819B37EF9AB93E2DAECFA5BDF2AF756C1766331A4FEAAFAFC255347F5B069BEA57658DBC68216AF3325869695CFC425AD09592D676F96C
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........f.4Z..gZ..gZ..g.}g^..gWUggX..gWUeg\..gWUZgW..gWU[g_..g..qg]..gZ..g...g'~Zg~..g'~[g...g'~fg[..gWUag[..g'~dg[..gRichZ..g........PE..L...GdOX...........!..............................m......................................@.........................@..........d.......................@........%...................................\..@...............,............................text...{........................... ..`.rdata..............................@..@.data...............................@....rsrc...............................@..@.reloc...%.......&..................@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-U5GQQ.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):123968
                                                                                                                                                                                                    Entropy (8bit):6.729931472912285
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:1536:FWHL4PUZ753HqpHBbq4pRdRoqgilgKptxG0ULtt1vVcn4MC0cn4MCqcn4MCZlcn7:Kpt5kq4pRVgiPe5vV/0/q/Zl/javgKRT
                                                                                                                                                                                                    MD5:35A9F5C0BF99937DE7C4B1F9CD97F3E5
                                                                                                                                                                                                    SHA1:AAFCA1D129ACE42FAD49F9A4772F7F841990D729
                                                                                                                                                                                                    SHA-256:B63423E5EC378CACF8977651AC0E66E4CBA6A35E65970E2F284C6C809410BCD7
                                                                                                                                                                                                    SHA-512:24AA5E9C1FDBF113B931F8533B55497FC5F8AD20AACA17F8828DFA4404004EEBE27B93587C1D6CFD4FB1F6204552DCA13F67FBCABC656FE8E7D121F46E7192BD
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......y..@=..=..=..4.1.?....:.<..&G>.>..=.....&G<.:..&G..>..&G.....&G9.<..&G8.<..&G?.<..Rich=..................PE..L...CdOX...........!................. .......0.....o......................................@.........................`...:...L...<.......................@............0..................................@............0...............................text............................... ..`.rdata.......0......................@..@.data...............................@....rsrc...............................@..@.reloc..>...........................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-U9P83.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):16448
                                                                                                                                                                                                    Entropy (8bit):6.391862720953825
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:GpseZwnvNocs0DmSHhV86Eee1cGXnYPLr7t4F:GpseqnFoE6S/86hebC7t4F
                                                                                                                                                                                                    MD5:5D883A670304684DAC4CE788DC866DC2
                                                                                                                                                                                                    SHA1:3EE8067AF2F600E6E4E6AA699BB69C1788383E5A
                                                                                                                                                                                                    SHA-256:43AB1C4D1D9676ADAD12C199A94A25EFC0AEF252A5DA9DEEC2864C3C32D46B6A
                                                                                                                                                                                                    SHA-512:355D34AF360F7CF9AFF9EE388D1C94D6B60F6F2667D42B18DC397CBED0EA0EB71A87BD3EFDFE1C894E6AE136E9D90E350415B5817A13AD4878EED17CA35C09CE
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........R%^.<v^.<v^.<vW..v\.<vEx.v_.<vEx.v\.<vEx.v[.<v^.=vo.<vEx.vJ.<vEx.v_.<vEx.v_.<vRich^.<v........PE..L....[OX............................z........ ....@..........................`......E.....@..................................#..P....@..\............(..@....P....... ..............................."..@............ ...............................text............................... ..`.rdata..J.... ......................@..@.data........0......................@....rsrc...\....@......................@..@.reloc.......P.......&..............@..B........................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\is-V5RFN.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):39488
                                                                                                                                                                                                    Entropy (8bit):6.742820030986535
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:768:O7nlMXDgL2YoOBAMUnwBASqG67o+qVDh63sZOnd0TPqC7Y9:O7lMzgXAeTT6uOuzDY9
                                                                                                                                                                                                    MD5:6448CD1CC4B46CAF776A7F55A6CE15EA
                                                                                                                                                                                                    SHA1:A49A6CA2E39F7486CB7673A7B1142854D4992FF0
                                                                                                                                                                                                    SHA-256:418452AF6B736ED3481BED2DF632762386956513FDFF6AFF857A89EEE7EAB4E9
                                                                                                                                                                                                    SHA-512:6ACD2534E48A125A25D7401A67E1E0836CF60E9B38CA6372BCE68464AE8B457C849DC1278367D252C1189E82CC430E9F6643F395C68BA374C900E5B52A01A721
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......W.d....]...]...]...]...].H.]...].H.]...].H.]...]...]_..].H.]...].H.]...].H.]...].H.]...]Rich...]........................PE..L...BdOX...........!.....N...4.......W.......`.....o................................jL....@.................................<x..P.......................@...........Pa...............................v..@............`..<............................text....L.......N.................. ..`.rdata..e!...`..."...R..............@..@.data...(............t..............@....rsrc................v..............@..@.reloc...............z..............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\j2pcsc.dll (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):16448
                                                                                                                                                                                                    Entropy (8bit):6.489931006106194
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:192:QbMJRa/RbY0pF89SSSQzDY3X3PVR6ygjzqpjybbU4nYe+PjPriT0fwsJEBwy:QbMJqfaS6zDonPV5gyBybbBnYPLr7wOy
                                                                                                                                                                                                    MD5:9643FFC9C7D6F1F548F56BBCC9C88221
                                                                                                                                                                                                    SHA1:89B911E77059ECFFCFD4CC46E5C3CAF13EC7E8C5
                                                                                                                                                                                                    SHA-256:5029BED56FA976D279144D365FEF5045EAD3D69CECD88DBAA67308F5D2B9711F
                                                                                                                                                                                                    SHA-512:C31E2C2BF1D180A50F34E43A6F337706ED7DCC2A12C134B35F3E8376AFC3742750EA219BA1F5887090C104EC843C29C2B2C55685797A22BD703D9627DA6BBFEA
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3...w.x^w.x^w.x^...^v.x^l..^u.x^l..^u.x^l..^u.x^~..^r.x^w.y^[.x^l..^y.x^l..^v.x^l..^v.x^l..^v.x^Richw.x^........PE..L...AdOX...........!.........................0.....m.........................p......8.....@..........................7.......2..P....P...............(..@....`..`....0..............................`1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...h....@....... ..............@....rsrc........P......."..............@..@.reloc.......`.......&..............@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\j2pkcs11.dll (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):51264
                                                                                                                                                                                                    Entropy (8bit):6.578462341166279
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:1536:FrOHh9t7/GAzqHcGxAnMRrZT9ixHDyo/r0rV9LrBH1bjPEwhEdheBwHWQFgE/Xu2:l+9t7/qHcGv1Xt/i
                                                                                                                                                                                                    MD5:991743210DEDC8FD20BA130071257769
                                                                                                                                                                                                    SHA1:0A7344B66A70360A3406524E26D2368397C8CAED
                                                                                                                                                                                                    SHA-256:FD2F996B930EE9BB597AF6FBB2DB9DEF2063752CEE906C74C415F32FA312D7B1
                                                                                                                                                                                                    SHA-512:8BFAF9974C10817B55492A82C5475841B83B2E079F74DC74EDB0FC7E4CBDC800DA0080634CBCA1C4147E17DB4358DDA6DF10E4234B0FFEF5882D0E5AC20C26CB
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......O^;w.?U$.?U$.?U$.G.$.?U$...$.?U$.?T$&?U$...$.?U$...$.?U$...$.?U$...$.?U$...$.?U$...$.?U$Rich.?U$........................PE..L...AdOX...........!.....v...8......l..............m................................E.....@.............................u...l...<.......................@.......................................... ...@............................................text...~t.......v.................. ..`.rdata...&.......(...z..............@..@.data...............................@....rsrc...............................@..@.reloc..V...........................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\jaas_nt.dll (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):19520
                                                                                                                                                                                                    Entropy (8bit):6.44944953930419
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:4EkF/QP8xkI6DgWIE0PVlXHSZlnYPLr7O7ho8c:4FqP7I61kdByPC7O7hoV
                                                                                                                                                                                                    MD5:4857C5578655DDA0A3A49873318B55AB
                                                                                                                                                                                                    SHA1:D208DF1ABE40C64EAF9D8DC579111218765E5563
                                                                                                                                                                                                    SHA-256:07748ADFF44390AEE7B5D1F4A168C9276D5FC8C1E187E17D4B505B91549B9B9A
                                                                                                                                                                                                    SHA-512:0048E88115D8790CB010021473B1D924975FFD5C733A2180A93F3D8EE975A9540EABADEF993F1BD8AC8CA3D86F50181C6DBCEBAF36E614435B24AD8C3A99E848
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......."..|fl./fl./fl./}.(/dl./}.*/gl./}../dl./o.'/al./fl./_l./}../kl./}.//gl./}../gl./}.)/gl./Richfl./................PE..L...BdOX...........!.........................0.....m.........................p......6!....@..........................=.......8..d....P...............4..@....`..\....1...............................6..@............0...............................text............................... ..`.rdata..w....0......................@..@.data...`....@.......*..............@....rsrc........P.......,..............@..@.reloc.......`.......0..............@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\jabswitch.exe (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):30784
                                                                                                                                                                                                    Entropy (8bit):6.4133234051058725
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:768:rHhfWinfwUFAvnbMTIUY+naSOu9YiQ5aiC7uQ:tuin5FAvATIUY+nbYiQ5Yr
                                                                                                                                                                                                    MD5:68417B588D482A945EA48C9F90AF26C2
                                                                                                                                                                                                    SHA1:CD851EB4C3818E95ACA4523771CEAD06337C3B05
                                                                                                                                                                                                    SHA-256:2E31D26B8DD5CECEFE93ABFC8201483AB29031A13C7DC850DAEA71B482F2B2BF
                                                                                                                                                                                                    SHA-512:27755E1BA693FB7419B85E9695134A3D3113A94449F28AA2DB5C4D81E26C77772B4788F943873A0A80C36B59DE6529473411950D7AC87B4B796670842D85B232
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............I...I...I..HI...I..JI...I..~I...I..GI...I...I..I...I...I..NI...I..II...IRich...I........PE..L....[OX.................0...,.......1.......@....@..................................v....@.................................dR..x....p...............`..@.......t....A...............................P..@............@..p............................text............0.................. ..`.rdata.......@.......4..............@..@.data........`.......N..............@....rsrc........p.......P..............@..@.reloc..p............Z..............@..B........................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\java-rmi.exe (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):15936
                                                                                                                                                                                                    Entropy (8bit):6.461148159920509
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:Gpsf3nDAsimSHhV8wSees0fnYPLr74kMf:Gpsf3nzS/8wfesSC74
                                                                                                                                                                                                    MD5:9F5FA433B4892218EEAE24C79126EEB3
                                                                                                                                                                                                    SHA1:BA5A52386BDFAF3BA79BDC138624F65A288C5BF0
                                                                                                                                                                                                    SHA-256:9D55FDDAAF113FDDB28F70A965DCD3FA136AF8336A1F89082CFD7A69E3CFBA02
                                                                                                                                                                                                    SHA-512:6D09E3AAB4BE308FEF0464529968054BACA10441F0470C893ECA169573F4D9BC72A57A910089BACA4639BE9A1EC9FF80EC065A0626A25CEF831678CFE22167BF
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........R%^.<v^.<v^.<vW..v\.<vEx.v_.<vEx.v\.<vEx.v[.<v^.=vo.<vEx.vJ.<vEx.v_.<vEx.v_.<vRich^.<v........PE..L....[OX..................................... ....@..........................`............@.................................."..P....@..\............&..@....P....... ...............................!..@............ ...............................text............................... ..`.rdata..j.... ......................@..@.data........0......................@....rsrc...\....@......................@..@.reloc.......P.......$..............@..B........................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\java.dll (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):127040
                                                                                                                                                                                                    Entropy (8bit):6.803901404249545
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:SeaQK12mW/peEXhPZSifrzahsIn/vsNrwJdG3kz9m:pK1sPZPdC0e9m
                                                                                                                                                                                                    MD5:D2AA977E549AACFE82F4C20DBA14D231
                                                                                                                                                                                                    SHA1:D9ED19AB15A685ACB4E285A7EDE540EE668047CC
                                                                                                                                                                                                    SHA-256:21DA10C45206C5535FCBE5278886869561D0B0DCF9FAF1F16AACA5B323856CFB
                                                                                                                                                                                                    SHA-512:498BFD3257586CC21B39E8D4CE8F20118615E89D72AD079F7BCAEA7BDD8C1A695AB5C5BE8A6200249EBDE5CE75528E8FD1C2F81F2610F319B61181C6A718B901
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........!..r..r..r.W.r..r.W(r..r...r..r..(r..r...r..r.W.r..r..r..r.W)r..r.W.r..r.W.r..r.W.r..rRich..r................PE..L...CdOX...........!..... ...........*.......0.....m.................................Z....@.........................@u...B...U..........................@....... ....5...............................S..@............0......\U..@....................text............ .................. ..`.rdata.......0.......$..............@..@.data...............................@....rsrc...............................@..@.reloc..h...........................@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\java.exe (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):191040
                                                                                                                                                                                                    Entropy (8bit):6.750064335659946
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:3C41UmIXZO4TsRjcUizRQrQBMWKm/3TBf8/LjZqMNqyqovZc:y4+XsRjAzqrQBMWL/3TBAvtqP
                                                                                                                                                                                                    MD5:068F32452896883AC346F82C0F3C4652
                                                                                                                                                                                                    SHA1:CA384CC7786818ADC92EC9A38CFCAAAD0FBD0EAB
                                                                                                                                                                                                    SHA-256:5AFB5DF8C32E760EC9113F3F94EB641ADD98A595A84EA825E2300E5EF4E7E9B9
                                                                                                                                                                                                    SHA-512:502A19D59BAB7D27E88BFFA101DF6A40ED3B54E90F3343972833EA98D88A70C3960778730955AF3616396BE2DC7612ACFD72AE1139E7E6590650961D26B966B7
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........+H..E...E...E.L.....E..E....E..E....E......E...D...E..E..{.E..E....E..E....E.Rich..E.........PE..L....[OX.....................&....................@..........................0......2.....@.................................L*..d.......................@............................................$..@............................................text...n........................... ..`.rdata...s.......t..................@..@.data....4...@....... ..............@....rsrc................6..............@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\java_crw_demo.dll (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):23616
                                                                                                                                                                                                    Entropy (8bit):6.618680932232422
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:Tp2dG5pC/ujTc8ZrEnrZm8WXbEnPV5niLQVnYPLr7Yb7G:fvCGjJ0Q8ndYLIC7YHG
                                                                                                                                                                                                    MD5:1A0A8C7BAC65D3655B39CF9B7EAD4F5A
                                                                                                                                                                                                    SHA1:39432B42ECFF57361C1D97273B5EB54A368B640D
                                                                                                                                                                                                    SHA-256:7438A6D79019E645BBCAFF7C21E83943642B6C9E1DF61C15631C71548730E3C1
                                                                                                                                                                                                    SHA-512:6C8E61C678525DAF66208BCCEB5F86BF517A5CDD780C39A97F319E854F284116C11B1299DC195FF37827F0E1CDDE6D83E2A660DCDC3C730D99CEADF554989E6F
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......2..v...v...v.....+.t...m'$.u...v...\...m'&.w...m'..t...m'..{...m'#.w...m'".w...m'%.w...Richv...................PE..L...IdOX...........!.....*...........4.......@.....m......................................@..........................I..|....E..<....`...............D..@....p.......@...............................D..@............@...............................text....).......*.................. ..`.rdata.......@......................@..@.data...(....P.......:..............@....rsrc........`.......<..............@..@.reloc..^....p.......@..............@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\javacpl.cpl (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):160256
                                                                                                                                                                                                    Entropy (8bit):6.469605160049269
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:/2lpElIhbyyH3c1CX766zKELxKZDqOSnjZqMNolGl2:/2rE+xdW+76DEVKZHwv
                                                                                                                                                                                                    MD5:81D7B975684B0669A2EDDFC26444F773
                                                                                                                                                                                                    SHA1:691C7B4A0027CEEE617908E8D8CCA803546E6FCF
                                                                                                                                                                                                    SHA-256:71869824A1073745D81775BE8A5993B2C76C0804A7B09653F3B003A82B47AD41
                                                                                                                                                                                                    SHA-512:208827E244E37F59FE064ED54DBE89262D6E3D108E31109415726EF8F53624DDF27E119866B72952E7BF239DA21A1B4B91F03750402FE97CE40CDCBB8563A783
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......d6.. We. We. We.;...9We.;...We.)/..)We. Wd..We.O!.(We.;...We.;...!We.;...!We.;...!We.Rich We.........................PE..L...X^OX...........!.....r...........q....................................................@.............................Z.......d.... ..............................@...................................@............................................text....p.......r.................. ..`.rdata..jH.......J...v..............@..@.data...,3..........................@....rsrc........ ......................@..@.reloc..@............T..............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\javacpl.exe (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):70208
                                                                                                                                                                                                    Entropy (8bit):6.353194726218584
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:768:pFVfr2k521ZnrawwMmqPXt+rPsb/9/YMCH0OpPOrEE14iVHLAuDeGJiqrmehiVSV:lxioMmqF+70MOR9Vq7qjh3rmKPNewuI
                                                                                                                                                                                                    MD5:E9383995672CF0B911AD652A2D5469CF
                                                                                                                                                                                                    SHA1:6B3A5FF1EF9950C627DD6ECA3179074291BA8EAC
                                                                                                                                                                                                    SHA-256:DB776CA0FD3E9EDF8B36FB5EFE7730D9A43C3DCFF1A6AA3CB21408CD9EFD8D3C
                                                                                                                                                                                                    SHA-512:08744D6CC9F93415BF1994A99B7CC8AA5E0E59201B3EFD8E44A741F0615481DF8135E6AE2A847776E838A98AF9AE978D1C2D3D7D017F3AF33EB6E19D3D6E42FD
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........._...1...1...1..9....1.j...1..9....1..9...1.....1...0.q.1.....1..9....1..9....1..9....1.Rich..1.................PE..L...^^OX.................B...........B.......`....@..........................@.......k....@..................................}..x.......................@....0.......b...............................u..@............`......@{.......................text...,@.......B.................. ..`.rdata..x'...`...(...F..............@..@.data................n..............@....rsrc................p..............@..@.reloc.......0......................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\javafx_font.dll (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):57408
                                                                                                                                                                                                    Entropy (8bit):6.67262433613941
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:768:/g/KC7qdFarGYmLP8FnqsdlxkJavvo8N+hwBBwaa3rpe8ZmI6aSTGBqwiw8E2ISl:m6arRmcnq2lxm+Na6C7HITeT8E2p/wS7
                                                                                                                                                                                                    MD5:91B1CA2FAE5D877F561C39FDBD3B620F
                                                                                                                                                                                                    SHA1:28DE0E055C50FF31F77AAE4937B1F72C5617BE75
                                                                                                                                                                                                    SHA-256:106A02DB62D616C9C3677350F72D1FCC74D15BE3B13FE0CCF4D209ACD531D7D6
                                                                                                                                                                                                    SHA-512:1E1201165DDB9531D9F8A51C5190C487BC03B554E72E4D86C0F4D713FB6A0805869DD377CF8E58B555C236F6D8F5659C86B115873E5DD482C06C1ED03AA519BE
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................I2.......(.......*.....................\.:.....\.>...............................)...............+.....Rich............PE..L...FdOX...........!.....r...V.......w.............m................................W.....@.........................@...x...............................@.......8.......................................@...............4............................text....p.......r.................. ..`.rdata...@.......B...v..............@..@.data...............................@....rsrc...............................@..@.reloc..8...........................@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\javafx_font_t2k.dll (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):446528
                                                                                                                                                                                                    Entropy (8bit):6.602914880166649
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:12288:KP+a1CtswnTrxYYCOO/H0Aw4+pfyptfiP+AeDyPKX8pGSvlgl:KPh1CP7pUyPKX8pvlgl
                                                                                                                                                                                                    MD5:0A6FA5CEA5289578E884DFD876AB9A5F
                                                                                                                                                                                                    SHA1:EFF846F977E55D354E405F98E62D95AF40C42025
                                                                                                                                                                                                    SHA-256:6147B83DBA649BF0AFC8F524FC205E766E492748EEB2B6EE9AADBFFBC39C20CB
                                                                                                                                                                                                    SHA-512:52068BF75BF6A8C4CD819B37EF9AB93E2DAECFA5BDF2AF756C1766331A4FEAAFAFC255347F5B069BEA57658DBC68216AF3325869695CFC425AD09592D676F96C
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........f.4Z..gZ..gZ..g.}g^..gWUggX..gWUeg\..gWUZgW..gWU[g_..g..qg]..gZ..g...g'~Zg~..g'~[g...g'~fg[..gWUag[..g'~dg[..gRichZ..g........PE..L...GdOX...........!..............................m......................................@.........................@..........d.......................@........%...................................\..@...............,............................text...{........................... ..`.rdata..............................@..@.data...............................@....rsrc...............................@..@.reloc...%.......&..................@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\javafx_iio.dll (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):126016
                                                                                                                                                                                                    Entropy (8bit):6.6094532025284085
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:kOxjjADzd+aeaPB9JhjxkM2wzGdXJbD/JjewPa:kcKzeaPB9JhjxknwzG5JbDxqwC
                                                                                                                                                                                                    MD5:B19474A46B4BE376477EBC3F6840E5D6
                                                                                                                                                                                                    SHA1:9A645B4CD4E7168683528CE704A88124AEF3706B
                                                                                                                                                                                                    SHA-256:2AC18D69137A1ECB4CC9BB140C931E22BDC68960240800596373C11F5D177581
                                                                                                                                                                                                    SHA-512:F5E29B9C6A7E5483FF0B39E785A841E4B95F106E0BD99D933AAD6D1FD2F40B4864B34C8C772246A5C3DCA446B9BB35DFE483F455FBDFBE3E81383AF24DF11F1D
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........y.r.*.r.*.r.*O..*.r.*.r.*.r.*. .*.r.*. .*.r.*. 0*.r.*. 1*.r.*..0*.r.*...*.r.*. .*.r.*...*.r.*Rich.r.*........PE..L...HdOX...........!.........:.....................m.................................>....@.....................................<.......................@.......\...................................0...@............................................text... ........................... ..`.rdata..8(.......*..................@..@.data...............................@....rsrc...............................@..@.reloc..\...........................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\javaw.exe (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):191552
                                                                                                                                                                                                    Entropy (8bit):6.744175386210352
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:KqGHPGleIOsEF+ySTk0Cl23+I0IXpcTBf8pdjZqMNj4HcezGN:tGvnsEOTknl23+I0gpcTBgvkYN
                                                                                                                                                                                                    MD5:9F8C5EAF561629D9323720ED6A80E9F8
                                                                                                                                                                                                    SHA1:A139AEE527417CBC6D8FBCD8107D159C18690025
                                                                                                                                                                                                    SHA-256:FF994196D2BB0F3F749C9A6295CCD3317B3C8F153B7AA1F9CED78A083CA72223
                                                                                                                                                                                                    SHA-512:07E10EE64157F45101D2E8FEE8EFDC9F411CD283D5A25A418F0DFF578FB94916C1FC5631DDBAD63D42A25416B3B71B5B948E8498EA87DDE268B4E63B34F6EF25
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........v...%...%...%..w%...%.7D%...%.7q%...%..|%...%...%...%.7E%*..%.7u%...%.7r%...%Rich...%........................PE..L....[OX.....................(....................@..........................0............@.................................\*..d.......................@............................................$..@............................................text.............................. ..`.rdata...t.......v..................@..@.data....4...@......."..............@....rsrc................8..............@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\javaws.exe (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):268864
                                                                                                                                                                                                    Entropy (8bit):6.4320561356319175
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:6144:uFPlS+WohsO0tHsOB0ppGr32DmrP9Dhvk9e:ilBWohsntHsb/Gb2DmZhvk9e
                                                                                                                                                                                                    MD5:03FBBFC587F2D6D06B6F085F2E745EC8
                                                                                                                                                                                                    SHA1:972EAD014E0383CA3668B578778CF54E2DFE19B1
                                                                                                                                                                                                    SHA-256:523C1746D8EBE35A080F4EBE1BE68DE6FB15A3B48825E620916E5123E703A83C
                                                                                                                                                                                                    SHA-512:F6B30830FBF96EC704F6AF9FE8022243C463A502059EB606A641C54B9959AC572587380FBEBA56AD6B46AE81F6519A9D350B7C61CCF3CDDE6B972BB398C7F9CB
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......a..L%...%...%...>c..8...J.4.-...,.......%.......>c5.....>c4.....>c..$...>c..$...Rich%...................PE..L....]OX.................r..........-C............@.................................Z.....@.................................L...x.......................@....... ................................... ...@...............h...T........................text....q.......r.................. ..`.rdata...c.......d...v..............@..@.data............x..................@....rsrc................R..............@..@.reloc..,-..........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\jawt.dll (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):13888
                                                                                                                                                                                                    Entropy (8bit):6.275240867244967
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:192:aDGnvnNcX3XLPVlD6iVUfnYe+PjPriT0fwSuj:a6W7PVlFV+nYPLr7M
                                                                                                                                                                                                    MD5:D30293BB469DCE96EFAB1E879DC3F5F4
                                                                                                                                                                                                    SHA1:0A12272C8AA7C74692D08F59F8C8916E30B9B624
                                                                                                                                                                                                    SHA-256:63CFB511B30B7DB1480166C950FBE429958C04BF495566538D7210D50D959B5D
                                                                                                                                                                                                    SHA-512:D391F648B37463BE07D6375ACEF7DF41383824451C8F0AF9637E211C2E5B71581886B20DE19435A3F7A989BF0C2495DBF0DBFC35768FB9CD2D6F77F3718D54C8
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X"._9LR_9LR_9LRD..R^9LRD..RS9LRD..RZ9LRVA.R]9LR_9MR|9LRD..R\9LRD..R^9LRD..R^9LRD..R^9LRRich_9LR........PE..L...JdOX...........!......................... .....m.........................`......b@....@..........................&..J...L"..P....@..................@....P..@.... ...............................!..@............ ...............................text............................... ..`.rdata..J.... ......................@..@.data...`....0......................@....rsrc........@......................@..@.reloc..t....P......................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\jdwp.dll (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):164416
                                                                                                                                                                                                    Entropy (8bit):6.7703850324284405
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:dkCW5Se5+EaGPjPc4QclwUsoIHTKDS42jPie9s1sx:eC6Se5+EaG74TKm4uPias4
                                                                                                                                                                                                    MD5:B18115260C97A515963132BFF6F1D940
                                                                                                                                                                                                    SHA1:AD0482896D36EF1C4049DD156BD3F5EC88A046CF
                                                                                                                                                                                                    SHA-256:8880300161E17540EB4B63BFB0D190B4D5E4AD958E626195317D0234D985E2BD
                                                                                                                                                                                                    SHA-512:B2E4BDE770EDE6539E87F69BD09D64D43D38CC01B8F0519C903A5F7D0BC6796926E82A0E868949A9D5612AF2CBC61CCA9E65A29620D763C0C0D11EC2565252D5
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........#..cp..cp..cp...p..cp...p..cp.D.p..cp..bp..cp.D.p..cp.D.p..cp.D.p..cp.D.p..cp.D.p..cp.D.p..cpRich..cp........................PE..L...MdOX...........!................&..............m................................^.....@..........................?..h....9..<....`...............j..@....p...)..@................................8..@...............,............................text............................... ..`.rdata...`.......b..................@..@.data...0....P.......6..............@....rsrc........`.......:..............@..@.reloc...+...p...,...>..............@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\jfr.dll (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):22592
                                                                                                                                                                                                    Entropy (8bit):6.619822012231737
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:YT4Z7lZRiY3PB6cGgOpem1zq2oRtSnPV5iYxIDLfCnYPLr7n9:44PZRiY3PB6cVAGbRMnd52DLaC79
                                                                                                                                                                                                    MD5:7CB51179FE1B2B6A296C04384D346D41
                                                                                                                                                                                                    SHA1:EFD492D022871D1672B391619079B0895BA7338B
                                                                                                                                                                                                    SHA-256:28A330C2312C5DDFEBDEF4061C9BAA41ADD1D47D8B20728EBBF07A81FB1CB811
                                                                                                                                                                                                    SHA-512:ABE2FF072EF5BFB221837C051F46C394BEDFEE05979CBDBAE4A79D745EA216CDA5F3996D0C61913AA5AE91BEFF836410498C29953E61BA9F8D8EC8F171E03D64
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........6...W..W..W../j.W...e.W..W..W....a.W...g.W...R.W...S.W...b.W...c.W...d.W..Rich.W..........PE..L...NdOX...........!........."......T&.......0.....m................................./....@.........................`>.......:..<....`...............@..@....p.. ....0...............................9..@............0...............................text...^........................... ..`.rdata..p....0....... ..............@..@.data........P.......6..............@....rsrc........`.......8..............@..@.reloc.......p.......<..............@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\jfxmedia.dll (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):115264
                                                                                                                                                                                                    Entropy (8bit):6.58808255551864
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:L+cINiJd/beFJ0cirPgyiciH/oQr0a6xoy2W3G6vAwC4S:pTOJ0cirPgyl2Nj6vby
                                                                                                                                                                                                    MD5:CB55308227A6F08FEC49AC770A3022F0
                                                                                                                                                                                                    SHA1:56831191C945E803E0E43BE1221BFEEE39DF5CCC
                                                                                                                                                                                                    SHA-256:F4F28C1DC39241DE0011C371137B43A2E1FC8B2E7390156D8524CDC67CDCC889
                                                                                                                                                                                                    SHA-512:4FFD8D03FC12B5C8789EEA292F0C25257C85A489BD9A31F633562F5ABF4A1F8ADA030017E9CDB12A3E32501A9914EF83598B685ED7104F1A827E3A04387192A5
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............l..l..l..>7..l..>...l..>5..l..>...l...#..l..5..l..l.zl.....l.....l..4..l..>3..l..6..l.Rich.l.........PE..L...OdOX...........!.........|.......,.......@.....m.....................................@.....................................x.......................@............................................h..@............@...............................text....-.......................... ..`.rdata..4Z...@...\...2..............@..@.data...4...........................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\jfxwebkit.dll (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):31896640
                                                                                                                                                                                                    Entropy (8bit):6.4081450765614125
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:393216:SPzJaMux3ZMo56qxqseJwDKRlDsqXCagQZhzvilh2Wlq7ORW:qzxOOLJRvUW
                                                                                                                                                                                                    MD5:E1CCBC17F87124177E89A9211170E17D
                                                                                                                                                                                                    SHA1:F4C22602CEF90EA12643378A13CC902217232181
                                                                                                                                                                                                    SHA-256:A386D0C2639E126E355A383D7EA71A62B96BD703A6751333B91E28A691AEECBC
                                                                                                                                                                                                    SHA-512:5364FAFCE53E4EDFF879A9408C1D76F681A724FCCF5EA87FBAAB2CA82FF39795677EED8D59B415D67465EDD4741E4E9ED833ACFBC3B8A723631003694732A41D
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$........}.,..c...c...c.e.....c..N....c..N....c..e....c..j....c...c...c..N..d.c..N....c.&....c...b...c..e....c..e....c..N....c.......c..e....c.Rich..c.........................PE..L...PdOX...........!...............................m.................................?....@.........................`\...@......x.... ..h...............@....0......................................s..@............................................text............................... ..`.rdata.............................@..@.data...XG.......V..................@....unwante............................@..@.rsrc...h.... ......................@..@.reloc......0......................@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\jjs.exe (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):15936
                                                                                                                                                                                                    Entropy (8bit):6.473780081477935
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:Gpsx5cnEsOEmSHhV8/Qeeq4SzianYPLr7/BuG:GpscnG5S/8/leqfC7JuG
                                                                                                                                                                                                    MD5:D644B1241088C3A6DFB233EDB3E8B4F9
                                                                                                                                                                                                    SHA1:FA131F8BF3BD920AE022BAB3F4583807B1C9E36B
                                                                                                                                                                                                    SHA-256:32E1B12A64B3E14DC3B488975C623055CFD25B09BDDBA6A43A371274B8CADC9A
                                                                                                                                                                                                    SHA-512:65DC1740739D7EC1D8E8778FB5A4917391EC7ACAD3D72EA608E8B554700D21966504D3B644304871C5B6351C9FAC6D17ED6142BE915402961CB2E86D3C26E9D1
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........R%^.<v^.<v^.<vW..v\.<vEx.v_.<vEx.v\.<vEx.v[.<v^.=vo.<vEx.vJ.<vEx.v_.<vEx.v_.<vRich^.<v........PE..L....[OX............................|........ ....@..........................`............@.................................$#..P....@..@............&..@....P....... ...............................!..@............ ...............................text............................... ..`.rdata....... ......................@..@.data........0......................@....rsrc...@....@......................@..@.reloc.......P.......$..............@..B........................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\jli.dll (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):158784
                                                                                                                                                                                                    Entropy (8bit):6.821119748025329
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:Hc079x1nIIS/NK+n9o20HCa++96TBf1Vuk3w:807lIIwKn20HCaP96TBO/
                                                                                                                                                                                                    MD5:A71D40B8F13C132FF90244BD5DCE0E05
                                                                                                                                                                                                    SHA1:1387B7490B2C871D4CE14DFBDF80D76714963EEF
                                                                                                                                                                                                    SHA-256:E7FB9B479D185FCAB7F4DF601B0BC111B7760F0358E28959941655421DBC44F1
                                                                                                                                                                                                    SHA-512:DEA331D024FDDEC351E56E46B6862E83C1139B8BD4F7A31A8131F5BD61B9646A16DDF0B445EC8AF29A470994C0CBD4486459218FDBD360353451F6BC93B3597A
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................6...........0.....=............7....5.....4.....3....Rich............PE..L...QdOX...........!...............................o................................Z~....@..........................3..m....*..d....................T..@............................................#..@............................................text...n........................... ..`.rdata...u.......v..................@..@.data....4...@......."..............@....rsrc................6..............@..@.reloc.."............:..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\jp2iexp.dll (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):207424
                                                                                                                                                                                                    Entropy (8bit):6.64291956597798
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:6144:iw/LSFAn1V6nC2E04bKcbPQa6OB1njm1P39HnY0ix:iw/LSG1h2E0mKcEjY0y
                                                                                                                                                                                                    MD5:4C7A9B695DFA9E768270B0EA93F827FD
                                                                                                                                                                                                    SHA1:FDBAFF79D649B57281CF2145BE758085F2B2E441
                                                                                                                                                                                                    SHA-256:10547D3D1803B7FA6F7DF5C4E52B2B80F8D8ACD78DDDE2B581018F42E00309C0
                                                                                                                                                                                                    SHA-512:8D47BB5FCC6190647ED01C32389DDC8DB8C569111661928EFF61001CF8C7D5B07034D75D057A15039A8FBAFA7DE577CBDEF7934AA45F35279055364C78D3914A
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........D.*...*...*.......*.......*.;....*.......*.......*...+...*.......*.......*.......*.......*.......*.......*.Rich..*.........................PE..L...RdOX...........!.........>.....................o.........................P.......>....@............................................................@......../...................................C..@...............|...........................text...O........................... ..`.rdata..............................@..@.data....-.......&..................@....rsrc...............................@..@.reloc...6.......8..................@..B........................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\jp2launcher.exe (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):83008
                                                                                                                                                                                                    Entropy (8bit):6.595362235920887
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:1536:IUV1TXKvcwKOuFqlgOt6s07VahQrt2TEQSOzMMC+CQ2z6GswY:zV1DxwCggOwDVaIt2TEQSOoGCRz6GswY
                                                                                                                                                                                                    MD5:BF6BCC0BC35AE1E1CC220DD13D0C14DB
                                                                                                                                                                                                    SHA1:D8E6F6ACE318B44C045D5940D3BBD08B94D30926
                                                                                                                                                                                                    SHA-256:3B4D3BB632242351EDC4C08E67FE320B00808E469B14B4CCA9735F88DDDDECB6
                                                                                                                                                                                                    SHA-512:FD50644F2F4577888788B926F0095E449B3D495E813330C0C8FDB4B97DAB7A2B790D3DAD7AF8890C824E2C4E8E322F1A1407C2116C92E54BDDF9659AC8807ADF
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-..C..C..C.....C.....C.v...C.....C..B.Y.C.....C.....C......C.....C.....C.Rich.C.................PE..L...N^OX............................q.............@.......................................@.....................................x....`..H............,..@....p..|...................................@...@...................0........................text.............................. ..`.rdata...C.......D..................@..@.data...$0... ......................@....rsrc...H....`......................@..@.reloc.......p......................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\jp2native.dll (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):19008
                                                                                                                                                                                                    Entropy (8bit):6.371891410300335
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:PTxbNok/0AfE0Q7TPVlx3B+ASZQ4NNN7F32nYPLr7z6Te:PNhr/w0QfdJSz78C7z6a
                                                                                                                                                                                                    MD5:B2BD172A35C5FA6F7373534C0F7B1F41
                                                                                                                                                                                                    SHA1:C38CF2262B575DCE7938A90C666587C33AD48EB8
                                                                                                                                                                                                    SHA-256:FA49F1189824020B2AAD63D8463169227F8DEC7493F252F7E2A23930D8C326E3
                                                                                                                                                                                                    SHA-512:2FA7CD0DE6A382A2ED7BE97941FD74BBEECA36D6383BDDEE8EC397A9A422F05E665998E060588A5F992771CFD529A78B787E450E4542A400E29B9D5C6F12D923
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............~fQ.~fQ.~fQ...Q.~fQ...Q.~fQ...Q.~fQ...Q.~fQ.~gQ.~fQ...Q.~fQ...Q.~fQ...Q.~fQ...Q.~fQ...Q.~fQRich.~fQ................PE..L...SdOX...........!.........................0.....o.........................p......+.....@..........................8......43..P....P...............2..@....`.......1..............................P1..@............0.......2..@....................text............................... ..`.rdata..T....0......................@..@.data........@.......&..............@....rsrc........P.......*..............@..@.reloc..J....`......................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\jp2ssv.dll (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):186944
                                                                                                                                                                                                    Entropy (8bit):6.611946209956476
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:SP6DHprimIoybZ6jpLbPJNJEcO09ccffPSBHab3YoDIx:SPWphe69/PJXEc/yc3PSYI5
                                                                                                                                                                                                    MD5:3C397EC3D573997FE4D6FF487D91A2F9
                                                                                                                                                                                                    SHA1:A01EE12A84D21B582CFD5331B9DF5D98FCD0FE53
                                                                                                                                                                                                    SHA-256:29CC5D8ADE3B798302C041CB3153E5F446879DC8D347329020688F5824C8A557
                                                                                                                                                                                                    SHA-512:32650071677A8EF93989DFCA61749621C77AE4DE082184F2FB7174C0BCAE2B889F48DC4A22B2B06EA2523A9836F28D001B404165197AF43F8711412AC8D6FF48
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B.+.#.x.#.x.#.x.mGx.#.x..Ax.#.x..ux3#.x.[Lx.#.x.[\x.#.x.#.x #.x.Utx.#.x..tx.#.x..Dx.#.x..Ex.#.x..Bx.#.xRich.#.x................PE..L...TdOX...........!................k........ .....o......................................@.....................................d.......................@............"...............................f..@............ ..P...<|.......................text...|........................... ..`.rdata...m... ...n..................@..@.data....5...........z..............@....rsrc...............................@..@.reloc...%.......&..................@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\jpeg.dll (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):145984
                                                                                                                                                                                                    Entropy (8bit):6.690501176691597
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:Pst3E0KkDBMUwgLlevLVnTmD7DBSndvinxQildB2tVonELM:Pst3EWKvulevLx6DvB/xQildB0VoEI
                                                                                                                                                                                                    MD5:EF6413CBD73BF706CCD9EC45A6E23E39
                                                                                                                                                                                                    SHA1:0BDB6F07D55E1927134883E0382C46FD91C143D3
                                                                                                                                                                                                    SHA-256:9D95566FCB03BF04CC6E37D1C2ADD6689787493B1661D1631D0CDFC2B98C148C
                                                                                                                                                                                                    SHA-512:6F6B0E28E99E3BC452D3AF6CB852A4616BE003F44ED87426C8E5CB645395017571B619B09C23106B00EA32E0FABA3C4466A87C7ED8575EE39AF6B8DAEDC05710
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........:.j.i.j.i.j.i..5i.j.i..8i.j.i...i.j.i..:i.j.i.j.i.j.i...i.j.i..=i.j.i..<i.j.i..;i.j.iRich.j.i................PE..L...UdOX...........!.........P......)..............o.........................`............@.........................."..X.......P....@..............."..@....P..........................................@............................................text...N........................... ..`.rdata...9.......:..................@..@.data........0......................@....rsrc........@......................@..@.reloc..4....P......................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\jsdt.dll (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):16448
                                                                                                                                                                                                    Entropy (8bit):6.488899272271987
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:NBY/8p65fb7c2coymhiqCyRoPV5shr1nYPLr7l:NI5fxXodiXC7l
                                                                                                                                                                                                    MD5:679A0D3F0330181CA4D2E919E3F0042B
                                                                                                                                                                                                    SHA1:ED1C5C602C449FDA771D2561764F0B944D8AC1D4
                                                                                                                                                                                                    SHA-256:4ABEF1B47DA71751B110F2BA976E2ACC7F6E7E52149860E49367D5F02CC3B910
                                                                                                                                                                                                    SHA-512:6CB94B0B485B50A14C89030DE52F3F00B1A05BF8AB48B99A2E8F42C084F4F98BD2146ACBF844EE4FCA3A31F2F37A6A74F278B50902F43DA941D658E927C5D864
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........{.m..d>..d>..d>.b.>..d>...>..d>..e>..d>...>..d>...>..d>...>..d>...>..d>...>..d>...>..d>Rich..d>........................PE..L...VdOX...........!.........................0.....o.........................p............@.........................P8..:....4..<....P...............(..@....`.......0...............................3..@............0...............................text............................... ..`.rdata.......0......................@..@.data...`....@....... ..............@....rsrc........P......."..............@..@.reloc.......`.......&..............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\jsound.dll (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):30784
                                                                                                                                                                                                    Entropy (8bit):6.611714817058123
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:763a8SoqjtggwjekwLPfc2j7JdJFEqyXCwiuG8RPGHvtLny5jnYPLr71:763a8SoRwLPVdJGqyXFtR+VuVC71
                                                                                                                                                                                                    MD5:0CE9F696A77510ED61453DA1ACCAACFB
                                                                                                                                                                                                    SHA1:C9013D81530AD7B8862C3902DA43C849FB6283F2
                                                                                                                                                                                                    SHA-256:CFC1105375E2494B47377EE6ABC5B167F7C57F4B55FD79F34B62D353C6C2B787
                                                                                                                                                                                                    SHA-512:120D55D96C43E84F3E40CA4B3FAD856489B2C0B57C788AF2E3CC874AEA21084A0E7E46D1C6C89F9DE0EAA3A9FAA5CD0CD334DB33AD9EBFF0ADD2812B22248F73
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......U.Nu.h &.h &.h &...&.h &...&.h &...&.h &.h!&_h &...&.h &...&.h &...&.h &...&.h &...&.h &Rich.h &........PE..L...WdOX...........!.....8...(.......A.......P.....o................................`.....@.........................P^.......V..P....................`..@...........`Q...............................U..@............P..D............................text...66.......8.................. ..`.rdata.. ....P.......<..............@..@.data...$....p.......V..............@....rsrc................X..............@..@.reloc...............\..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\jsoundds.dll (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):27712
                                                                                                                                                                                                    Entropy (8bit):6.629316342102385
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:768:1WeFz9Yu22rM0Z6uHB72ZWreX06OMi423nDIN5sgvYWW/2YSXqqzTgNj2Qdq2jCs:1WW296eAj2d2+Y
                                                                                                                                                                                                    MD5:A725581D6C80BC5D204379FC2BDC0E04
                                                                                                                                                                                                    SHA1:FDA84702E40CCD52D565D07697DF2F36624A2E42
                                                                                                                                                                                                    SHA-256:1FF9875CCA81E82221CFDA40EA2A3FB1176120662945D1019931ACBADE56775A
                                                                                                                                                                                                    SHA-512:DFFB52EDA5A2C856004C8DC8A0FE01DAFE8D72D8E748E7D693E5C7D3B0203DDD9BF463C1AFDA989BF66F7AED4B6B94FCA73B8E1B586E9E40325DD96B2CD36D4E
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............q...q...q.......q.......q.......q...q...q....=..q....<..q.......q.......q.......q..Rich.q..........................PE..L...XdOX...........!.....6...$.......?.......P.....o......................................@.........................0Y.......S.......p...............T..@.......0....Q...............................R..@............P...............................text...v4.......6.................. ..`.rdata.......P.......:..............@..@.data...L....`.......J..............@....rsrc........p.......L..............@..@.reloc...............P..............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\kcms.dll (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):178240
                                                                                                                                                                                                    Entropy (8bit):6.802695940538205
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:e1Wd97Kl2KtpdhEnG5RKNyfCBxFaTUct/OuSsWPjT9JC1pBSCq:yQ2ltpdhEn0CBSTbtmPj65W
                                                                                                                                                                                                    MD5:82F488CA868FE602E2170AE7A9A62C5A
                                                                                                                                                                                                    SHA1:570117F879342FB17EDCD4DE90457F9BCBD3BE70
                                                                                                                                                                                                    SHA-256:EFA38A458AE50007257E7A218808310AE5D10314D3E10D9952FCB0412ACF3C44
                                                                                                                                                                                                    SHA-512:69CBA55C451FF7DD6E62F4DE26D595A81523912B805A667A5C923F0BBC5B8F3CFC403C5A0621761B49BCF90E4DF0B9A2C9169DF0995C8DBD493F680E1BC72CA9
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........:..di..di..di.k.i..di.k.i..di...i..di.k.i..di..ei..di.k.i..di.k.i..di.k.i..di.k.i..diRich..di................PE..L...BdOX...........!.....^...F.......g.......p.....o.................................|....@.............................d....x..P.......h...............@....... ...`q..............................pw..@............p..H............................text....\.......^.................. ..`.rdata.......p.......b..............@..@.data................v..............@....rsrc...h...........................@..@.reloc.. ...........................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\keytool.exe (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):15936
                                                                                                                                                                                                    Entropy (8bit):6.473180362325704
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:GpsY5cnCsTmSHhV8voeeU4SzitnYPLr7PeBJ:GpsHn8S/8vdeUkC7Pe3
                                                                                                                                                                                                    MD5:5CE9A44FAAEC31DECA6CE7A368F6BE7F
                                                                                                                                                                                                    SHA1:9C526AC517E61E2DF15DD71C1E00B3075D3FC752
                                                                                                                                                                                                    SHA-256:4AD51A372F82EE11AC9B3C94903E5877E52659AC1519F471D4F8FBA04CB54B6D
                                                                                                                                                                                                    SHA-512:F0D49B742AF36685E77EEA2A858BCD187721648F1A35E465CDB002458D3BBCE194D9351A25DF3506064BDA299C8E2AF6C0BA8829CF7C4554D3850AEA48C641F2
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........R%^.<v^.<v^.<vW..v\.<vEx.v_.<vEx.v\.<vEx.v[.<v^.=vo.<vEx.vJ.<vEx.v_.<vEx.v_.<vRich^.<v........PE..L....[OX............................|........ ....@..........................`......L.....@.................................4#..P....@..T............&..@....P....... ...............................!..@............ ...............................text............................... ..`.rdata....... ......................@..@.data........0......................@....rsrc...T....@......................@..@.reloc.......P.......$..............@..B........................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\kinit.exe (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):15936
                                                                                                                                                                                                    Entropy (8bit):6.477783118037472
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:GpsW5cnusImSHhV82+Aeek4SzSdnYPLr7S6:GpstnTS/8P1ekoC7S6
                                                                                                                                                                                                    MD5:8D07726A3CC4AE3835FFC6DBE9584468
                                                                                                                                                                                                    SHA1:D6A6C0C5B040F3EE687662F3A612BB41C2060C5D
                                                                                                                                                                                                    SHA-256:9B4178478D2C6AF8C39C95680697E9011C62A9980F1D999BB325EDD6F1A735DB
                                                                                                                                                                                                    SHA-512:191A89AEE7DD967EB35A1449907509CC44655ECCE7FF970DA0DA3B0039A4964F29E281F3C375485F0C02DF756703741FA9E062909BD570B261349640572DA73D
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........R%^.<v^.<v^.<vW..v\.<vEx.v_.<vEx.v\.<vEx.v[.<v^.=vo.<vEx.vJ.<vEx.v_.<vEx.v_.<vRich^.<v........PE..L....[OX............................|........ ....@..........................`......kg....@.................................4#..P....@..H............&..@....P....... ...............................!..@............ ...............................text............................... ..`.rdata....... ......................@..@.data........0......................@....rsrc...H....@......................@..@.reloc.......P.......$..............@..B........................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\klist.exe (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):15936
                                                                                                                                                                                                    Entropy (8bit):6.478103043828708
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:GpsF5cnUsBmSHhV8/Ceek4SzSKnYPLr7c6A:GpsQn8S/8/vekzC71A
                                                                                                                                                                                                    MD5:5CF6A00237CF6318819FE63644210693
                                                                                                                                                                                                    SHA1:44A70F8428610EC6F8D1D2B9F40CC768A33D5AC9
                                                                                                                                                                                                    SHA-256:EABE64D651D5912A8296F08DA2930E42DA47C6168BA44D5F1C730EBF1A7B393E
                                                                                                                                                                                                    SHA-512:DEFF59B40DCCD080A0DC58B72C0DB33D01F90527A44D14502DB3588EB447F1107E168F1F6B19981139DFA40E479E6FD144B8EE3DD1506F603D92CDC3B33C7EE2
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........R%^.<v^.<v^.<vW..v\.<vEx.v_.<vEx.v\.<vEx.v[.<v^.=vo.<vEx.vJ.<vEx.v_.<vEx.v_.<vRich^.<v........PE..L....[OX............................|........ ....@..........................`.......,....@.................................4#..P....@..H............&..@....P....... ...............................!..@............ ...............................text............................... ..`.rdata....... ......................@..@.data........0......................@....rsrc...H....@......................@..@.reloc.......P.......$..............@..B........................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\ktab.exe (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):15936
                                                                                                                                                                                                    Entropy (8bit):6.477502829409479
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:GpsR5cnts8mSHhV8xeee84SzSPnYPLr7Tn0X:Gps8nQS/8xDe8iC7D0X
                                                                                                                                                                                                    MD5:347EF202FD465A219020FC2BFB1DEFAA
                                                                                                                                                                                                    SHA1:9AF54E67F5B7C4FC61E6E4D6015FA7E43F7ED2A0
                                                                                                                                                                                                    SHA-256:51B4638BF220A2C57F44F0555C11F59DE806C7AB811A5B7CE9C60CE0456C1F8E
                                                                                                                                                                                                    SHA-512:FD0E812DE2FCDB6F7FE311D45D31AE64D5C22A0AB716056D0FEC54D6ABACE4E950568F0C79F7BFCC1FBF81B9B0246A95DFC5D243639FD2D0F4DF2DB4406D5162
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........R%^.<v^.<v^.<vW..v\.<vEx.v_.<vEx.v\.<vEx.v[.<v^.=vo.<vEx.vJ.<vEx.v_.<vEx.v_.<vRich^.<v........PE..L....[OX............................|........ ....@..........................`.......x....@.................................4#..P....@..H............&..@....P....... ...............................!..@............ ...............................text............................... ..`.rdata....... ......................@..@.data........0......................@....rsrc...H....@......................@..@.reloc.......P.......$..............@..B........................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\lcms.dll (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):185920
                                                                                                                                                                                                    Entropy (8bit):6.5164171249812854
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:uqIxSXvf/q46Z6TmdGPnp2gpsSAp8xnfoTWqn0JUd38C5/9euzV2M:ZwSX1leGPXq/p8xop3v5zj
                                                                                                                                                                                                    MD5:9369C5D802A5B46CD0FAEC2B395A520D
                                                                                                                                                                                                    SHA1:B641A2F1E24ADEFD90A30ED01F9CB1BB2BB5BE0A
                                                                                                                                                                                                    SHA-256:14675693C8B341F8D242F7A5137199F18B77354235D959EBB50AB5FCCC2ECBE6
                                                                                                                                                                                                    SHA-512:A5662FBC6DE7D621A61BDC673ED17548E97172F82CE00CA64CE5B2ED2D263D60FD4786B04A2561624A94A17FE07585D7CA1DB402E25DBF407D6A388E61D824AE
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......AE.m.$z>.$z>.$z>.\.>.$z>...>.$z>...>.$z>...>.$z>.${>T$z>...>"$z>...>.$z>...>.$z>...>.$z>Rich.$z>........................PE..L...BdOX...........!.................&.......0.....o................................{H....@..........................P..h...<K..d.......................@.......(... 1...............................I..@............0...............................text............................... ..`.rdata..8#...0...$... ..............@..@.data....h...`...\...D..............@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\management.dll (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):33344
                                                                                                                                                                                                    Entropy (8bit):6.5475211336265815
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:768:qqdE5A9uLz/EZSd1f2KyVwhxKdd0t2NC7O:NRK/EZS32pVSYc2AO
                                                                                                                                                                                                    MD5:053566FDEC6BF9717C3A21F36D32C723
                                                                                                                                                                                                    SHA1:9B75BBEE077F4B04DBBACB942B6974F6D17BF823
                                                                                                                                                                                                    SHA-256:A7786F02ECF4F70B03CB2E06F1474E5F613120A6591C9500631931B4813AD672
                                                                                                                                                                                                    SHA-512:C279A5EFC5045BCD2123935024FE202E7340DF71DD55DB34E9E1084A61BF45AC48781B411338A821A93E1089B7555E6321042BA2B2FA25F06D58AAA82CA2170B
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\j.29.29.29w..9.29...9.29...9.29..9.29...9.29.39..29...9..29...9.29...9.29...9.29Rich.29........PE..L...BdOX...........!.....,...>......H6.......@.....o................................k.....@..........................T.......K.......................j..@...........pA..............................XJ..@............@..P............................text...^+.......,.................. ..`.rdata...-...@.......0..............@..@.data...@....p.......^..............@....rsrc................`..............@..@.reloc...............d..............@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\mlib_image.dll (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):574528
                                                                                                                                                                                                    Entropy (8bit):6.505383213382561
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:12288:VgOd513xASJ4yvhwKF1FbaFLYKZxL/ooG6+WkAI4i8MaJ4LctiGolste8Q8Nw38X:VgOd513SSJ4yvhwKF1FbaF0KZioG8kAR
                                                                                                                                                                                                    MD5:2A9F651B6394AAFFA4F454C9880B7F94
                                                                                                                                                                                                    SHA1:DB5CE34660CDF84BBDDFF9B800D224BB14848B6C
                                                                                                                                                                                                    SHA-256:C849E1C1989896EB4103FD717200D3545DD3ECEDA81E3BAE95DB0A6309647562
                                                                                                                                                                                                    SHA-512:5819014214563D6A6A8B04F81CD261C5E042C76B2F8D82E67932E6594E3FEC8C6B0C92D9CA5402A28C095156D26BA457227C8B0969C3CF5C8F72DB50B3E5D0C2
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Y...8i.8i.8i.@..8i....8i.8h.8i....8i....8i.....8i....8i....8i....8i.Rich.8i.........PE..L...BdOX...........!...............................o.................................p....@......................... ..."......<.......................@...........................................p...@............................................text............................... ..`.rdata..B...........................@..@.data...,...........................@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\msvcp120.dll (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):455328
                                                                                                                                                                                                    Entropy (8bit):6.698367093574994
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:12288:uZ/8wcqw2oe+Z3VrfwfNOOoWhUgiW6QR7t5ss3Ooc8DHkC2e77/:W/8wVwHZFTwFOOos3Ooc8DHkC2e77/
                                                                                                                                                                                                    MD5:FD5CABBE52272BD76007B68186EBAF00
                                                                                                                                                                                                    SHA1:EFD1E306C1092C17F6944CC6BF9A1BFAD4D14613
                                                                                                                                                                                                    SHA-256:87C42CA155473E4E71857D03497C8CBC28FA8FF7F2C8D72E8A1F39B71078F608
                                                                                                                                                                                                    SHA-512:1563C8257D85274267089CD4AEAC0884A2A300FF17F84BDB64D567300543AA9CD57101D8408D0077B01A600DDF2E804F7890902C2590AF103D2C53FF03D9E4A5
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......o...+.N+.N+.N.3wN).N+.N..Nm.aN(.Nm.cN#.Nm.]N..Nm.\Ne.Nm.YN-.Nm.`N*.Nm.gN*.Nm.bN*.NRich+.N........................PE..L....|OR.........."!.........................0.......................................x....@..........................W..L...<...<........................>.......D...................................K..@...............<............................text...<........................... ..`.data....^...0...0... ..............@....idata...............P..............@..@.rsrc................j..............@..@.reloc...D.......F...n..............@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\msvcr100.dll (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):773968
                                                                                                                                                                                                    Entropy (8bit):6.901569696995594
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:12288:yMmCy3nAgPAxN9ueqix/HEmxsvGrif8ZSy+rdQw2QRAtd74/vmYK6H3BV0eAI:dmCy3KxW3ixPEmxsvGrm8Z6r+JQPzV4I
                                                                                                                                                                                                    MD5:BF38660A9125935658CFA3E53FDC7D65
                                                                                                                                                                                                    SHA1:0B51FB415EC89848F339F8989D323BEA722BFD70
                                                                                                                                                                                                    SHA-256:60C06E0FA4449314DA3A0A87C1A9D9577DF99226F943637E06F61188E5862EFA
                                                                                                                                                                                                    SHA-512:25F521FFE25A950D0F1A4DE63B04CB62E2A3B0E72E7405799586913208BF8F8FA52AA34E96A9CC6EE47AFCD41870F3AA0CD8289C53461D1B6E792D19B750C9A1
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:.y.~...~...~...w...}...~.......eD.....eD..+...eD..J...eD......eD......eD......eD......Rich~...................PE..L..."._M.........."!.........................0.....x................................u.....@..........................H......d...(.......................P.......$L...!..8...........................hE..@............................................text...!........................... ..`.data....Z...0...N..................@....rsrc................f..............@..@.reloc..$L.......N...j..............@..B................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\msvcr120.dll (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):970912
                                                                                                                                                                                                    Entropy (8bit):6.9649735952029515
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:12288:LBmFyjLAOQaYkxGXPfY7eiWWcpOKnpTVOIxhK765qlRRb6x4pI23IbJQV:dmFyjLF847eiWWcoGZVOIxh/WxIAIbGV
                                                                                                                                                                                                    MD5:034CCADC1C073E4216E9466B720F9849
                                                                                                                                                                                                    SHA1:F19E9D8317161EDC7D3E963CC0FC46BD5E4A55A1
                                                                                                                                                                                                    SHA-256:86E39B5995AF0E042FCDAA85FE2AEFD7C9DDC7AD65E6327BD5E7058BC3AB615F
                                                                                                                                                                                                    SHA-512:5F11EF92D936669EE834A5CEF5C7D0E7703BF05D03DC4F09B9DCFE048D7D5ADFAAB6A9C7F42E8080A5E9AAD44A35F39F3940D5CCA20623D9CAFE373C635570F7
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......S9...XlA.XlA.XlA..A.XlA.XmA.XlAQ..A.ZlAQ..AvXlAQ..A!XlAQ..A.XlAQ..A.XlAQ..A.XlAQ..A.XlARich.XlA........PE..L....|OR.........."!................D............................................... .....@.........................`........R..(....p...................>......d]..@...8...........................H...@............P...............................text............................... ..`.data...4e.......V..................@....idata.......P......................@....rsrc........p.......0..............@..@.reloc..d].......^...4..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\net.dll (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):80960
                                                                                                                                                                                                    Entropy (8bit):6.679744509090023
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:1536:djPA2UOEe31bRlX1iZ0Y/cbq+sLdx2uuzrUWLoaj3SnGo/:d735pNbq9eoajJo/
                                                                                                                                                                                                    MD5:1A15D876CF7676920E87EADBE62E9E27
                                                                                                                                                                                                    SHA1:7C0D907A6FD5A4DD369991FD233FF361EA478210
                                                                                                                                                                                                    SHA-256:0CD5AD5A0A69EE8BA160012A0A97BBBD603DE2BEB3C8D90C30E97AF29BFD2172
                                                                                                                                                                                                    SHA-512:EA83E9EBD01BD8D2D348BE7C7832E68051240381D4FB8EFBCDC1CF053D87780715C1A80F1EB94BDBB67DB19C6ABB2B65F6377DA9A3C7F57895B101504F744C75
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......!..Ke.}.e.}.e.}.~'..d.}.~'..g.}.....f.}.~'..c.}.e.|..}.l...b.}.l...d.}.~'..D.}.~'..d.}.~'..d.}.~'..d.}.Riche.}.................PE..L...BdOX...........!.........l......r..............o.........................`.......6....@.........................P...1............0...............$..@....@...... ...............................P...@.......................`....................text...^........................... ..`.rdata...L.......N..................@..@.data........ ......................@....rsrc........0......................@..@.reloc..V....@......................@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\nio.dll (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):51264
                                                                                                                                                                                                    Entropy (8bit):6.566239798664522
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:1536:as+mn0yrrdv14NVnsXC76G8Y2i4UqASi/wF:asfn3LOay+G8Y2iDqAFS
                                                                                                                                                                                                    MD5:741AD004E3B11B6A1C6A089ACEFE0109
                                                                                                                                                                                                    SHA1:8144144E27B4A6BD348ECCC6A1A35A113D37EF3E
                                                                                                                                                                                                    SHA-256:79947E56B8AD1256F07107194112E6CA94D3B51812034C0BBA49C277DB1B6014
                                                                                                                                                                                                    SHA-512:7D8CEA8B1EABAB2A435141641DACFDF1F5F0A85038F46B0BAD11C7D4AABA2754D3950F13C12011C99664E8D2185B9A644CCA61CCE97328D5D4A3C3AB72D68EC6
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......J!...@..@..@...@..@...u..@...B..@..@..@..8M..@...t..@...E..@...D..@...C..@.Rich.@.........PE..L...BdOX...........!.....V...Z......9_.......p.....o................................c.....@..............................+..L|..........................@.......t....r...............................{..@............p...............................text...TT.......V.................. ..`.rdata...F...p...H...Z..............@..@.data...(...........................@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\npt.dll (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):17472
                                                                                                                                                                                                    Entropy (8bit):6.406821273109915
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:192:mgp64394shTV8+5nwzp5GmL3X+PVR6ymx3doEUnnYe+PjPriT0fwZg:5ThTm+5niD5zOPV5i3doEqnYPLr7n
                                                                                                                                                                                                    MD5:81CACC8ADF951956BC66081CEF52C94A
                                                                                                                                                                                                    SHA1:3DC2E1CEA0CFAF7E44977752A00B258594D5DF93
                                                                                                                                                                                                    SHA-256:1242274BA80CF3F5918E62372E9C3EA40E7BF4B8A2CD3CA70B1FA60659C15A12
                                                                                                                                                                                                    SHA-512:AB0FA1FED99BC5DDB10AD913E4D3B60254721632B1287C10AFE13DC835C9EB3B7D2E3327C0008D74AED60380842FB238EDE43982DA511E9C19B3C542825D5B8D
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............w...w...w....@..w..O9K..w....O..w...w...w....M..w....x..w....y..w....H..w....I..w....N..w..Rich.w..........PE..L...CdOX...........!................)........0.....o.........................p......e.....@..........................7.._....3..<....P...............,..@....`.......0...............................2..@............0...............................text...>........................... ..`.rdata..O....0......................@..@.data...X....@......."..............@....rsrc........P.......$..............@..@.reloc.......`.......(..............@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\orbd.exe (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):16448
                                                                                                                                                                                                    Entropy (8bit):6.382180875681361
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:Gps0Anv+dsQmSHhV8FUeenc2tnYPLr7eD:Gps1nWQS/8FRe3C7W
                                                                                                                                                                                                    MD5:6EDF068A2741192CB8C297FC4004AA6B
                                                                                                                                                                                                    SHA1:C513BDE60791C2923BEFAEE0006C36F51A6D6F50
                                                                                                                                                                                                    SHA-256:8F0E318A14A11BD18AFF3F655A9CF05FD1D778B22C29A4047666A52A381AC576
                                                                                                                                                                                                    SHA-512:A58BBEFAF6DDA705012ACCD5D0C146D5D6303DB86795FCF131AE4461627F05D4EB39A5DC9D3275A7ECE556B9909F3BB0946E6E4A66BA856C050A429286C97624
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........R%^.<v^.<v^.<vW..v\.<vEx.v_.<vEx.v\.<vEx.v[.<v^.=vo.<vEx.vJ.<vEx.v_.<vEx.v_.<vRich^.<v........PE..L....[OX............................z........ ....@..........................`.......3....@..................................#..P....@..H............(..@....P....... ..............................h"..@............ ...............................text............................... ..`.rdata....... ......................@..@.data........0......................@....rsrc...H....@......................@..@.reloc.......P.......&..............@..B........................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\pack200.exe (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):15936
                                                                                                                                                                                                    Entropy (8bit):6.475995282201349
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:GpsG5cnJsGmSHhV8yk8eeU4SzKjnYPLr75p:Gps9naS/8yk5eUmC75p
                                                                                                                                                                                                    MD5:28048A3ED6A2E3DE080FAAD19A432356
                                                                                                                                                                                                    SHA1:DBF149C56EFA85FBF0200C4E016CED7244F729A1
                                                                                                                                                                                                    SHA-256:21A4B05D25F8DF26F5B383834D4DDE970CB5B38500EEE6CD1568A4E1BAD2CA18
                                                                                                                                                                                                    SHA-512:7F3EFD375B4551CD345BECEEBA989365C02CA3EEE059AFF37C62FCD13C31A8147C530D1AA6C40669CB6CC535F7420AF7068EA126CF454B876CF3ADC99F1F40F5
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........R%^.<v^.<v^.<vW..v\.<vEx.v_.<vEx.v\.<vEx.v[.<v^.=vo.<vEx.vJ.<vEx.v_.<vEx.v_.<vRich^.<v........PE..L....[OX............................|........ ....@..........................`......,4....@.................................4#..P....@..T............&..@....P....... ...............................!..@............ ...............................text............................... ..`.rdata....... ......................@..@.data........0......................@....rsrc...T....@......................@..@.reloc.......P.......$..............@..B........................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\plugin2\is-JD61V.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):773968
                                                                                                                                                                                                    Entropy (8bit):6.901569696995594
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:12288:yMmCy3nAgPAxN9ueqix/HEmxsvGrif8ZSy+rdQw2QRAtd74/vmYK6H3BV0eAI:dmCy3KxW3ixPEmxsvGrm8Z6r+JQPzV4I
                                                                                                                                                                                                    MD5:BF38660A9125935658CFA3E53FDC7D65
                                                                                                                                                                                                    SHA1:0B51FB415EC89848F339F8989D323BEA722BFD70
                                                                                                                                                                                                    SHA-256:60C06E0FA4449314DA3A0A87C1A9D9577DF99226F943637E06F61188E5862EFA
                                                                                                                                                                                                    SHA-512:25F521FFE25A950D0F1A4DE63B04CB62E2A3B0E72E7405799586913208BF8F8FA52AA34E96A9CC6EE47AFCD41870F3AA0CD8289C53461D1B6E792D19B750C9A1
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:.y.~...~...~...w...}...~.......eD.....eD..+...eD..J...eD......eD......eD......eD......Rich~...................PE..L..."._M.........."!.........................0.....x................................u.....@..........................H......d...(.......................P.......$L...!..8...........................hE..@............................................text...!........................... ..`.data....Z...0...N..................@....rsrc................f..............@..@.reloc..$L.......N...j..............@..B................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\plugin2\is-U4PV7.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):172096
                                                                                                                                                                                                    Entropy (8bit):6.385351864602567
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:4LzqgseqQZjbnvulVw6hefoIUG7dDyzObaUcODMM4cBqg8UyJNd5uGZzfYtRD+E0:4bT3nWPKoIU6DwObaUcODMM4cBqg8UyD
                                                                                                                                                                                                    MD5:5885945862885D0D1D3BE7D8F411EE5B
                                                                                                                                                                                                    SHA1:21CA26EFF3033553E2304CBDC010D7482B523B6E
                                                                                                                                                                                                    SHA-256:D3EDCA0E3D1F2E020603687D7B98EDF3CB833FCE9727201577B560DE4F702A3B
                                                                                                                                                                                                    SHA-512:3C4F79D1ACF75653D6ED331A626A6CE713550AF8DC7761BEA38A528222AEF6DA79A3F07559961D3ECEA2CFDD99BB9131D82EC718683B42F5EBF58DA432830596
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-n.C=.C=.C=...=..C=a..=..C=...=..C=...=..C=.B=..C=...=..C=...=.C=...=.C=...=.C=...=.C=...=.C=Rich.C=........................PE..L...DdOX...........!.....J...@.......-.......`.....o......................................@.............................A............ ...h..............@.......p....c..................................@............`..H............................text....H.......J.................. ..`.rdata.......`.......N..............@..@.data...x!..........................@....rsrc....h... ...j..................@..@.reloc...".......$...d..............@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\plugin2\msvcr100.dll (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):773968
                                                                                                                                                                                                    Entropy (8bit):6.901569696995594
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:12288:yMmCy3nAgPAxN9ueqix/HEmxsvGrif8ZSy+rdQw2QRAtd74/vmYK6H3BV0eAI:dmCy3KxW3ixPEmxsvGrm8Z6r+JQPzV4I
                                                                                                                                                                                                    MD5:BF38660A9125935658CFA3E53FDC7D65
                                                                                                                                                                                                    SHA1:0B51FB415EC89848F339F8989D323BEA722BFD70
                                                                                                                                                                                                    SHA-256:60C06E0FA4449314DA3A0A87C1A9D9577DF99226F943637E06F61188E5862EFA
                                                                                                                                                                                                    SHA-512:25F521FFE25A950D0F1A4DE63B04CB62E2A3B0E72E7405799586913208BF8F8FA52AA34E96A9CC6EE47AFCD41870F3AA0CD8289C53461D1B6E792D19B750C9A1
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:.y.~...~...~...w...}...~.......eD.....eD..+...eD..J...eD......eD......eD......eD......Rich~...................PE..L..."._M.........."!.........................0.....x................................u.....@..........................H......d...(.......................P.......$L...!..8...........................hE..@............................................text...!........................... ..`.data....Z...0...N..................@....rsrc................f..............@..@.reloc..$L.......N...j..............@..B................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\plugin2\npjp2.dll (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):172096
                                                                                                                                                                                                    Entropy (8bit):6.385351864602567
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:4LzqgseqQZjbnvulVw6hefoIUG7dDyzObaUcODMM4cBqg8UyJNd5uGZzfYtRD+E0:4bT3nWPKoIU6DwObaUcODMM4cBqg8UyD
                                                                                                                                                                                                    MD5:5885945862885D0D1D3BE7D8F411EE5B
                                                                                                                                                                                                    SHA1:21CA26EFF3033553E2304CBDC010D7482B523B6E
                                                                                                                                                                                                    SHA-256:D3EDCA0E3D1F2E020603687D7B98EDF3CB833FCE9727201577B560DE4F702A3B
                                                                                                                                                                                                    SHA-512:3C4F79D1ACF75653D6ED331A626A6CE713550AF8DC7761BEA38A528222AEF6DA79A3F07559961D3ECEA2CFDD99BB9131D82EC718683B42F5EBF58DA432830596
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-n.C=.C=.C=...=..C=a..=..C=...=..C=...=..C=.B=..C=...=..C=...=.C=...=.C=...=.C=...=.C=...=.C=Rich.C=........................PE..L...DdOX...........!.....J...@.......-.......`.....o......................................@.............................A............ ...h..............@.......p....c..................................@............`..H............................text....H.......J.................. ..`.rdata.......`.......N..............@..@.data...x!..........................@....rsrc....h... ...j..................@..@.reloc...".......$...d..............@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\policytool.exe (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):15936
                                                                                                                                                                                                    Entropy (8bit):6.474805310471259
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:GpsS5Bn1sCmSHhV8Teeet4SzvBGnYPLr7EBs:Gps0nGS/8TDetJ0C7EBs
                                                                                                                                                                                                    MD5:6791321A5CFEB19A85CC4265D368A0A0
                                                                                                                                                                                                    SHA1:608BBC705ABCA303DBEC6AE5015FB5BE1D2E4A8F
                                                                                                                                                                                                    SHA-256:2D55D5C5B139A319BD5B8550B2540AD4A38A7BF3C5795AE62B95EA2A219CBC91
                                                                                                                                                                                                    SHA-512:D2D0952BEE2F4EE16973F11CD1BD9AADD3A7D9C0CE0FE15920C37A22C7AAA8EA5386ACBF40EC10C77783B5DFA89D0ADCD6023546AC2C68D5D3675528805F78B7
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........R%^.<v^.<v^.<vW..v\.<vEx.v_.<vEx.v\.<vEx.v[.<v^.=vo.<vEx.vJ.<vEx.v_.<vEx.v_.<vRich^.<v........PE..L....[OX............................|........ ....@..........................`............@.................................D#..P....@..h............&..@....P....... ...............................!..@............ ...............................text............................... ..`.rdata....... ......................@..@.data........0......................@....rsrc...h....@......................@..@.reloc.......P.......$..............@..B........................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\prism_common.dll (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):52800
                                                                                                                                                                                                    Entropy (8bit):6.453835079331636
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:768:KkRxfoAQAQUEP/EG9uq4QSpXpNMQcTQxtdRcAXl7gS5vMPxDGUVukrV9tbqycqXd:KkQkQp19umWtL6AXxncxDGUwmtbt09Za
                                                                                                                                                                                                    MD5:53493EDE1D3751C19ABC2E9BE5F69B5F
                                                                                                                                                                                                    SHA1:06400FF6BC3F5A2EF10AE952124CF1AE89BA9AC7
                                                                                                                                                                                                    SHA-256:2EB97530113F4CA1B3E2B8481EB69CBAB4BA0E8F5FECE45E2611BA295469F9A1
                                                                                                                                                                                                    SHA-512:E2062AC217E2C1A6F6DE5ABC3D4554A6729C22B000295C5B40F70F0EABA6D365E2FE5547B0485C57EC2FBD0EACB9D98CDB163CB6C1AC5912251E0A9FD2950E56
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......q..D5.w.5.w.5.w..J..7.w.5.v...w.8..6.w.8..6.w.8..9.w.8..7.w.H..2.w.H..4.w.8..4.w.H..4.w.Rich5.w.........................PE..L...BdOX...........!................e..............o......................................@....................................<.......................@...............................................@............................................text............................... ..`.rdata..X...........................@..@.data...L...........................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\prism_d3d.dll (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):116288
                                                                                                                                                                                                    Entropy (8bit):5.788900294640214
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:6XSOejykUroCJGBhzla+uHMg9glgFvcfgfgzgG4g9XTXDXp+RuXGXlXdY9vXTXvv:WSOeGkUrVJShKc1b
                                                                                                                                                                                                    MD5:B9F99AFF9D768E5C8CA214B41963D84E
                                                                                                                                                                                                    SHA1:0823B7C6539F3FC120C3EF69C45AF90DE007644F
                                                                                                                                                                                                    SHA-256:867F8159D07B0E1089F2CD301698590B3B00063BE4D6004C3CFD6E993EC7C56A
                                                                                                                                                                                                    SHA-512:71C80DABC0695A0C1631599BBCB171C8C95895998A20E35C4E84A8BE014056C4FB5593ADBB509E9CD16938BDF04DE59A0AAA546CAC686796D01570872DA0C518
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........tm....X...X...X.G.X...X.G.X...X.G.X...X.G.X...XR..X...X...X...X.l.X...X.l.X...X.G.X...X.l.X...XRich...X........PE..L...BdOX...........!................=..............o.................................f....@.........................0...K...|...d.......................@....... ......................................@...............4............................text.............................. ..`.rdata..X...........................@..@.data...............................@....rsrc...............................@..@.reloc.. ...........................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\prism_sw.dll (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):86592
                                                                                                                                                                                                    Entropy (8bit):6.6935188420387375
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:1536:w8lZS4GiZd9lYzFv0TtRsSpFC5X3K7BenAe7C3xWxiKarY5:w8a4F9l6cFpFWueqWxiKqY5
                                                                                                                                                                                                    MD5:041B6BDC1B9D4B1C754CA218DD581FD4
                                                                                                                                                                                                    SHA1:6EA6D3B272FA84711857D60AD884C84C1FF63E2D
                                                                                                                                                                                                    SHA-256:BF24F085660AC8F8E81DFA04C7FD85FAB2586A5883A52AA1259BDC7483C56288
                                                                                                                                                                                                    SHA-512:E2E6F5FE1AB2B163E665199820E4EA4602FA9372359D771CCCB662E0B7F70BF688D82C172157394A6E60B55E023755E68D3F09D2B3241A74D7E24EC77D85370C
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......!3.ueRr&eRr&eRr&...&gRr&eRs&ERr&h..&fRr&h..&oRr&h..&hRr&h..&gRr&.+.&nRr&.+.&dRr&h..&dRr&.+.&dRr&RicheRr&........PE..L...CdOX...........!..............................o................................DM....@........................../..B...D4..<....p...............:..@.......\...................................0...@...............|............................text............................... ..`.rdata..*w.......x..................@..@.data...$....@....... ..............@..._RDATA.......`.......(..............@..@.rsrc........p.......0..............@..@.reloc..\............4..............@..B................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\resource.dll (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):14912
                                                                                                                                                                                                    Entropy (8bit):6.38285429926287
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:192:7WdrN32+sPFlC13XLPVlD6s+N9F5o4VUInYe+PjPriT0fwJBsRbwcKB:74Gd0p7PVlSV5nYPLr76eULB
                                                                                                                                                                                                    MD5:79AD5610814D5C9DA7F9FDF1A66814D9
                                                                                                                                                                                                    SHA1:3B6DED495AFD575B4A5FA8D332BF6DC2D5CC9C97
                                                                                                                                                                                                    SHA-256:3FB679D51CDD2F8434FB7177553F7276C98FD4E7BCF60A0AB21BB4298158A2AE
                                                                                                                                                                                                    SHA-512:329154B6C127EF7CF88DAA7735FF898C9B9032C4A4082EFD53521851F1D9BD8F7DBBE870A4EF7F53EEDC6E53E8C027EE8FD3F5C3707EFDADD931EB61AEB06DD7
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Z>Mg._#4._#4._#4.'.4._#4..4._#4..4._#4..4._#4._"4>_#4..4._#4..4._#4..4._#4..4._#4Rich._#4................PE..L...BdOX...........!......................... .....o.........................`.......E....@..........................%......\"..d....@..............."..@....P..D.... ...............................!..@............ ...............................text............................... ..`.rdata....... ......................@..@.data...`....0......................@....rsrc........@......................@..@.reloc.......P....... ..............@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\rmid.exe (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):15936
                                                                                                                                                                                                    Entropy (8bit):6.47089309000393
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:Gps65cnCse0mSHhV8/Y1ee84SzaHnYPLr7KRRi:GpshnApS/8/9e8+C7YRi
                                                                                                                                                                                                    MD5:A07322088F339B3CD49230B4BB99618C
                                                                                                                                                                                                    SHA1:A7CD4DCB02D6FC0638EA4D94B6D2AFA0FF5262A7
                                                                                                                                                                                                    SHA-256:5E1D7446F1A8ADE3558CB8BD8B4DF7DDDE24510BD396E357A6636557B2684DEF
                                                                                                                                                                                                    SHA-512:5A508F9A7545AC91D38BF932840E7100735D753A5D8678577D53A07CF830148F222409EAA62A30983D9C8C4074660B71311EC59BBE24909DA3BF6CAF0C4C0C31
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........R%^.<v^.<v^.<vW..v\.<vEx.v_.<vEx.v\.<vEx.v[.<v^.=vo.<vEx.vJ.<vEx.v_.<vEx.v_.<vRich^.<v........PE..L....[OX............................|........ ....@..........................`.......B....@.................................$#..P....@..H............&..@....P....... ...............................!..@............ ...............................text............................... ..`.rdata....... ......................@..@.data........0......................@....rsrc...H....@......................@..@.reloc.......P.......$..............@..B........................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\rmiregistry.exe (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):15936
                                                                                                                                                                                                    Entropy (8bit):6.473030915765446
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:Gps05cnKs1mSHhV8PeeeX4SziInYPLr704:GpsDniS/8PDeXhC71
                                                                                                                                                                                                    MD5:C985AF01EA996411BC9D7A13137EE457
                                                                                                                                                                                                    SHA1:C2E29EFE207081E54AD2ED22F3383D084021C11D
                                                                                                                                                                                                    SHA-256:2CA8BB2980D12A83888E1D6B568C772A649BFD7927A617780A6456F0D8C0B8D3
                                                                                                                                                                                                    SHA-512:0B4E3BC3DC1413EC9186282812DC468142BDE43E882162668052F8D2F3E8E957A3CC78E87C2C9C2F90CB9F7619A9FC3E87F2748DBAAE5CA24C7E90487243E150
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........R%^.<v^.<v^.<vW..v\.<vEx.v_.<vEx.v\.<vEx.v[.<v^.=vo.<vEx.vJ.<vEx.v_.<vEx.v_.<vRich^.<v........PE..L....[OX............................|........ ....@..........................`............@.................................4#..P....@..h............&..@....P....... ...............................!..@............ ...............................text............................... ..`.rdata....... ......................@..@.data........0......................@....rsrc...h....@......................@..@.reloc.......P.......$..............@..B........................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\servertool.exe (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):15936
                                                                                                                                                                                                    Entropy (8bit):6.47578383777715
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:GpsY5Bnr2sLmSHhV8Uo1eet4SzvBanYPLr7/EJK:Gpsinr8S/8UNetJkC7OK
                                                                                                                                                                                                    MD5:AB263A4210AE7104C31E0179AAF09721
                                                                                                                                                                                                    SHA1:7B32F5A0D53FB5772A4D46B9572D4CA1BDD25FD7
                                                                                                                                                                                                    SHA-256:215A1F849B635529566449E9ECA76AC21ACFED1C2B79E4DD8C45986FF93A4D04
                                                                                                                                                                                                    SHA-512:4F187241CBC89AF7C80EE277B6DAA78BCCF18CD2D84637806EFDEA81D21127B5A593A390B65F60E75E71F56EC458E35F29767A604B92729BE21A3EA0E3BBE3AC
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........R%^.<v^.<v^.<vW..v\.<vEx.v_.<vEx.v\.<vEx.v[.<v^.=vo.<vEx.vJ.<vEx.v_.<vEx.v_.<vRich^.<v........PE..L....[OX............................|........ ....@..........................`............@.................................D#..P....@..h............&..@....P....... ...............................!..@............ ...............................text............................... ..`.rdata....... ......................@..@.data........0......................@....rsrc...h....@......................@..@.reloc.......P.......$..............@..B........................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\splashscreen.dll (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):177216
                                                                                                                                                                                                    Entropy (8bit):6.910362272973599
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:pKiXfM0EZunzwimqWjJPo8LeEhANKl7FkGI07xmaVB9TBf5baT:oiX0L4nzoZANKT607xmaVB9TBBi
                                                                                                                                                                                                    MD5:2D8C8D7BEC612C2A1A0491E9A523FD0C
                                                                                                                                                                                                    SHA1:75F1A6C6EBA8FF1D9DC913C2611925692598FD4F
                                                                                                                                                                                                    SHA-256:0EE4E7023E17048A581368F2337DF4E67C8DD66ED616A8B06C86C3E1823657D0
                                                                                                                                                                                                    SHA-512:E8BEA855D6C674368BD896CC6E4EB1CE11461D390821E49055182AC82104C257AAA4B2F9BE2EEE40A2A95D6D9EA312988932C17EDC1D7F9EF0237223CE10926E
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................8h....z.l.....8j.....8_......_......g.......h....8^......8o.....8n.....8i....Rich...........................PE..L...BdOX...........!...............................o................................/.....@.........................P...........P.......................@...........`...................................@...............D...l...@....................text............................... ..`.rdata..M...........................@..@.data....1..........................@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\ssv.dll (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):473152
                                                                                                                                                                                                    Entropy (8bit):5.528589615049839
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:6144:0CrIfR5ApLfU6Nb4rxNXMwy5C6YEmYDqneyuRvdLY+RNBu0GxH:FkfUJs6Nb4rUwyxYEmYmeyu1oxH
                                                                                                                                                                                                    MD5:21B8DA80D65276AE5511858525FCCC88
                                                                                                                                                                                                    SHA1:A47BA73456EDD43CB638945DF3B80209473A252F
                                                                                                                                                                                                    SHA-256:E124CF7232981D211F5670647B123EF669BCA36C3D6BDFBA225F44168D18A594
                                                                                                                                                                                                    SHA-512:EE1B055B59B284DF4D7A600BB664F2AF258F6AE86ECE18BB7290F2720F2626BEB4678D36A500962A25AF7BF09B57B2E9644B79E2E2A7C7FD53FEC98A90B0780D
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......@.....@..@..@..4@..@.u2@..@.u.@..@../@..@..?@..@..@:.@k..@..@.u.@\.@.u7@..@.u6@..@.u1@..@Rich..@........PE..L...BdOX...........!.....^........... .......p.....o.........................p......E.....@.........................0D.......+...........s........... ..@.... ..46...t..................................@............p.......(.......................text...l\.......^.................. ..`.rdata.......p.......b..............@..@.data....I...P...*...8..............@....rsrc....s.......t...b..............@..@.reloc...H... ...J..................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\ssvagent.exe (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):52800
                                                                                                                                                                                                    Entropy (8bit):6.367692661513199
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:1536:aIofovBbS9KMvRe0cz6QsTPOXw2iT90ci:aIYpYX0cz6QsTPOXxiJ0R
                                                                                                                                                                                                    MD5:1C3EF5399F815FDC3C47D41CC529BCE8
                                                                                                                                                                                                    SHA1:852DC6CA36FBF7E29B84578106AD43C4C8DF1B0D
                                                                                                                                                                                                    SHA-256:EBBFEDDE9F35B321D4CC68B1FA0CF47573792A7155FFA7D2E50E25D403241655
                                                                                                                                                                                                    SHA-512:C3CBFAFBAEA0F72F120BE5847E3B889A33F20869DFACF20781E13416595B635D16E8559F7A929DFD2F46045FDDDFE4DD45A08BBF7BA822CC39EF936616FAAF34
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Hi.m...>...>...>..u>...>.Fq>...>..w>...>..C>...>.pj>...>.pz>...>...>...>c~B>...>..B>...>..s>...>..t>...>Rich...>........PE..L....^OX.................f...R.......i............@.................................L.....@.....................................x.......................@.......X...@...............................P...@...................`........................text....e.......f.................. ..`.rdata...5.......6...j..............@..@.data...............................@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\sunec.dll (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):123968
                                                                                                                                                                                                    Entropy (8bit):6.729931472912285
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:1536:FWHL4PUZ753HqpHBbq4pRdRoqgilgKptxG0ULtt1vVcn4MC0cn4MCqcn4MCZlcn7:Kpt5kq4pRVgiPe5vV/0/q/Zl/javgKRT
                                                                                                                                                                                                    MD5:35A9F5C0BF99937DE7C4B1F9CD97F3E5
                                                                                                                                                                                                    SHA1:AAFCA1D129ACE42FAD49F9A4772F7F841990D729
                                                                                                                                                                                                    SHA-256:B63423E5EC378CACF8977651AC0E66E4CBA6A35E65970E2F284C6C809410BCD7
                                                                                                                                                                                                    SHA-512:24AA5E9C1FDBF113B931F8533B55497FC5F8AD20AACA17F8828DFA4404004EEBE27B93587C1D6CFD4FB1F6204552DCA13F67FBCABC656FE8E7D121F46E7192BD
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......y..@=..=..=..4.1.?....:.<..&G>.>..=.....&G<.:..&G..>..&G.....&G9.<..&G8.<..&G?.<..Rich=..................PE..L...CdOX...........!................. .......0.....o......................................@.........................`...:...L...<.......................@............0..................................@............0...............................text............................... ..`.rdata.......0......................@..@.data...............................@....rsrc...............................@..@.reloc..>...........................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\sunmscapi.dll (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):25664
                                                                                                                                                                                                    Entropy (8bit):6.5367372882532315
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:GdZqjlfs7ZLd8RTou2L23sNmUMh16jelFBOuJIjkzIPV5UKlW5bbonYPLr7LbB:zlcHBu2q8NmUMTlFsBjk8dbyb0C7LbB
                                                                                                                                                                                                    MD5:0893E135F3F304C58CCC8A7D216097E8
                                                                                                                                                                                                    SHA1:7A7C140C50A7F0283E5B3CE011B6FACB1FD67EC6
                                                                                                                                                                                                    SHA-256:93B41671694A845445EE548622860D951B3BFF226DB8DC35582069AEF8EC5B34
                                                                                                                                                                                                    SHA-512:48EEE1E6BF8A1B9B0D31AECBCED1B81F8D3C432A7F1D83C152316ADED3CC521448EF67DE9DD77E514A09BF62DCF5C0F16F4D1A5B35E7111F7F98CFC7DFD139A5
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........O.............................;......V...............:..........................Rich....................PE..L...DdOX...........!.....(...".......3.......@.....o......................................@.........................`O.......G..d....p...............L..@...........PA..............................8D..@............@..4............................text....'.......(.................. ..`.rdata..8....@.......,..............@..@.data...`....`.......B..............@....rsrc........p.......D..............@..@.reloc..f............H..............@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\t2k.dll (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):195136
                                                                                                                                                                                                    Entropy (8bit):6.809611745177281
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:+NBDRSwyhM0HT6La7zite7ckwjxqR7+WDpa7ozGGDLylUIJ2qIcWYEfQQxIYh59I:SkwyhffKteQ3yLUGIUdljUwOJ
                                                                                                                                                                                                    MD5:4CAD2D27ECC32A6EFA49B29BB4C3A3EE
                                                                                                                                                                                                    SHA1:24B50301C0D36810E00C6A662FCE9E913550A0B6
                                                                                                                                                                                                    SHA-256:92B499CCA582CAF7C3221FD9C59997CFF2C6F57DBEADA41A80BE2E39F6725188
                                                                                                                                                                                                    SHA-512:64A0AB92B837ADE3BF39596168ECD52161CD99FDB925BB48DEDC6D171144D4EE2CC20C8F3F934FD92C6E1E8CD90D98C53824309033D1DFBBC40B1E4437264225
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......`.zS$...$...$...-..&...?>..'...?>..!...$.......?>.. ...?>......?>..%...?>..%...?>..%...Rich$...................PE..L...BdOX...........!.....f...........p.............o......................... ......U.....@.............................f...\...P.......................@...............................................@............................................text....e.......f.................. ..`.rdata..v[.......\...j..............@..@.data...............................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\tnameserv.exe (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):16448
                                                                                                                                                                                                    Entropy (8bit):6.391862720953825
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:GpseZwnvNocs0DmSHhV86Eee1cGXnYPLr7t4F:GpseqnFoE6S/86hebC7t4F
                                                                                                                                                                                                    MD5:5D883A670304684DAC4CE788DC866DC2
                                                                                                                                                                                                    SHA1:3EE8067AF2F600E6E4E6AA699BB69C1788383E5A
                                                                                                                                                                                                    SHA-256:43AB1C4D1D9676ADAD12C199A94A25EFC0AEF252A5DA9DEEC2864C3C32D46B6A
                                                                                                                                                                                                    SHA-512:355D34AF360F7CF9AFF9EE388D1C94D6B60F6F2667D42B18DC397CBED0EA0EB71A87BD3EFDFE1C894E6AE136E9D90E350415B5817A13AD4878EED17CA35C09CE
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........R%^.<v^.<v^.<vW..v\.<vEx.v_.<vEx.v\.<vEx.v[.<v^.=vo.<vEx.vJ.<vEx.v_.<vEx.v_.<vRich^.<v........PE..L....[OX............................z........ ....@..........................`......E.....@..................................#..P....@..\............(..@....P....... ..............................."..@............ ...............................text............................... ..`.rdata..J.... ......................@..@.data........0......................@....rsrc...\....@......................@..@.reloc.......P.......&..............@..B........................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\unpack.dll (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):65600
                                                                                                                                                                                                    Entropy (8bit):6.467531778100052
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:1536:alvSH88S2YYJAOd8O3nY4ZIWEQFWCdDAZO2ntOZdUKyi:mvq88sLOt3nrcQFWCdDAZO2nYZR3
                                                                                                                                                                                                    MD5:EB361320622E189EC3FAFA9AA87879E0
                                                                                                                                                                                                    SHA1:82760DDA2CF2B1ADFFB25A7E2404033808532A46
                                                                                                                                                                                                    SHA-256:8E2EDF9E342C70D4CE79AFB2712BD55EDA7585BE2924C40EFF2BF4839C67809E
                                                                                                                                                                                                    SHA-512:E7FE96792B9F58413768116749927654D18E4E4D40E37CCB381B51F2E921E386237A39BF130254B78377FDA52FF5DFC634FA82E1F73D9E56E38B9B5A31BDBA06
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........D.H%..H%..H%..A]).J%...k".I%..S.$.L%..S...D%..S.&.O%..H%..w%..S...A%..S.!.I%..S. .I%..S.'.I%..RichH%..........PE..L...BdOX...........!.........L......-..............o......................... .......y....@.....................................d.......................@...........................................p...@............................................text...>........................... ..`.rdata...-..........................@..@.data...............................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\unpack200.exe (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):159296
                                                                                                                                                                                                    Entropy (8bit):6.025878791890928
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:+ruq5zbJEeMW19gFbIFhgnkTj99TBfYEaf9zQ6NlI6xr:LgMcKUh2kLTBgEaf9zQ6Np
                                                                                                                                                                                                    MD5:62128FBE88671C6CBAC00B82E16F0071
                                                                                                                                                                                                    SHA1:F771617B24C5529543811C5513BEBBE1CF9E0529
                                                                                                                                                                                                    SHA-256:DCF4A425779F8BBB5085C156E7979FD1BBFA3EE0D9B8E39EAF20E058C7922B44
                                                                                                                                                                                                    SHA-512:86A4C7FD237040EDE2A666D9AF5770EE722B186A761A3491A811E8818C61D0038000A58990D0BA81EBC369A0ED8E6E977016A8F1C7FB70716EE1CB690228BB4A
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......ar.:%..i%..i%..i,kKi'..i.]@i&..i>.Di&..i%..in..i>.Fi ..i>.ri8..i>.si,..i>.Bi$..i>.Ei$..iRich%..i........PE..L....[OX............................J.............@......................................@..................................p..<....................V..@........... ...............................h6..@............q...............................text............................... ..`.rdata.............................@..@.data........P.......(..............@....idata..D....p.......8..............@....rsrc................B..............@..@.reloc...............J..............@..B........................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\verify.dll (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):39488
                                                                                                                                                                                                    Entropy (8bit):6.742820030986535
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:768:O7nlMXDgL2YoOBAMUnwBASqG67o+qVDh63sZOnd0TPqC7Y9:O7lMzgXAeTT6uOuzDY9
                                                                                                                                                                                                    MD5:6448CD1CC4B46CAF776A7F55A6CE15EA
                                                                                                                                                                                                    SHA1:A49A6CA2E39F7486CB7673A7B1142854D4992FF0
                                                                                                                                                                                                    SHA-256:418452AF6B736ED3481BED2DF632762386956513FDFF6AFF857A89EEE7EAB4E9
                                                                                                                                                                                                    SHA-512:6ACD2534E48A125A25D7401A67E1E0836CF60E9B38CA6372BCE68464AE8B457C849DC1278367D252C1189E82CC430E9F6643F395C68BA374C900E5B52A01A721
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......W.d....]...]...]...]...].H.]...].H.]...].H.]...]...]_..].H.]...].H.]...].H.]...].H.]...]Rich...]........................PE..L...BdOX...........!.....N...4.......W.......`.....o................................jL....@.................................<x..P.......................@...........Pa...............................v..@............`..<............................text....L.......N.................. ..`.rdata..e!...`..."...R..............@..@.data...(............t..............@....rsrc................v..............@..@.reloc...............z..............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\w2k_lsa_auth.dll (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):21568
                                                                                                                                                                                                    Entropy (8bit):6.48227716192687
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:IodIxzB8AzVR8kIo1vLmiW9LEiGTHb6hVXbS7fLsD5bGGNET7T7T7T7L6yFoynPO:JdIxz2A4q1SiW9LEiGTHb6hVXbS7QbGM
                                                                                                                                                                                                    MD5:E02145CB2D7977FDBDF0142B8CDD3665
                                                                                                                                                                                                    SHA1:D4DBD6981679BCB51875CDD8531AB66D18072060
                                                                                                                                                                                                    SHA-256:A47F187DC087DC300367AFD0F60DB02069F15C81F0B6FD249A1D4EFD58A2AD17
                                                                                                                                                                                                    SHA-512:2CE312FA0392051D72DE75B70AB95F43B04278E9FB81CE80F8DC96C2799BCC7AE29ACA12675EE46DD7A593C48C1D336C392BD73B665E1EBF92734E9BE72364E5
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......D..3..`..`..`.E.`..`.E.`..`.E `..`...`..`..`2.`.E!`..`.E.`..`.E.`..`.E.`..`Rich..`........................PE..L...BdOX...........!.........".......#.......0.....o......................................@.........................0B.......<..x....`...............<..@....p.......0...............................;..@............0...............................text............................... ..`.rdata..&....0......................@..@.data........P.......2..............@....rsrc........`.......4..............@..@.reloc..&....p.......8..............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\wsdetect.dll (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):163904
                                                                                                                                                                                                    Entropy (8bit):6.517540235798898
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:2LjX8c87qs2YGheBQIaMDL6SeroQTrlFA5gNyb:2Lj8c87L2BheBQIaMXyJTrlFAL
                                                                                                                                                                                                    MD5:CC4A4D5DECE7766C2C74BEBF0B00D0F0
                                                                                                                                                                                                    SHA1:BD7F34F7A8EA918BC85D867FE6552041AA13E234
                                                                                                                                                                                                    SHA-256:A22D1A4EC035BF00EC5479C4BE533E6B72AFA12BBEC5416AFF462439598E7655
                                                                                                                                                                                                    SHA-512:8E5727FE93D52A44848886CAF468412532981E47894A544116D6B1A0A2BFE097C961195C1724F19B5A4677461D3547F66BB9DECA52C36062907E7B64A27085C2
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........5...T.^.T.^.T.^..)^.T.^../^.T.^...^&T.^.".^.T.^.,2^.T.^.,"^.T.^.T.^MT.^...^.T.^..*^.T.^..+^.T.^..,^.T.^Rich.T.^................PE..L...DdOX...........!...............................o................................2_....@.................................D........p..P............h..@.......d...................................P...@.......................@....................text............................... ..`.rdata...d.......f..................@..@.data...`@... ..."..................@....rsrc...P....p.......(..............@..@.reloc..~/.......0...8..............@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\zip.dll (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):69696
                                                                                                                                                                                                    Entropy (8bit):6.901580195725612
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:1536:UCpYhdRItqEkQIN0X3lzaQoIOwIOpVnToIfcC5yTgrb:ERUkN+rump9TBfcCY8rb
                                                                                                                                                                                                    MD5:983F2D039CD2268692EF5858A9CE2DBE
                                                                                                                                                                                                    SHA1:FB0D00AA0C8C9E1E965B4EA84E1159EF04C240D2
                                                                                                                                                                                                    SHA-256:0BB5481B4E21E549D5997E095362F6B2C93C8E6630B3355CD9E26371EB8980E1
                                                                                                                                                                                                    SHA-512:7DD17818DC09278CA4FDD370B7D42E407718DBFB64DD309DBA695FE49D347D15B629C8DDD9AF2F46914662667202B9797A9053CD1B13614EF582A573C7BECD55
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........H....................2.................4.....................5.............................Rich............PE..L...BdOX...........!.........h.....................o.........................0.......(....@.................................L...d.......................@.... ..X...0...................................@............................................text............................... ..`.rdata..wV.......X..................@..@.data...............................@....rsrc...............................@..@.reloc....... ......................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\is-0DDTK.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Unicode text, UTF-8 (with BOM) text
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):110114
                                                                                                                                                                                                    Entropy (8bit):4.820689169327024
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:1536:Sli851WMeF1vb9nJIa1r+jQ2LpMtzs6CSTmLNUkuiYLOeBWwpZKf:L8P5o9d1r+jxQzP/yZbxQOeowpo
                                                                                                                                                                                                    MD5:AB9DB8D553033C0326BD2D38D77F84C1
                                                                                                                                                                                                    SHA1:D13CAC18FEC0C71D4A5CB550F6FA93FC60C39E45
                                                                                                                                                                                                    SHA-256:38995534DF44E0526F8C8C8D479C778A4B34627CFD69F19213CFBE019A7261BA
                                                                                                                                                                                                    SHA-512:178EABC5D8883E3E0A32F40ACDC8DB5A80CBABFA6689D3902880FE521B1A84425758F22CC7DD236416033B20A3FADCE6ACC03DB579F582BAE2C0AFFC0B2ECA5E
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:.DO NOT TRANSLATE OR LOCALIZE..***************************************************************************..%%The following software may be included in this product:.Microsoft DirectShow - Base Classes..Use of any of this software is governed by the terms of the license below:..MSDN - Information on Terms of Use..Updated: February 13, 2008..ON THIS PAGE.. * ACCEPTANCE OF TERMS. * PRIVACY AND PROTECTION OF PERSONAL INFORMATION. * NOTICE SPECIFIC TO APIs AVAILABLE ON THIS WEB SITE. * NOTICE SPECIFIC TO SOFTWARE AVAILABLE ON THIS WEB SITE. * NOTICE SPECIFIC TO DOCUMENTATION AVAILABLE ON THIS WEB SITE. * NOTICES REGARDING SOFTWARE, DOCUMENTATION, APIS AND SERVICES AVAILABLE ON.THIS WEB SITE. * RESERVATION OF RIGHTS. * MEMBER ACCOUNT, PASSWORD, AND SECURITY. * NO UNLAWFUL OR PROHIBITED USE. * USE OF SERVICES. * MATERIALS PROVIDED TO MICROSOFT OR POSTED AT ANY MICROSOFT WEB SITE. * NOTICES AND PROCEDURE FOR MAKING CLAIMS OF COPYRIGHT INFRINGEMENT. * L

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\is-1B2GM.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):40
                                                                                                                                                                                                    Entropy (8bit):4.208694969562842
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:c3AXFshzhRSjn:c9hzhgj
                                                                                                                                                                                                    MD5:98F46AB6481D87C4D77E0E91A6DBC15F
                                                                                                                                                                                                    SHA1:3E86865DEEC0814C958BCF7FB87F790BCCC0E8BD
                                                                                                                                                                                                    SHA-256:23F9A5C12FA839650595A32872B7360B9E030C7213580FB27DD9185538A5828C
                                                                                                                                                                                                    SHA-512:AC2C14C56EEA2024FCF7E871D25BCC323A40A2D1D95059C67EC231BCD710ACB8B798A8C107AAD60AAA3F14A64AA0355769AB86A481141D9A185E22CE049A91B7
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:Please refer to http://java.com/license.

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\is-9QFKL.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):46
                                                                                                                                                                                                    Entropy (8bit):4.197049999347145
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:c3AXFshzhRSkU:c9hzhgkU
                                                                                                                                                                                                    MD5:0F1123976B959AC5E8B89EB8C245C4BD
                                                                                                                                                                                                    SHA1:F90331DF1E5BADEADC501D8DD70714C62A920204
                                                                                                                                                                                                    SHA-256:963095CF8DB76FB8071FD19A3110718A42F2AB42B27A3ADFD9EC58981C3E88D2
                                                                                                                                                                                                    SHA-512:E9136FDF42A4958138732318DF0B4BA363655D97F8449703A3B3A40DDB40EEFF56363267D07939889086A500CB9C9AAF887B73EEAD06231269116110A0C0A693
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:Please refer to http://java.com/licensereadme.

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\is-E6V4P.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:HTML document, ASCII text
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):955
                                                                                                                                                                                                    Entropy (8bit):5.094001412859534
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:24:INMTdqcxtK4jXQ5VaJ2gjQo4pDW94mKDJn:TTdqIK4jXjJdso4V7B
                                                                                                                                                                                                    MD5:7A329F25E9CC132C673CD134E8134B0D
                                                                                                                                                                                                    SHA1:634D69FDD1E9B824A1E92DA00FDB6201A6D302AC
                                                                                                                                                                                                    SHA-256:6F3F130AA22B3CBEAD959E5CF0F7F626B96539EECA56BED60768E91A77823363
                                                                                                                                                                                                    SHA-512:99C9026924558381CAB0D1CD1F351D977F82953C1AB1BC99DAFE543D81DB702A1F30527DD7E33BD99219CDC21DC05688898C39E8070658AC185F82DAA3F526A4
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:<html>.<head>.<title>.Welcome to the Java(TM) Platform.</title>.</head>.<body>..<h2>Welcome to the Java<SUP><FONT SIZE=-2>TM</FONT></SUP> Platform</h2>.<p> Welcome to the Java<SUP><FONT SIZE=-2>TM</FONT></SUP> Standard Edition Runtime . Environment. This provides complete runtime support for Java applications. .<p> The runtime environment includes the Java<SUP><FONT SIZE=-2>TM</FONT></SUP> . Plug-in product which supports the Java environment inside web browsers. .<h3>References</h3>.<p>.See the <a href="http://download.oracle.com/javase/7/docs/technotes/guides/plugin/">Java Plug-in</a> product.documentation for more information on using the Java Plug-in product..<p> See the <a href=."http://www.oracle.com/technetwork/java/javase/overview/".>Java Platform</a> web site for . more information on the Java Platform. .<hr>.<font size="-2">.Copyright (c) 2006, 2017, Oracle and/or its affiliates. All rights reserved..</font>.<p>.</body>.</html>.

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\is-HT5LI.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:ISO-8859 text
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):3244
                                                                                                                                                                                                    Entropy (8bit):4.504892344419146
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:96:ikjJXQSqgbiihCrRbo+Q/cV0rDcFBL3P0/r3:icAaOi01E+xV0rDaBL3P0z3
                                                                                                                                                                                                    MD5:3DC1BFBD5BED75D650AD0506A0DF5930
                                                                                                                                                                                                    SHA1:8E79323389B9BC4B6AAD357B8BFAAB6A518FB82E
                                                                                                                                                                                                    SHA-256:621F7616B5E8538ABBC26667F28C25650A5B239A4F1ECA981F5DD60B8DA9B589
                                                                                                                                                                                                    SHA-512:74F077BC149AA459E480B5EE6117876CF67CD17D290E90F0A6045F687C42DD4E9F12133CE2459EAF905BD053E5EBA587C042040C84DA9CD2A26E415FC388B148
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:Copyright . 1993, 2017, Oracle and/or its affiliates..All rights reserved...This software and related documentation are provided under a.license agreement containing restrictions on use and.disclosure and are protected by intellectual property laws..Except as expressly permitted in your license agreement or.allowed by law, you may not use, copy, reproduce, translate,.broadcast, modify, license, transmit, distribute, exhibit,.perform, publish, or display any part, in any form, or by.any means. Reverse usering, disassembly, or.decompilation of this software, unless required by law for.interoperability, is prohibited...The information contained herein is subject to change.without notice and is not warranted to be error-free. If you.find any errors, please report them to us in writing...If this is software or related documentation that is.delivered to the U.S. Government or anyone licensing it on.behalf of the U.S. Government, the following notice is.applicable:..U.S. GOVERNMENT END US

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\is-NILG4.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Unicode text, UTF-8 text
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):177094
                                                                                                                                                                                                    Entropy (8bit):5.023336784860332
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:Yj33DuJYSqN7amC35q6dNFiG8OH8eowpQcw+4oHHZZvc9HNhJhxe+p/U0UIdKJpi:3qN2p5Jmncw+4o0HMWEyHrNRj
                                                                                                                                                                                                    MD5:745D6DB5FC58C63F74CE6A7D4DB7E695
                                                                                                                                                                                                    SHA1:A816FB5DD09E32D80E1ECF47A458569E3868B975
                                                                                                                                                                                                    SHA-256:C77BA9F668FEE7E9B810F1493E518ADF87233AC8793E4B37C9B3D1ED7846F1C0
                                                                                                                                                                                                    SHA-512:1E452DFD39566F1FF1D7EE9804076F1E0B8050A6D783D2A299788A099428B42544F9CB488D02061A62A3B8A5344252EA8A4FF0B5D4FDEC1D99DDE133DA146A22
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:DO NOT TRANSLATE OR LOCALIZE..-----------------------------..%% This notice is provided with respect to ASM Bytecode Manipulation .Framework v5.0.3, which may be included with JRE 8, and JDK 8, and .OpenJDK 8...--- begin of LICENSE ---..Copyright (c) 2000-2011 France T.l.com.All rights reserved...Redistribution and use in source and binary forms, with or without.modification, are permitted provided that the following conditions.are met:..1. Redistributions of source code must retain the above copyright. notice, this list of conditions and the following disclaimer...2. Redistributions in binary form must reproduce the above copyright. notice, this list of conditions and the following disclaimer in the. documentation and/or other materials provided with the distribution...3. Neither the name of the copyright holders nor the names of its. contributors may be used to endorse or promote products derived from. this software without specific prior written permission...THIS SOFTWAR

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\is-PT9LP.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:ASCII text, with very long lines (427)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):527
                                                                                                                                                                                                    Entropy (8bit):5.400635858865135
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:12:Gck18B8WJWJ2lsPhzVimiKEXgvQ9CDLnL3y9Ti8sBZxY2+y+E:Gcc8B8PQlsPhxREXN9CiarYfy+E
                                                                                                                                                                                                    MD5:5315D5C93B76ED601622A1E980D783E1
                                                                                                                                                                                                    SHA1:FC5642C67D55C7E5BE2435B6D294CBAE60067CAD
                                                                                                                                                                                                    SHA-256:14C8D16D378DC686BEAAC59470775BAFE38FA2659182D31EB31691F109864375
                                                                                                                                                                                                    SHA-512:86C6610202CD9A481BB219BD1C643FADED5E16028378987430C776EE838AD34A87649686FEC9DD61A3CF4F53FCB3962CC4601A6C00DEE24FB73C2B950D815365
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:JAVA_VERSION="1.8.0_121".OS_NAME="Windows".OS_VERSION="5.1".OS_ARCH="i586".SOURCE=" .:f2b5b6ab1f55 corba:386e9b79fcf5 deploy:7130ca3292fd hotspot:90f94521c351 hotspot/make/closed:bb6215e98e28 hotspot/src/closed:5c67a72be91c hotspot/test/closed:262c6cd71fd1 install:709a5016570e jaxp:b8d4e4724071 jaxws:5b8834cc3bb9 jdk:2974746e5619 jdk/make/closed:14736f778a50 jdk/src/closed:784a1cdcf90e jdk/test/closed:75844215d99a langtools:f634736433d9 nashorn:fd548ea7e156 pubs:6c3449393359 sponsors:d32775ed283a".BUILD_TYPE="commercial".

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\accessibility.properties (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):149
                                                                                                                                                                                                    Entropy (8bit):4.558376029276625
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:LFpfBZgZLXnuWxVEzERMLVAAiuKIn7IRAdSPGGzJzGBXlnfMaAHCR1vn:L7APWzTLVAkIiSPhZGBX5kaAHCXn
                                                                                                                                                                                                    MD5:2ED483DF31645D3D00C625C00C1E5A14
                                                                                                                                                                                                    SHA1:27C9B302D2D47AAE04FC1F4EF9127A2835A77853
                                                                                                                                                                                                    SHA-256:68EF2F3C6D7636E39C6626ED1BD700E3A6B796C25A9E5FECA4533ABFACD61CDF
                                                                                                                                                                                                    SHA-512:4BF6D06F2CEAF070DF4BD734370DEF74A6DD545FD40EFD64A948E1422470EF39E37A4909FEEB8F0731D5BADB3DD9086E96DACE6BDCA7BBD3078E8383B16894DA
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:#.# Load the Java Access Bridge class into the JVM.#.#assistive_technologies=com.sun.java.accessibility.AccessBridge.#screen_magnifier_present=true..

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\calendars.properties (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):1378
                                                                                                                                                                                                    Entropy (8bit):5.180680535922269
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:24:QVDBgkwOVul8DbeQd3s5MCmCkcJF+DK+Obv:KwOVu2HXy5MCmCkcJFvRL
                                                                                                                                                                                                    MD5:40A6F317D17705B4D0241F4EBB45962D
                                                                                                                                                                                                    SHA1:42EBB0988124433B8F2A6E5D9A74ED41240BCFC6
                                                                                                                                                                                                    SHA-256:D93FB6D3451D1B82256B0E31AAE7850152FA5DF76F116A9D669AA4ACE6BB68B4
                                                                                                                                                                                                    SHA-512:E4C95F8F1354833F440672C0761CE1B4895DAA52E7F143A110533F978CC6C094847AEB66636EFA6DE74B0E900FBBE79A3CC21280C4063627CE8D259068084A3A
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:# Copyright (c) 2005, 2013, Oracle and/or its affiliates. All rights reserved..# ORACLE PROPRIETARY/CONFIDENTIAL. Use is subject to license terms..#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#..#.# Japanese imperial calendar.#.# Meiji since 1868-01-01 00:00:00 local time (Gregorian).# Taisho since 1912-07-30 00:00:00 local time (Gregorian).# Showa since 1926-12-25 00:00:00 local time (Gregorian).# Heisei since 1989-01-08 00:00:00 local time (Gregorian).calendar.japanese.type: LocalGregorianCalendar.calendar.japanese.eras: \..name=Meiji,abbr=M,since=-3218832000000; \..name=Taisho,abbr=T,since=-1812153600000; \..name=Showa,abbr=S,since=-1357603200000; \..name=Heisei,abbr=H,since=600220800000..#.# Taiwanese calendar.# Minguo since 1911-01-01 00:00:00 local time (Gregorian).calendar.taiwanese.type: LocalGregorianCalendar.calendar.taiwanese.eras: \..name=MinGuo,since=-1830384000000..#.# Thai Buddhist calendar.# Buddhist Era since -542-01-01 00:00:00 local time (Gregorian).calend

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\charsets.jar (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Java archive data (JAR)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):3036922
                                                                                                                                                                                                    Entropy (8bit):6.608043156167759
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:49152:Hci3hz1nV3t3pPEH8AFMQ0rVDnvvJ1lbI6/Xw:HciRzNHRUipn3vlbIR
                                                                                                                                                                                                    MD5:9E399D57C6042B4357090F6643AAAE19
                                                                                                                                                                                                    SHA1:DA2CCC9C4774035F09001947351F3D8EBC87FA48
                                                                                                                                                                                                    SHA-256:61176279D85EE7BF67910A47D58A04D178EF11BF3CC6A89077D65EA952E4CD27
                                                                                                                                                                                                    SHA-512:C701EB337C62862AA5075D1BBD39BF5CABC539BBC7407F8096020265970F8C695509A2AC798FE1AB29274C88F650E9D3804D7ADD11EB758D56CED1C01C65CA58
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK........F..I................META-INF/....PK........F..I<:S1D...D.......META-INF/MANIFEST.MFManifest-Version: 1.0..Created-By: 1.7.0_07 (Oracle Corporation)....PK...........I./..............sun/nio/cs/ext/Big5.class.......4....]..c..d............................................................................................................................................................................................................................................................................................................... !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~...........................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\classlist (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):84355
                                                                                                                                                                                                    Entropy (8bit):4.927199323446014
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:1536:4X/nxfn5rxLyMznYolTzlff5OK3COHoHNG5rb/cxNwmCX1g86K2oWdAqNqc+KMjD:qxn5rxLyMzbf5OK3CJNG51g86A
                                                                                                                                                                                                    MD5:7FC71A62D85CCF12996680A4080AA44E
                                                                                                                                                                                                    SHA1:199DCCAA94E9129A3649A09F8667B552803E1D0E
                                                                                                                                                                                                    SHA-256:01FE24232D0DBEFE339F88C44A3FD3D99FF0E17AE03926CCF90B835332F5F89C
                                                                                                                                                                                                    SHA-512:B0B9B486223CF79CCF9346AAF5C1CA0F9588247A00C826AA9F3D366B7E2EF905AF4D179787DCB02B32870500FD63899538CF6FAFCDD9B573799B255F658CEB1D
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:java/lang/Object..java/lang/String..java/io/Serializable..java/lang/Comparable..java/lang/CharSequence..java/lang/Class..java/lang/reflect/GenericDeclaration..java/lang/reflect/AnnotatedElement..java/lang/reflect/Type..java/lang/Cloneable..java/lang/ClassLoader..java/lang/System..java/lang/Throwable..java/lang/Error..java/lang/ThreadDeath..java/lang/Exception..java/lang/RuntimeException..java/lang/SecurityManager..java/security/ProtectionDomain..java/security/AccessControlContext..java/security/SecureClassLoader..java/lang/ClassNotFoundException..java/lang/ReflectiveOperationException..java/lang/NoClassDefFoundError..java/lang/LinkageError..java/lang/ClassCastException..java/lang/ArrayStoreException..java/lang/VirtualMachineError..java/lang/OutOfMemoryError..java/lang/StackOverflowError..java/lang/IllegalMonitorStateException..java/lang/ref/Reference..java/lang/ref/SoftReference..java/lang/ref/WeakReference..java/lang/ref/FinalReference..java/lang/ref/PhantomReference..sun/misc/Cleaner

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\cmm\CIEXYZ.pf (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Sun KCMS color profile 2.0, type KCMS, XYZ/XYZ-spac device, 51236 bytes, 2-12-1997 18:50:04, dependently, PCS X=0xf6b3 Z=0xd2f8 "XYZ to XYZ Identity Profile"
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):51236
                                                                                                                                                                                                    Entropy (8bit):7.226972359973779
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:1536:2Qnt0y7xFNksbeCqY39JJ8GmaNo68GmaNo68GmaNoW:JOy7xXjtqYNfHxNo6HxNo6HxNoW
                                                                                                                                                                                                    MD5:10F23396E21454E6BDFB0DB2D124DB85
                                                                                                                                                                                                    SHA1:B7779924C70554647B87C2A86159CA7781E929F8
                                                                                                                                                                                                    SHA-256:207D748A76C10E5FA10EC7D0494E31AB72F2BACAB591371F2E9653961321FE9C
                                                                                                                                                                                                    SHA-512:F5C5F9FC3C4A940D684297493902FD46F6AA5248D2B74914CA5A688F0BAD682831F6060E2264326D2ECB1F3544831EB1FA029499D1500EA4BFE3B97567FE8444
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:...$KCMS....spacXYZ XYZ .........2..acspSUNW....KODA.ODA............................................................................A2B0.......4B2A0.......4cprt.......Gwtpt...T....desc...h....K070........K071........mft2................................................................................................................ !!""##$$%%&&''(())**++,,--..//00112233445566778899::;;<<==>>??@@AABBCCDDEEFFGGHHIIJJKKLLMMNNOOPPQQRRSSTTUUVVWWXXYYZZ[[\\]]^^__``aabbccddeeffgghhiijjkkllmmnnooppqqrrssttuuvvwwxxyyzz{{||}}~~.................................................................................................................................................................................................................................................................................................................................. !!""##$$%%&&''(())**++,,--..//00112233445566778899::;;<<==>>??@@AABBCCDDEEFFGGHHIIJJKKLLMMNNOOPPQQRRSSTTUUVVWWXXYYZZ[[\\]]^^__``aabbccddeeffgghhiijjkkllmm

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\cmm\GRAY.pf (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Sun KCMS color profile 2.0, type KCMS, GRAY/XYZ-mntr device, KODA/GRAY model, 632 bytes, 27-7-95 17:30:15, embedded, relative colorimetric, PCS Z=0xd32b "KODAK Grayscale Conversion - Gamma 1.0"
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):632
                                                                                                                                                                                                    Entropy (8bit):3.7843698642539243
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:12:51AP3fJgXQ531yqQac/lkgz42WlHlYujlOl9Fhl:vA2XQCqpUlkgzulHiXl3hl
                                                                                                                                                                                                    MD5:1002F18FC4916F83E0FC7E33DCC1FA09
                                                                                                                                                                                                    SHA1:27F93961D66B8230D0CDB8B166BC8B4153D5BC2D
                                                                                                                                                                                                    SHA-256:081CAAC386D968ADD4C2D722776E259380DCF78A306E14CC790B040AB876D424
                                                                                                                                                                                                    SHA-512:334D932D395B46DFC619576B391F2ADC2617E345AFF032B592C25E333E853735DA8B286EF7542EB19059CDE8215CDCEA147A3419ED56BDD6006CA9918D0618E1
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:...xKCMS....mntrGRAYXYZ ._..........acspSUNW....KODAGRAY.......................+....................................................cprt.......?desc........dmnd.......`wtpt........kTRC........dmdd.......dtext....COPYRIGHT (c) 1997 Eastman Kodak, All rights reserved...desc.......'KODAK Grayscale Conversion - Gamma 1.0..................@...............~.......................~.......~..............desc........KODAK..................@..................................................,...,....XYZ ...............+curv............desc........Grayscale..................@..................................................,...,....

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\cmm\LINEAR_RGB.pf (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:color profile 2.0, type KCMS, RGB/XYZ-mntr device by KODK, 1044 bytes, 2-2-1998, PCS Z=0xd32c "linear sRGB"
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):1044
                                                                                                                                                                                                    Entropy (8bit):6.510788634170065
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:6:zwuau/7De0/q98EAsBIMD/WvaKIV4R0/lCAEdD0WlV9AEdwKKt/n3knR3lfR/NHD:zw7ePB/rEAsBIkVuUlAYKu/nUnKw
                                                                                                                                                                                                    MD5:A387B65159C9887265BABDEF9CA8DAE5
                                                                                                                                                                                                    SHA1:7913274C2F73BAFCF888F09FF60990B100214EDE
                                                                                                                                                                                                    SHA-256:712036AA1951427D42E3E190E714F420CA8C2DD97EF01FCD0675EE54B920DB46
                                                                                                                                                                                                    SHA-512:359D9B57215855F6794E47026C06036B93710998205D0817C6E602B2A24DAEB92537C388F129407461FC60180198F02A236AEB349A17430ED7AC85A1E5F71350
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:....KCMS....mntrRGB XYZ ............acsp........KODK...........................,KODK................................................cprt.......Hdesc...8....rXYZ........gXYZ........bXYZ........rTRC........gTRC........bTRC........wtpt........text....Copyright (c) Eastman Kodak Company, 1998, all rights reserved..desc........linear sRGB............l.i.n.e.a.r. .s.R.G.B.....linear sRGB........................................................XYZ ......m...6.....XYZ ......e........!XYZ ......#B...^...Kcurv........................................................................ !!""##$$%%&&''(())**++,,--..//00112233445566778899::;;<<==>>??@@AABBCCDDEEFFGGHHIIJJKKLLMMNNOOPPQQRRSSTTUUVVWWXXYYZZ[[\\]]^^__``aabbccddeeffgghhiijjkkllmmnnooppqqrrssttuuvvwwxxyyzz{{||}}~~..........................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\cmm\PYCC.pf (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Sun KCMS color profile 2.0, type KCMS, 3CLR/Lab-spac device, 274474 bytes, 6-11-1996 7:50:04, PCS X=0xf6b3 Z=0xd2f8 "Std Photo YCC Print"
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):274474
                                                                                                                                                                                                    Entropy (8bit):7.843290819622709
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:6144:nJleRNRyAnAqNaADEJHeeeeevoAuaiqwV6sg0pUjRVgYgI:nJleRNRpN0j3qhjRC9I
                                                                                                                                                                                                    MD5:24B9DEE2469F9CC8EC39D5BDB3901500
                                                                                                                                                                                                    SHA1:4F7EED05B8F0EEA7BCDC8F8F7AAEB1925CE7B144
                                                                                                                                                                                                    SHA-256:48122294B5C08C69B7FE1DB28904969DCB6EDC9AA5076E3F8768BF48B76204D0
                                                                                                                                                                                                    SHA-512:D23CE2623DE400216D249602486F21F66398B75196E80E447143D058A07438919A78AE0ED2DDF8E80D20BD70A635D51C9FB300E9F08A4751E00CD21883B88693
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:..0*KCMS....spac3CLRLab .........2..acspSUNW....KODAnone............................................................................A2B0... ...4B2A0...T..f4cprt..-....Gdmnd..-....ndmdd...@...zwtpt........desc.......nK013../@....K019../L....K030../.....K031..0.....K070..0.....K071..0 ....mft2.....................................................K.S.8.....l.....0...3.........U.. .!h".$.%\&.'.)5*y+.,..5/o0.1.3.4E5v6.7.8.:*;S<z=.>.?.A.B,CLDkE.F.G.H.I.K.L!M7NLO`PsQ.R.S.T.U.V.W.X.Y.[.\.].^._%`,a2b8c=dAeEfHgJhLiMjMkMlLmKnIoFpCq@r;s7t1u,v%w.x.y.z.z.{.|.}.~...............p.b.S.C.3.#..............~.j.U.@.+.............t.\.C.*...........r.W.;...........p.R.3..........w.V.6.........l.J.'........v.R.-.......t.N.(.......f.?........v.N.%........U.+.......U.*......z.N."......n.@.......Z.+......o.@.........P. .......\.+.......d.1...........................z.p.f.[.Q.G.=.3.). ........................ .!.".#.$.%.&{'s(k)d*]+U,N-G.@/9021,2%3.4.5.6.7.8.8.9.:.;.<.=.>.?.@.A.B.C.D.E.F.

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\cmm\is-384J0.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Sun KCMS color profile 2.0, type KCMS, XYZ/XYZ-spac device, 51236 bytes, 2-12-1997 18:50:04, dependently, PCS X=0xf6b3 Z=0xd2f8 "XYZ to XYZ Identity Profile"
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):51236
                                                                                                                                                                                                    Entropy (8bit):7.226972359973779
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:1536:2Qnt0y7xFNksbeCqY39JJ8GmaNo68GmaNo68GmaNoW:JOy7xXjtqYNfHxNo6HxNo6HxNoW
                                                                                                                                                                                                    MD5:10F23396E21454E6BDFB0DB2D124DB85
                                                                                                                                                                                                    SHA1:B7779924C70554647B87C2A86159CA7781E929F8
                                                                                                                                                                                                    SHA-256:207D748A76C10E5FA10EC7D0494E31AB72F2BACAB591371F2E9653961321FE9C
                                                                                                                                                                                                    SHA-512:F5C5F9FC3C4A940D684297493902FD46F6AA5248D2B74914CA5A688F0BAD682831F6060E2264326D2ECB1F3544831EB1FA029499D1500EA4BFE3B97567FE8444
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:...$KCMS....spacXYZ XYZ .........2..acspSUNW....KODA.ODA............................................................................A2B0.......4B2A0.......4cprt.......Gwtpt...T....desc...h....K070........K071........mft2................................................................................................................ !!""##$$%%&&''(())**++,,--..//00112233445566778899::;;<<==>>??@@AABBCCDDEEFFGGHHIIJJKKLLMMNNOOPPQQRRSSTTUUVVWWXXYYZZ[[\\]]^^__``aabbccddeeffgghhiijjkkllmmnnooppqqrrssttuuvvwwxxyyzz{{||}}~~.................................................................................................................................................................................................................................................................................................................................. !!""##$$%%&&''(())**++,,--..//00112233445566778899::;;<<==>>??@@AABBCCDDEEFFGGHHIIJJKKLLMMNNOOPPQQRRSSTTUUVVWWXXYYZZ[[\\]]^^__``aabbccddeeffgghhiijjkkllmm

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\cmm\is-DQCCG.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Sun KCMS color profile 2.0, type KCMS, GRAY/XYZ-mntr device, KODA/GRAY model, 632 bytes, 27-7-95 17:30:15, embedded, relative colorimetric, PCS Z=0xd32b "KODAK Grayscale Conversion - Gamma 1.0"
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):632
                                                                                                                                                                                                    Entropy (8bit):3.7843698642539243
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:12:51AP3fJgXQ531yqQac/lkgz42WlHlYujlOl9Fhl:vA2XQCqpUlkgzulHiXl3hl
                                                                                                                                                                                                    MD5:1002F18FC4916F83E0FC7E33DCC1FA09
                                                                                                                                                                                                    SHA1:27F93961D66B8230D0CDB8B166BC8B4153D5BC2D
                                                                                                                                                                                                    SHA-256:081CAAC386D968ADD4C2D722776E259380DCF78A306E14CC790B040AB876D424
                                                                                                                                                                                                    SHA-512:334D932D395B46DFC619576B391F2ADC2617E345AFF032B592C25E333E853735DA8B286EF7542EB19059CDE8215CDCEA147A3419ED56BDD6006CA9918D0618E1
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:...xKCMS....mntrGRAYXYZ ._..........acspSUNW....KODAGRAY.......................+....................................................cprt.......?desc........dmnd.......`wtpt........kTRC........dmdd.......dtext....COPYRIGHT (c) 1997 Eastman Kodak, All rights reserved...desc.......'KODAK Grayscale Conversion - Gamma 1.0..................@...............~.......................~.......~..............desc........KODAK..................@..................................................,...,....XYZ ...............+curv............desc........Grayscale..................@..................................................,...,....

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\cmm\is-KPTA7.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:color profile 2.0, type KCMS, RGB/XYZ-mntr device by KODK, 1044 bytes, 2-2-1998, PCS Z=0xd32c "linear sRGB"
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):1044
                                                                                                                                                                                                    Entropy (8bit):6.510788634170065
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:6:zwuau/7De0/q98EAsBIMD/WvaKIV4R0/lCAEdD0WlV9AEdwKKt/n3knR3lfR/NHD:zw7ePB/rEAsBIkVuUlAYKu/nUnKw
                                                                                                                                                                                                    MD5:A387B65159C9887265BABDEF9CA8DAE5
                                                                                                                                                                                                    SHA1:7913274C2F73BAFCF888F09FF60990B100214EDE
                                                                                                                                                                                                    SHA-256:712036AA1951427D42E3E190E714F420CA8C2DD97EF01FCD0675EE54B920DB46
                                                                                                                                                                                                    SHA-512:359D9B57215855F6794E47026C06036B93710998205D0817C6E602B2A24DAEB92537C388F129407461FC60180198F02A236AEB349A17430ED7AC85A1E5F71350
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:....KCMS....mntrRGB XYZ ............acsp........KODK...........................,KODK................................................cprt.......Hdesc...8....rXYZ........gXYZ........bXYZ........rTRC........gTRC........bTRC........wtpt........text....Copyright (c) Eastman Kodak Company, 1998, all rights reserved..desc........linear sRGB............l.i.n.e.a.r. .s.R.G.B.....linear sRGB........................................................XYZ ......m...6.....XYZ ......e........!XYZ ......#B...^...Kcurv........................................................................ !!""##$$%%&&''(())**++,,--..//00112233445566778899::;;<<==>>??@@AABBCCDDEEFFGGHHIIJJKKLLMMNNOOPPQQRRSSTTUUVVWWXXYYZZ[[\\]]^^__``aabbccddeeffgghhiijjkkllmmnnooppqqrrssttuuvvwwxxyyzz{{||}}~~..........................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\cmm\is-MSS51.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Microsoft color profile 2.1, type Lino, RGB/XYZ-mntr device, IEC/sRGB model by HP, 3144 bytes, 9-2-1998 6:49:00 "sRGB IEC61966-2.1"
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):3144
                                                                                                                                                                                                    Entropy (8bit):7.026867070945169
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:48:+FflsXlf/lulel4wlwx+6MjnNsvIYWiR5QkyTJbZPHXZ9u6gbVwyKzJgWjU:aN26MT0D5MdtbZPAVwzV0
                                                                                                                                                                                                    MD5:1D3FDA2EDB4A89AB60A23C5F7C7D81DD
                                                                                                                                                                                                    SHA1:9EAEA0911D89D63E39E95F2E2116EAEC7E0BB91E
                                                                                                                                                                                                    SHA-256:2B3AA1645779A9E634744FAF9B01E9102B0C9B88FD6DECED7934DF86B949AF7E
                                                                                                                                                                                                    SHA-512:16AAE81ACF757036634B40FB8B638D3EBA89A0906C7F95BD915BC3579E3BE38C7549EE4CD3F344EF0A17834FF041F875B9370230042D20B377C562952C47509B
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:...HLino....mntrRGB XYZ .........1..acspMSFT....IEC sRGB.......................-HP ................................................cprt...P...3desc.......lwtpt........bkpt........rXYZ........gXYZ...,....bXYZ...@....dmnd...T...pdmdd........vued...L....view.......$lumi........meas.......$tech...0....rTRC...<....gTRC...<....bTRC...<....text....Copyright (c) 1998 Hewlett-Packard Company..desc........sRGB IEC61966-2.1............sRGB IEC61966-2.1..................................................XYZ .......Q........XYZ ................XYZ ......o...8.....XYZ ......b.........XYZ ......$.........desc........IEC http://www.iec.ch............IEC http://www.iec.ch..............................................desc........IEC 61966-2.1 Default RGB colour space - sRGB............IEC 61966-2.1 Default RGB colour space - sRGB......................desc.......,Reference Viewing Condition in IEC61966-2.1...........,Reference Viewing Condition in IEC61966-2.1..........................view.........._.....

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\cmm\is-UJBLV.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Sun KCMS color profile 2.0, type KCMS, 3CLR/Lab-spac device, 274474 bytes, 6-11-1996 7:50:04, PCS X=0xf6b3 Z=0xd2f8 "Std Photo YCC Print"
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):274474
                                                                                                                                                                                                    Entropy (8bit):7.843290819622709
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:6144:nJleRNRyAnAqNaADEJHeeeeevoAuaiqwV6sg0pUjRVgYgI:nJleRNRpN0j3qhjRC9I
                                                                                                                                                                                                    MD5:24B9DEE2469F9CC8EC39D5BDB3901500
                                                                                                                                                                                                    SHA1:4F7EED05B8F0EEA7BCDC8F8F7AAEB1925CE7B144
                                                                                                                                                                                                    SHA-256:48122294B5C08C69B7FE1DB28904969DCB6EDC9AA5076E3F8768BF48B76204D0
                                                                                                                                                                                                    SHA-512:D23CE2623DE400216D249602486F21F66398B75196E80E447143D058A07438919A78AE0ED2DDF8E80D20BD70A635D51C9FB300E9F08A4751E00CD21883B88693
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:..0*KCMS....spac3CLRLab .........2..acspSUNW....KODAnone............................................................................A2B0... ...4B2A0...T..f4cprt..-....Gdmnd..-....ndmdd...@...zwtpt........desc.......nK013../@....K019../L....K030../.....K031..0.....K070..0.....K071..0 ....mft2.....................................................K.S.8.....l.....0...3.........U.. .!h".$.%\&.'.)5*y+.,..5/o0.1.3.4E5v6.7.8.:*;S<z=.>.?.A.B,CLDkE.F.G.H.I.K.L!M7NLO`PsQ.R.S.T.U.V.W.X.Y.[.\.].^._%`,a2b8c=dAeEfHgJhLiMjMkMlLmKnIoFpCq@r;s7t1u,v%w.x.y.z.z.{.|.}.~...............p.b.S.C.3.#..............~.j.U.@.+.............t.\.C.*...........r.W.;...........p.R.3..........w.V.6.........l.J.'........v.R.-.......t.N.(.......f.?........v.N.%........U.+.......U.*......z.N."......n.@.......Z.+......o.@.........P. .......\.+.......d.1...........................z.p.f.[.Q.G.=.3.). ........................ .!.".#.$.%.&{'s(k)d*]+U,N-G.@/9021,2%3.4.5.6.7.8.8.9.:.;.<.=.>.?.@.A.B.C.D.E.F.

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\cmm\sRGB.pf (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Microsoft color profile 2.1, type Lino, RGB/XYZ-mntr device, IEC/sRGB model by HP, 3144 bytes, 9-2-1998 6:49:00 "sRGB IEC61966-2.1"
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):3144
                                                                                                                                                                                                    Entropy (8bit):7.026867070945169
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:48:+FflsXlf/lulel4wlwx+6MjnNsvIYWiR5QkyTJbZPHXZ9u6gbVwyKzJgWjU:aN26MT0D5MdtbZPAVwzV0
                                                                                                                                                                                                    MD5:1D3FDA2EDB4A89AB60A23C5F7C7D81DD
                                                                                                                                                                                                    SHA1:9EAEA0911D89D63E39E95F2E2116EAEC7E0BB91E
                                                                                                                                                                                                    SHA-256:2B3AA1645779A9E634744FAF9B01E9102B0C9B88FD6DECED7934DF86B949AF7E
                                                                                                                                                                                                    SHA-512:16AAE81ACF757036634B40FB8B638D3EBA89A0906C7F95BD915BC3579E3BE38C7549EE4CD3F344EF0A17834FF041F875B9370230042D20B377C562952C47509B
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:...HLino....mntrRGB XYZ .........1..acspMSFT....IEC sRGB.......................-HP ................................................cprt...P...3desc.......lwtpt........bkpt........rXYZ........gXYZ...,....bXYZ...@....dmnd...T...pdmdd........vued...L....view.......$lumi........meas.......$tech...0....rTRC...<....gTRC...<....bTRC...<....text....Copyright (c) 1998 Hewlett-Packard Company..desc........sRGB IEC61966-2.1............sRGB IEC61966-2.1..................................................XYZ .......Q........XYZ ................XYZ ......o...8.....XYZ ......b.........XYZ ......$.........desc........IEC http://www.iec.ch............IEC http://www.iec.ch..............................................desc........IEC 61966-2.1 Default RGB colour space - sRGB............IEC 61966-2.1 Default RGB colour space - sRGB......................desc.......,Reference Viewing Condition in IEC61966-2.1...........,Reference Viewing Condition in IEC61966-2.1..........................view.........._.....

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\content-types.properties (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):5548
                                                                                                                                                                                                    Entropy (8bit):5.037985807321917
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:96:r45Vf4fq7MBzO4pYEZ2MQ6KXr3NO0slzMX+W1CuHvvABbiAQ+xaW/ioLHTU+Wsch:r4KJO4mEZ2MQ6Cr3NO0slzMX+WIuHvvv
                                                                                                                                                                                                    MD5:F507712B379FDC5A8D539811FAF51D02
                                                                                                                                                                                                    SHA1:82BB25303CF6835AC4B076575F27E8486DAB9511
                                                                                                                                                                                                    SHA-256:46F47B3883C7244A819AE1161113FE9D2375F881B75C9B3012D7A6B3497E030A
                                                                                                                                                                                                    SHA-512:CB3C99883336D04C42CEA9C2401E81140ECBB7FC5B8EF3301B13268A45C1AC93FD62176AB8270B91528AC8E938C7C90CC9663D8598E224794354546139965DFE
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:#sun.net.www MIME content-types table.#.# Property fields:.#.# <description> ::= 'description' '=' <descriptive string>.# <extensions> ::= 'file_extensions' '=' <comma-delimited list, include '.'>.# <image> ::= 'icon' '=' <filename of icon image>.# <action> ::= 'browser' | 'application' | 'save' | 'unknown'.# <application> ::= 'application' '=' <command line template>.#..#.# The "we don't know anything about this data" type(s)..# Used internally to mark unrecognized types..#.content/unknown: description=Unknown Content.unknown/unknown: description=Unknown Data Type..#.# The template we should use for temporary files when launching an application.# to view a document of given type..#.temp.file.template: c:\\temp\\%s..#.# The "real" types..#.application/octet-stream: \..description=Generic Binary Stream;\..file_extensions=.saveme,.dump,.hqx,.arc,.obj,.lib,.bin,.exe,.zip,.gz..application/oda: \..description=ODA Document;\..file_extensions=.oda..application/pdf: \..de

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\currency.data (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):4122
                                                                                                                                                                                                    Entropy (8bit):3.2585384283455134
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:48:BlWxFFGFSupi94blATFxjGph5vLC6/w37ZXQTbVm/eVzOBJ:BlWJEi94blAT+ph5vLkApmGqr
                                                                                                                                                                                                    MD5:F6258230B51220609A60AA6BA70D68F3
                                                                                                                                                                                                    SHA1:B5B95DD1DDCD3A433DB14976E3B7F92664043536
                                                                                                                                                                                                    SHA-256:22458853DA2415F7775652A7F57BB6665F83A9AE9FB8BD3CF05E29AAC24C8441
                                                                                                                                                                                                    SHA-512:B2DFCFDEBF9596F2BB05F021A24335F1EB2A094DCA02B2D7DD1B7C871D5EECDA7D50DA7943B9F85EDB5E92D9BE6B6ADFD24673CE816DF3960E4D68C7F894563F
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:CurD..........................@C..,M...................... K...C..PF..4@...........R...........C......TF...........M..DL...C.......S..........<M...c...................C...C...A..........hK...C...M.......... O......8...PC...C..........@E...............E..............`.......pX...O...........B...C.......O...D..............,J..........................................@J..............XO..........................................0C...........................O...........................................M.......A...............................................................C...O...................................................................O..........TK...........R...O..............8C...........................P.................. C..............................................`C..........PK...............J......0F..pE...................................Q...............................R.......Q...........c...Q...................................................................................C

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\deploy.jar (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Java archive data (JAR)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):5014514
                                                                                                                                                                                                    Entropy (8bit):6.572049680612901
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:49152:qVlKtT3nO37H8TieZmOGkaBIWAg78uykL5U1xUPn4qQG0K:rs7jFUTUP4g0K
                                                                                                                                                                                                    MD5:741F19422CA038C0E025AF1086256D9E
                                                                                                                                                                                                    SHA1:237FC913646B36ABA63592E6C948E60161D7FE27
                                                                                                                                                                                                    SHA-256:41325FA84D9212D63843001754A548F6C5D90458AE47E109FA1677D9DED75D5C
                                                                                                                                                                                                    SHA-512:DD4B7B2CF02A15B1338BE1EAE1153D32AFFB0BB2EEDFDF75A6BFE262EF1CAB5745E9656172BDE7821C8D6F381FC0D88F185E9234739358F87CD80C1271642013
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK.........I................META-INF/....PK.........Iu/u*e...e.......META-INF/MANIFEST.MFManifest-Version: 1.0..Ant-Version: Apache Ant 1.7.1..Created-By: 25.121-b13 (Oracle Corporation)....PK.........I................com/PK.........I................com/oracle/PK.........I................com/oracle/deploy/PK.........I................com/oracle/deploy/update/PK.........I................com/sun/PK.........I................com/sun/applet2/PK.........I................com/sun/applet2/preloader/PK.........I............ ...com/sun/applet2/preloader/event/PK.........I................com/sun/deploy/PK.........I................com/sun/deploy/appcontext/PK.........I................com/sun/deploy/association/PK.........I............#...com/sun/deploy/association/utility/PK.........I................com/sun/deploy/cache/PK.........I................com/sun/deploy/config/PK.........I................com/sun/deploy/jardiff/PK.........I................com/sun/deploy/mo

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\deploy\ffjcext.zip (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v1.0 to extract, compression method=store
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):14156
                                                                                                                                                                                                    Entropy (8bit):5.744910434735822
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:48:ZCbLI+R9wTdWTe3WPu20kPjd5GyOa17T3rce7sH1l/CdOAd4pD0ACBWpgzT6j/lZ:cl56Qzjd51f7fZGWPmpaeGjHojn
                                                                                                                                                                                                    MD5:821A76771E3F87FD065108A943FE9D70
                                                                                                                                                                                                    SHA1:9CFBD943985C1FB048949DC9C7BEDF99AFFD76AA
                                                                                                                                                                                                    SHA-256:90A87FA5E8B53DD03523458722F47D0B9E52509B971E3B3E348F5BEFB9D0ECEF
                                                                                                                                                                                                    SHA-512:FFBF867EB4CC8DF5CF4DC14556A22E9A5E79242A02881682FD3E363E9A3C8F60BC0A09B970511ABB1823BBEA70D00F220BC642239EBD6E64614861CF84FB1FED
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK........,..I............'...{CAFEEFAC-0018-0000-0121-ABCDEFFEDCBA}/UT....]OX.]OXux..........)..PK........+..I................{CAFEEFAC-0018-0000-0121-ABCDEFFEDCBA}/chrome/UT....]OX.]OXux..........)..PK........+..I............6...{CAFEEFAC-0018-0000-0121-ABCDEFFEDCBA}/chrome/content/UT....]OX.]OXux..........)..PK........+..I............>...{CAFEEFAC-0018-0000-0121-ABCDEFFEDCBA}/chrome/content/ffjcext/UT....]OX.]OXux..........)..PK........+..I..M.........H...{CAFEEFAC-0018-0000-0121-ABCDEFFEDCBA}/chrome/content/ffjcext/ffjcext.jsUT....]OX.]OXux..........)..const gJavaConsole1_8_0_121 = {...id.: "javaconsole1.8.0_121",...mimeType: "application/x-java-applet;jpi-version=1.8.0_121",...install.: function() {...window.addEventListener("load",this.init,false);..},...init.: function() { ...if (navigator.mimeTypes[gJavaConsole1_8_0_121.mimeType]) {....var toolsPopup = document.getElementById("menu_ToolsPopup");.....toolsPopup.addEventListener("popupshowing",gJavaConsole1_8_0_121.enable,false)

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\deploy\is-36PC6.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:ASCII text, with very long lines (1475)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):3600
                                                                                                                                                                                                    Entropy (8bit):4.74546152535042
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:96:ovLS0y45dMsqf52i3nkrBpW/QiQdjY0CQ1G:oTSWw3foFNp71G
                                                                                                                                                                                                    MD5:6D32848BD173B9444B71922616E0645E
                                                                                                                                                                                                    SHA1:1B0334B79DB481C3A59BE6915D5118D760C97BAA
                                                                                                                                                                                                    SHA-256:BE987D93E23AB7318DB095727DEDD8461BA6D98B9409EF8FC7F5C79FA9666B84
                                                                                                                                                                                                    SHA-512:8E9E92D3229FF80761010E4878B4A33BFB9F0BD053040FE152565CFB2819467E9A92609B3786F9BDBF0D7934CF3C7D20BC3369FE1AD7D0DF7FADF561C3FDCA3C
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:#.# Copyright (c) 2004, 2013, Oracle and/or its affiliates. All rights reserved..# ORACLE PROPRIETARY/CONFIDENTIAL. Use is subject to license terms..#..error.internal.badmsg=Error interno, mensaje desconocido.error.badinst.nojre=Instalaci\u00F3n incorrecta. No se ha encontrado JRE en el archivo de configuraci\u00F3n.error.launch.execv=Se ha encontrado un error al llamar a Java Web Start (execv).error.launch.sysexec=Se ha encontrado un error al llamar a Java Web Start (SysExec) .error.listener.failed=Pantalla de Presentaci\u00F3n: fallo de sysCreateListenerSocket.error.accept.failed=Pantalla de Presentaci\u00F3n: fallo de accept.error.recv.failed=Pantalla de Presentaci\u00F3n: fallo de recv.error.invalid.port=Pantalla de Presentaci\u00F3n: no se ha activado un puerto v\u00E1lido.error.read=Lectura m\u00E1s all\u00E1 del final del buffer.error.xmlparsing=Error de an\u00E1lisis de XML: se ha encontrado un tipo de token no v\u00E1lido.error.splash.exit=Saliendo del proceso de la pantalla d

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\deploy\is-3IV2D.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:GIF image data, version 89a, 640 x 278
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):12250
                                                                                                                                                                                                    Entropy (8bit):7.901446927123525
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:192:Zzv4QPei/ueMFJ2M4xSGb/xGEyddpTa7Kv9I1BDc3KR3q6xmwJePYueHjAPZKGMr:5vTWvmxSGbkpTaYe1dc3KR3q7wJsOHmu
                                                                                                                                                                                                    MD5:3FE2013854A5BDAA488A6D7208D5DDD3
                                                                                                                                                                                                    SHA1:D2BFF9BBF7920CA743B81A0EE23B0719B4D057CA
                                                                                                                                                                                                    SHA-256:FC39D09D187739E580E47569556DE0D19AF28B53DF5372C7E0538FD26EDB7988
                                                                                                                                                                                                    SHA-512:E3048E8E0C22F6B200E5275477309083AA0435C0F33D1994C10CE65A52F357EE7CF7081F85C00876F438DFA1EE59B542D602287EC02EA340BFDF90C0C6ABD548
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:GIF89a.......{.....k......{...........P|.b..V......................Hr.Hq.......................]...........X...........f.............i............R~....u..It.u.....l..T~.......Qz.......^..Q~....i.......b.............Qx.Y..Y.....q..p.....v..............a..U|......T..Y........................^..n........f.....Tz.e..j..f..Ox.p..Y~.Ov.......y..Z..h.....l.....W.....w.....R|.p.....X~.a........Pw.Ks.Ir.......^.....Kt.FFF\........Ox...........W..U..Nw.Mu.W..V..Is.V..Hr.R~.W..W..U..T..O{.Kv.Gp.S..Mx.Lw.Fp.Lw.U..T..Jt.R..Gq.Fo.Ju.My.R..Q}.R~.Nz.Oz.It.Nz.V..V..Gp.Ny.Ku.P|.Ku.Gq.P}.S..Q}.S..S..Is.Lx.U..O{.Hs.T..O{.My.Mx.Kv.Lv............iii...YYY.............xxx........._.....U..Gp.U..Lv.Mw....Oz......S|.S}.Hq.\..Kv....Mv.P{.W..T........Mw.T.....Nz.q..Fo.......!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c014 79.156797, 2014/08/20-09:53:02 "> <rdf:RDF xmlns:rdf="ht

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\deploy\is-5OIG7.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:ASCII text, with very long lines (2601)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):5712
                                                                                                                                                                                                    Entropy (8bit):4.758283080201437
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:96:fiX7fdokXLqlz9yx3f7yhJxpmG32i0HkZr+ywc8b8+/moD7yct070DL70Dj:g7ucLoINAYGbT/44i4
                                                                                                                                                                                                    MD5:FED33982E349F696EF21E35ED0DBBDE3
                                                                                                                                                                                                    SHA1:BF9E055B5AB138AD6D49769E2B7630B7938848D6
                                                                                                                                                                                                    SHA-256:D9C95C31B4C1092F32BDCF40D5232B31CC09FB5B68564067C1C2A5F59D3869FA
                                                                                                                                                                                                    SHA-512:88B16B7C3ACFED2FC4B1E3A14006FEF532147EB1E2930D8966E90629069462FB2E8CBF65F561E6CBC9A946F39D1866583CB02D6BB84C60C71428F489DAAA61EF
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:#.# Copyright (c) 2004, 2016, Oracle and/or its affiliates. All rights reserved..# ORACLE PROPRIETARY/CONFIDENTIAL. Use is subject to license terms..#..error.internal.badmsg=\uB0B4\uBD80 \uC624\uB958\uAC00 \uBC1C\uC0DD\uD588\uC2B5\uB2C8\uB2E4. \uC54C \uC218 \uC5C6\uB294 \uBA54\uC2DC\uC9C0\uC785\uB2C8\uB2E4..error.badinst.nojre=\uC124\uCE58\uAC00 \uC798\uBABB\uB418\uC5C8\uC2B5\uB2C8\uB2E4. \uAD6C\uC131 \uD30C\uC77C\uC5D0\uC11C JRE\uB97C \uCC3E\uC744 \uC218 \uC5C6\uC2B5\uB2C8\uB2E4..error.launch.execv=Java Web Start(execv)\uB97C \uD638\uCD9C\uD558\uB294 \uC911 \uC624\uB958\uAC00 \uBC1C\uC0DD\uD588\uC2B5\uB2C8\uB2E4..error.launch.sysexec=Java Web Start(SysExec)\uB97C \uD638\uCD9C\uD558\uB294 \uC911 \uC624\uB958\uAC00 \uBC1C\uC0DD\uD588\uC2B5\uB2C8\uB2E4. .error.listener.failed=\uC2A4\uD50C\uB798\uC2DC: sysCreateListenerSocket\uC744 \uC2E4\uD328\uD588\uC2B5\uB2C8\uB2E4..error.accept.failed=\uC2A4\uD50C\uB798\uC2DC: \uC2B9\uC778\uC744 \uC2E4\uD328\uD588\uC2B5\uB2C8\uB2E4..error.recv.failed=

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\deploy\is-5P320.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:GIF image data, version 89a, 320 x 139
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):7805
                                                                                                                                                                                                    Entropy (8bit):7.877495465139721
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:96:S88k2wenvMs3iHrSI3yy73VWOcaJpGvrrXqJBcqgbf5bD0jmzDBoqCN2IWsyh:SFHhs73n73V4airrXq41Ll3vBmN2YU
                                                                                                                                                                                                    MD5:9E8F541E6CEBA93C12D272840CC555F8
                                                                                                                                                                                                    SHA1:8DEF364E07F40142822DF84B5BB4F50846CB5E4E
                                                                                                                                                                                                    SHA-256:C5578AC349105DE51C1E9109D22C7843AAB525C951E312700C73D5FD427281B9
                                                                                                                                                                                                    SHA-512:2AB06CAE68DEC9D92B66288466F24CC25505AF954FA038748D6F294D1CFFB72FCC7C07BA8928001D6C487D1BF71FE0AF1B1AA0F35120E5F6B1B2C209BA596CE2
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:GIF89a@...................................{...........c.....P|.l.....].............Ry.........S{.i.....U~........................uuuV..b........T.....WWW}..R~.......Hr.v..T|.It..........n.............e..f.....].........Hq.`........Y.....i..r.._..l...........]..Y.....v..................s..f.....z.....\........Jr.r.....................i..e.....p.....Y..m........Z..Sz.Ow....Y..Nx.{..w..Jr.T..R}....Pw.Lt.s..`..W..W..Lv...........................................FFF...W..V..Is.Kv.W..W..U..Hr.O{.Mx.Jt.Gq.Fp.Gp.Lw.Fo.U..T..Q~.R..P|.Lw.S..S..Ju.Nz.V..X..V..U..Ny.Hs.My.Ku.My.Q}.R~.P}.Q}.R..S..S..O{.Oz.Lx.Nz.Lv.It.Gp.Gq....ggg.....................S...............S|....Gp........Mw.S~.Px.Nz.Pz.......Lt.Kv.a.....V.....r.................Fo.......!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c014 79.156797, 2014/08/20-09:53:02 "> <rdf:RDF xmlns:rdf="ht

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\deploy\is-66MQ0.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:ASCII text, with very long lines (1729)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):3752
                                                                                                                                                                                                    Entropy (8bit):5.14936903006307
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:96:zMWCQv8u9/IzdG/JvFWlHaQzWy/owZFomWdYQCfQ/ydQCyJ:gWCQv7VIxG/JodaQ7PoHWQaQ/6QCY
                                                                                                                                                                                                    MD5:880BAACB176553DEAB39EDBE4B74380D
                                                                                                                                                                                                    SHA1:37A57AAD121C14C25E149206179728FA62203BF0
                                                                                                                                                                                                    SHA-256:FF4A3A92BC92CB08D2C32C435810440FD264EDD63E56EFA39430E0240C835620
                                                                                                                                                                                                    SHA-512:3039315BB283198AF9090BD3D31CFAE68EE73BC2B118BBAE0B32812D4E3FD0F11CE962068D4A17B065DAB9A66EF651B9CB8404C0A2DEFCE74BB6B2D1D93646D5
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:#.# Copyright (c) 2004, 2013, Oracle and/or its affiliates. All rights reserved..# ORACLE PROPRIETARY/CONFIDENTIAL. Use is subject to license terms..#..error.internal.badmsg=\u5167\u90E8\u932F\u8AA4\uFF0C\u4E0D\u660E\u7684\u8A0A\u606F.error.badinst.nojre=\u5B89\u88DD\u932F\u8AA4\u3002\u5728\u7D44\u614B\u6A94\u4E2D\u627E\u4E0D\u5230 JRE.error.launch.execv=\u547C\u53EB Java Web Start (execv) \u6642\u9047\u5230\u932F\u8AA4.error.launch.sysexec=\u547C\u53EB Java Web Start (SysExec) \u6642\u9047\u5230\u932F\u8AA4.error.listener.failed=Splash: sysCreateListenerSocket \u5931\u6557.error.accept.failed=Splash: \u63A5\u53D7\u5931\u6557.error.recv.failed=Splash: recv \u5931\u6557.error.invalid.port=Splash: \u6709\u6548\u7684\u9023\u63A5\u57E0\u5C1A\u672A\u56DE\u5FA9.error.read=\u8B80\u53D6\u8D85\u51FA\u7DE9\u885D\u5340\u7D50\u5C3E.error.xmlparsing=XML \u5256\u6790\u932F\u8AA4: \u627E\u5230\u932F\u8AA4\u7684\u8A18\u865F\u7A2E\u985E.error.splash.exit=Java Web Start \u9583\u73FE\u87A2\u5E55\u8655\u7

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\deploy\is-697OB.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:ASCII text, with very long lines (1575)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):3409
                                                                                                                                                                                                    Entropy (8bit):4.800862996269612
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:48:pcj7LwORE+DNaQCJhSNiZGBk9zghSqvS//oTnvDHt65NA3gBne8p6KF/uoYuh1Lq:pc3LwqiJhSNiZNQSov0U4t1S4x8X/
                                                                                                                                                                                                    MD5:C11AB66FEDE3042EE75DFD19032C8A72
                                                                                                                                                                                                    SHA1:69BD2D03C2064F8679DE5B4E430EA61B567C69C5
                                                                                                                                                                                                    SHA-256:8DEEEC35ED29348F5755801F42675E3BF3FA7AD4B1E414ACCA283C4DA40E4D77
                                                                                                                                                                                                    SHA-512:072F8923DF111F82F482D65651758B8B4BA2486CB0EA08FB8B113F472A42A1C3BCB00DAE7D1780CF371E2C2BD955D8B66658D5EE15E548B1EEA16B312FDCBDF9
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:#.# Copyright (c) 2004, 2011, Oracle and/or its affiliates. All rights reserved..# ORACLE PROPRIETARY/CONFIDENTIAL. Use is subject to license terms..#..error.internal.badmsg=erreur interne, message inconnu.error.badinst.nojre=Installation incorrecte. JRE introuvable dans le fichier de configuration.error.launch.execv=Erreur lors de l'appel de Java Web Start (execv).error.launch.sysexec=Erreur lors de l'appel de Java Web Start (SysExec) .error.listener.failed=Accueil : \u00E9chec de sysCreateListenerSocket.error.accept.failed=Accueil : \u00E9chec d'accept.error.recv.failed=Accueil : \u00E9chec de recv.error.invalid.port=Accueil : impossible de r\u00E9activer un port valide.error.read=Lecture apr\u00E8s la fin de tampon.error.xmlparsing=Erreur d'analyse XML : type incorrect de jeton.error.splash.exit=Le processus d'affichage de l'\u00E9cran d'accueil de Java Web Start est en cours de fermeture...\n.# "Last WinSock Error" means the error message for the last operation that failed..error.w

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\deploy\is-9H3Q7.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:ASCII text, with very long lines (2924)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):6349
                                                                                                                                                                                                    Entropy (8bit):4.575777726495053
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:96:Ltk1ZccBD8M25jCTDrk9/RoaG7THG9o7f6tEflA44CAmIbIC3j5pN/o8woJb:W1xBY1CG6OlG2r
                                                                                                                                                                                                    MD5:B7279F1C3BA0B63806F37F6B9D33C314
                                                                                                                                                                                                    SHA1:751170A7CDEFCB1226604AC3F8196E06A04FD7AC
                                                                                                                                                                                                    SHA-256:8D499C1CB14D58E968A823E11D5B114408C010B053B3B38CFEF7EBF9FB49096F
                                                                                                                                                                                                    SHA-512:4A3BF898A36D55010C8A8F92E5A784516475BDFFFCD337D439D6DA251DDB97BCC7E26F104AC5602320019ED5C0B8DC8883B2581760AFEA9C59C74982574D164B
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:#.# Copyright (c) 2004, 2013, Oracle and/or its affiliates. All rights reserved..# ORACLE PROPRIETARY/CONFIDENTIAL. Use is subject to license terms..#..error.internal.badmsg=\u5185\u90E8\u30A8\u30E9\u30FC\u3001\u4E0D\u660E\u306A\u30E1\u30C3\u30BB\u30FC\u30B8.error.badinst.nojre=\u30A4\u30F3\u30B9\u30C8\u30FC\u30EB\u304C\u6B63\u3057\u304F\u3042\u308A\u307E\u305B\u3093\u3002\u69CB\u6210\u30D5\u30A1\u30A4\u30EB\u5185\u306BJRE\u304C\u3042\u308A\u307E\u305B\u3093.error.launch.execv=Java Web Start\u306E\u547C\u51FA\u3057\u4E2D\u306B\u30A8\u30E9\u30FC\u304C\u767A\u751F\u3057\u307E\u3057\u305F(execv).error.launch.sysexec=Java Web Start\u306E\u547C\u51FA\u3057\u4E2D\u306B\u30A8\u30E9\u30FC\u304C\u767A\u751F\u3057\u307E\u3057\u305F(SysExec) .error.listener.failed=\u30B9\u30D7\u30E9\u30C3\u30B7\u30E5: sysCreateListenerSocket\u306B\u5931\u6557\u3057\u307E\u3057\u305F.error.accept.failed=\u30B9\u30D7\u30E9\u30C3\u30B7\u30E5: accept\u306B\u5931\u6557\u3057\u307E\u3057\u305F.error.recv.failed=\u30B9\

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\deploy\is-9QBVO.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:GIF image data, version 89a, 640 x 278
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):15276
                                                                                                                                                                                                    Entropy (8bit):7.949850025334252
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:192:onqkbSDLFgIBL0IgyZCE/oIuuemXclVO/HemZ8GbRdziHm6tIclW3ZYvvebtssZn:lKMLWkpgy8sdsnOmEyPLaYoauAdI
                                                                                                                                                                                                    MD5:CB81FED291361D1DD745202659857B1B
                                                                                                                                                                                                    SHA1:0AE4A5BDA2A6D628FAC51462390B503C99509FDC
                                                                                                                                                                                                    SHA-256:9DD5CCD6BDFDAAD38F7D05A14661108E629FDD207FC7776268B566F7941E1435
                                                                                                                                                                                                    SHA-512:4A383107AC2D642F4EB63EE7E7E85A8E2F63C67B41CA55EBAE56B52CECFE8A301AAF14E6536553CBC3651519DB5C10FC66588C84C9840D496F5AE980EF2ED2B9
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:GIF89a..............................................FFF...W..V..Is.Hr.W..W..U..P|.T..Kv.O{.V..Mx....S..Fp.Jt.Lw.Gp.Gq.Lw.U..T..R..Q~.Fo.Nz.R~.R..Q}.My.Ju.It.Oz.Gp.Nz.Gq.V..Ny.Hq.P|.P}.S..S..S..Q}.Ku.Ku.Hr.Lx.X..Mx.It.U..Is.Hs.T..O{.R~.T..O{.Kv.My.Lv..........i...........]..WWWu...........ggguuut.......................................Ry.......{..............b..........................^..l.................X}....a..{.....c..................v..m........T{.f.....l........X.........................j..U|...........`........j..g..U~........^.....Qz.Jr.Nw.p.....v.....p.....Gp....r..Mt.......y..q.....]..Nv............Tz.Y.....[.....Pw....Ox..............X.....Y..X..W..V..S|............Mx....Mv.Kt.U..Hq.Lv.W.....Mu.i..Q{.Gq.Lt.S~.T..U..Kv................Fo.......!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="ht

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\deploy\is-BU7BF.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:ASCII text, with very long lines (1392)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):3223
                                                                                                                                                                                                    Entropy (8bit):4.671266438569996
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:48:pbv+eaVtVVdMDCU02B9a8+eYbuKY8t5gBne8uo265eLaqMQ6URhmwgFs+ur6N:paearV4l+e6uKY8t5C26+7RhZgRN
                                                                                                                                                                                                    MD5:A81C4B0F3BF9A499429E14A881010EF6
                                                                                                                                                                                                    SHA1:DBE49949308F28540A42AE6CD2AD58AFBF615592
                                                                                                                                                                                                    SHA-256:550954F1F80FE0E73D74EB10AD529B454D5EBC626EB94A6B294D7D2ACF06F372
                                                                                                                                                                                                    SHA-512:6FED61CBCD7FE82C15C9A312ACED9D93836EBCFFAF3E13543BC9DD8B4C88400C371D2365FEEE0F1BB844A6372D4128376568A5B6FE666FD6213636FCBD8C7791
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:#.# Copyright (c) 2004, 2011, Oracle and/or its affiliates. All rights reserved..# ORACLE PROPRIETARY/CONFIDENTIAL. Use is subject to license terms..#..error.internal.badmsg=errore interno, messaggio sconosciuto.error.badinst.nojre=Installazione errata. Impossibile trovare il JRE nel file di configurazione.error.launch.execv=Errore durante la chiamata di Java Web Start (execv).error.launch.sysexec=Errore durante la chiamata di Java Web Start (SysExec) .error.listener.failed=Apertura: sysCreateListenerSocket non riuscito.error.accept.failed=Apertura: accept non riuscito.error.recv.failed=Apertura: recv non riuscito.error.invalid.port=Apertura: impossibile identificare una porta valida.error.read=Tentativo di lettura dopo la fine del buffer.error.xmlparsing=Errore durante l'analisi XML: trovato un tipo di token errato.error.splash.exit=Uscita dal processo di schermata iniziale di Java Web Start in corso...\n.# "Last WinSock Error" means the error message for the last operation that faile

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\deploy\is-CPKST.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:ASCII text, with very long lines (1729)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):3752
                                                                                                                                                                                                    Entropy (8bit):5.14936903006307
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:96:zMWCQv8u9/IzdG/JvFWlHaQzWy/owZFomWdYQCfQ/ydQCyJ:gWCQv7VIxG/JodaQ7PoHWQaQ/6QCY
                                                                                                                                                                                                    MD5:880BAACB176553DEAB39EDBE4B74380D
                                                                                                                                                                                                    SHA1:37A57AAD121C14C25E149206179728FA62203BF0
                                                                                                                                                                                                    SHA-256:FF4A3A92BC92CB08D2C32C435810440FD264EDD63E56EFA39430E0240C835620
                                                                                                                                                                                                    SHA-512:3039315BB283198AF9090BD3D31CFAE68EE73BC2B118BBAE0B32812D4E3FD0F11CE962068D4A17B065DAB9A66EF651B9CB8404C0A2DEFCE74BB6B2D1D93646D5
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:#.# Copyright (c) 2004, 2013, Oracle and/or its affiliates. All rights reserved..# ORACLE PROPRIETARY/CONFIDENTIAL. Use is subject to license terms..#..error.internal.badmsg=\u5167\u90E8\u932F\u8AA4\uFF0C\u4E0D\u660E\u7684\u8A0A\u606F.error.badinst.nojre=\u5B89\u88DD\u932F\u8AA4\u3002\u5728\u7D44\u614B\u6A94\u4E2D\u627E\u4E0D\u5230 JRE.error.launch.execv=\u547C\u53EB Java Web Start (execv) \u6642\u9047\u5230\u932F\u8AA4.error.launch.sysexec=\u547C\u53EB Java Web Start (SysExec) \u6642\u9047\u5230\u932F\u8AA4.error.listener.failed=Splash: sysCreateListenerSocket \u5931\u6557.error.accept.failed=Splash: \u63A5\u53D7\u5931\u6557.error.recv.failed=Splash: recv \u5931\u6557.error.invalid.port=Splash: \u6709\u6548\u7684\u9023\u63A5\u57E0\u5C1A\u672A\u56DE\u5FA9.error.read=\u8B80\u53D6\u8D85\u51FA\u7DE9\u885D\u5340\u7D50\u5C3E.error.xmlparsing=XML \u5256\u6790\u932F\u8AA4: \u627E\u5230\u932F\u8AA4\u7684\u8A18\u865F\u7A2E\u985E.error.splash.exit=Java Web Start \u9583\u73FE\u87A2\u5E55\u8655\u7

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\deploy\is-CV5RJ.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:ASCII text, with very long lines (1319)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):3285
                                                                                                                                                                                                    Entropy (8bit):4.837889715420947
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:48:R+OfaeLkDcUfLYgIYu9WvXx6K6GBxLy1gBne8u6K0NCMc6MTNTjtA7NZdlw7ZHAz:R1fybjfSIX8pGBxLy1Ba+mZdlw7Zs
                                                                                                                                                                                                    MD5:ED15A441A20EA85C29521A0C7C8C3097
                                                                                                                                                                                                    SHA1:24E4951743521AB9A11381C77BD0CDB1ED30F5B5
                                                                                                                                                                                                    SHA-256:4140663A49040FF191C07D2D04588402263EC2E1679A9A1A79B790A137EE7FB8
                                                                                                                                                                                                    SHA-512:BE5F0639DE6B0AC95792987D0AF83CA77495F7F49953698C8B18692DE982F77B68FE63159E8CD7537D62A71209A9FFABBECF046AD82D8341F613D39F180F9C83
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:#.# Copyright (c) 2004, 2016, Oracle and/or its affiliates. All rights reserved..# ORACLE PROPRIETARY/CONFIDENTIAL. Use is subject to license terms..#..error.internal.badmsg=erro interno, mensagem desconhecida.error.badinst.nojre=Instala\u00E7\u00E3o incorreta. Nenhum JRE encontrado no arquivo de configura\u00E7\u00E3o.error.launch.execv=Erro encontrado ao chamar Java Web Start (execv).error.launch.sysexec=Erro encontrado ao chamar Java Web Start (SysExec) .error.listener.failed=Tela Inicial: falha em sysCreateListenerSocket.error.accept.failed=Tela Inicial: falha na fun\u00E7\u00E3o accept.error.recv.failed=Tela Inicial: falha na fun\u00E7\u00E3o recv.error.invalid.port=Tela Inicial: n\u00E3o reativou uma porta v\u00E1lida.error.read=Ler ap\u00F3s o final do buffer.error.xmlparsing=Erro durante o parsing de XML: tipo incorreto de token encontrado.error.splash.exit=Saindo do processamento da tela inicial do Java Web .....\n.# "Last WinSock Error" means the error message for the last op

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\deploy\is-EC06J.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:ASCII text, with very long lines (1386)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):3409
                                                                                                                                                                                                    Entropy (8bit):4.897253332398417
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:96:pB+L1Q6sQcqRo/hM7M4ogqxwvpvykU/2/7JCh91XlK7Q/vm2QAfr:vM1TsGk1CzJA1KGm2QIr
                                                                                                                                                                                                    MD5:A6005BE45C88900A15BC80D461B60C30
                                                                                                                                                                                                    SHA1:CA3E18B5AEA928A8465656C86970D9584D85EF7F
                                                                                                                                                                                                    SHA-256:5CCEE63720FCAC2A136CF1FA90CBAC05040F89FFE8C082C2D067247BFCD76B87
                                                                                                                                                                                                    SHA-512:9442FFB47BF0F158A44A81A16B2AB94BB36FAC2F75B0C9467654AB9A8DF26A63C0C7A7717DEAF5476068BC0A0D602B828CE1E8D229CBFAAF201C24C0F78BE1F9
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:#.# Copyright (c) 2004, 2011, Oracle and/or its affiliates. All rights reserved..# ORACLE PROPRIETARY/CONFIDENTIAL. Use is subject to license terms..#..error.internal.badmsg=internt fel, ok\u00E4nt meddelande.error.badinst.nojre=Felaktig installation. Ingen JRE har hittats i konfigurationsfilen.error.launch.execv=Ett fel intr\u00E4ffade under starten av Java Web Start (execv).error.launch.sysexec=Ett fel intr\u00E4ffade under starten av Java Web Start (SysExec) .error.listener.failed=V\u00E4lkomstsk\u00E4rm: sysCreateListenerSocket utf\u00F6rdes inte.error.accept.failed=V\u00E4lkomstsk\u00E4rm: kunde inte accepteras.error.recv.failed=V\u00E4lkomstsk\u00E4rm: kunde inte mottaga.error.invalid.port=V\u00E4lkomstsk\u00E4rm: \u00E5terskapade inte en giltig port.error.read=L\u00E4ste f\u00F6rbi slutet av bufferten.error.xmlparsing=XML-tolkningsfel: fel typ av igenk\u00E4nningstecken hittades.error.splash.exit=Java Web Start - v\u00E4lkomstsk\u00E4rmen avslutas .....\n.# "Last WinSock Error"

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\deploy\is-ERDPO.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:GIF image data, version 89a, 320 x 139
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):8590
                                                                                                                                                                                                    Entropy (8bit):7.910688771816331
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:192:91m4OqvVyG+LMIcBc2qPjHmxJCCG/h97dIYhOX:9/OqdivcqzjH3tfDE
                                                                                                                                                                                                    MD5:249053609EAF5B17DDD42149FC24C469
                                                                                                                                                                                                    SHA1:20E7AEC75F6D036D504277542E507EB7DC24AAE8
                                                                                                                                                                                                    SHA-256:113B01304EBBF3CC729A5CA3452DDA2093BD8B3DDC2BA29E5E1C1605661F90BE
                                                                                                                                                                                                    SHA-512:9C04A20E2FA70E4BCFAC729E366A0802F6F5167EA49475C2157C8E2741C4E4B8452D14C75F67906359C12F1514F9FB7E9AF8E736392AC8434F0A5811F7DDE0CB
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:GIF89a@................................................FFF...T..W..V..Is.Kv.W..W..U..Hr.P|.O{.Mx.Gq.Jt.Fo.Fp.V..U..Gp.T..Lw.P|.R..Q~.S..S..Nz.Lw.Hq.Ju.X..V..Lx.It.U..Hs.Ny.Nz.P}.R~.S..R~.R..Q}.Q}.My.Lv.It.O{.Ku.My.Oz.Gp.Gq.Hr.....................WWW.........Ry.uuu............i......ggg...]..................{..y..d..........Sz................s............i...............c............v.....X........r...........]........^........p.....z.........r..Y..l..m...............]................Mu........Qw.Nw.........v.....b..j.......V}.]........d.....k........v........Lu....S|.U{.Oy................W........Lv.U..R}.....Nv.Gp.Nx.Ks....Jr....Hq......V~.T..S~.Z.....Gq.O{.......W..Qz.......Lw.Z.....T...........S~....Lt.Kv....V.................Fo.......!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="ht

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\deploy\is-JH56Q.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:ASCII text, with very long lines (1345)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):3306
                                                                                                                                                                                                    Entropy (8bit):4.888605396125911
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:96:MLHMLhMXQXTyf2IXOZza2uuFMir25pAvAv2ITOsdK:OHOh4QD+JJcFZY+ITOqK
                                                                                                                                                                                                    MD5:D77C3B5274B8161328AB5C78F66DD0D0
                                                                                                                                                                                                    SHA1:D989FE1B8F7904888D5102294EBEFD28D932ECDB
                                                                                                                                                                                                    SHA-256:C9399A33BB9C75345130B99D1D7CE886D9148F1936543587848C47B8540DA640
                                                                                                                                                                                                    SHA-512:696E28B6BC7E834C51AB9821D0D65D1A32F00EB15CAA732047B751288EA73D8D703D3152BF81F267147F8C1538E1BF470748DF41176392F10E622F4C7708DD92
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:#.# Copyright (c) 2004, 2013, Oracle and/or its affiliates. All rights reserved..# ORACLE PROPRIETARY/CONFIDENTIAL. Use is subject to license terms..#..error.internal.badmsg=interner Fehler, unbekannte Meldung.error.badinst.nojre=Ung\u00FCltige Installation. Keine JRE in Konfigurationsdatei gefunden.error.launch.execv=Fehler beim Aufrufen von Java Web Start (execv) aufgetreten.error.launch.sysexec=Fehler beim Aufrufen von Java Web Start (SysExec) aufgetreten.error.listener.failed=Startbildschirm: sysCreateListenerSocket nicht erfolgreich.error.accept.failed=Startbildschirm: accept nicht erfolgreich.error.recv.failed=Startbildschirm: recv nicht erfolgreich.error.invalid.port=Startbildschirm: Reaktivierung eines g\u00FCltigen Ports nicht m\u00F6glich.error.read=\u00DCber Pufferende hinaus gelesen.error.xmlparsing=XML-Parsefehler: Falscher Tokentyp gefunden.error.splash.exit=Prozess f\u00FCr Startbildschirm von Java Web Start wird beendet.....\n.# "Last WinSock Error" means the error mess

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\deploy\is-LS1LI.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v1.0 to extract, compression method=store
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):14156
                                                                                                                                                                                                    Entropy (8bit):5.744910434735822
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:48:ZCbLI+R9wTdWTe3WPu20kPjd5GyOa17T3rce7sH1l/CdOAd4pD0ACBWpgzT6j/lZ:cl56Qzjd51f7fZGWPmpaeGjHojn
                                                                                                                                                                                                    MD5:821A76771E3F87FD065108A943FE9D70
                                                                                                                                                                                                    SHA1:9CFBD943985C1FB048949DC9C7BEDF99AFFD76AA
                                                                                                                                                                                                    SHA-256:90A87FA5E8B53DD03523458722F47D0B9E52509B971E3B3E348F5BEFB9D0ECEF
                                                                                                                                                                                                    SHA-512:FFBF867EB4CC8DF5CF4DC14556A22E9A5E79242A02881682FD3E363E9A3C8F60BC0A09B970511ABB1823BBEA70D00F220BC642239EBD6E64614861CF84FB1FED
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK........,..I............'...{CAFEEFAC-0018-0000-0121-ABCDEFFEDCBA}/UT....]OX.]OXux..........)..PK........+..I................{CAFEEFAC-0018-0000-0121-ABCDEFFEDCBA}/chrome/UT....]OX.]OXux..........)..PK........+..I............6...{CAFEEFAC-0018-0000-0121-ABCDEFFEDCBA}/chrome/content/UT....]OX.]OXux..........)..PK........+..I............>...{CAFEEFAC-0018-0000-0121-ABCDEFFEDCBA}/chrome/content/ffjcext/UT....]OX.]OXux..........)..PK........+..I..M.........H...{CAFEEFAC-0018-0000-0121-ABCDEFFEDCBA}/chrome/content/ffjcext/ffjcext.jsUT....]OX.]OXux..........)..const gJavaConsole1_8_0_121 = {...id.: "javaconsole1.8.0_121",...mimeType: "application/x-java-applet;jpi-version=1.8.0_121",...install.: function() {...window.addEventListener("load",this.init,false);..},...init.: function() { ...if (navigator.mimeTypes[gJavaConsole1_8_0_121.mimeType]) {....var toolsPopup = document.getElementById("menu_ToolsPopup");.....toolsPopup.addEventListener("popupshowing",gJavaConsole1_8_0_121.enable,false)

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\deploy\is-O1BOU.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:ASCII text, with very long lines (1857)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):4072
                                                                                                                                                                                                    Entropy (8bit):5.01527031899567
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:96:Ln7OVgLO4c5tgvDgEY4tnf7OgdbywfK0eSm91js:3OVTjqvIwPtK1js
                                                                                                                                                                                                    MD5:E6F84C081895ACDFD98DA0F496E1DD3D
                                                                                                                                                                                                    SHA1:1C2B96673DDDD3596890EF4FC22017D484A1F652
                                                                                                                                                                                                    SHA-256:A1752A0175F490F61E0AAD46DC6887C19711F078309062D5260E164AC844F61A
                                                                                                                                                                                                    SHA-512:D4D28780147E22678CD8E7415CACFAD533AE5AF31D74426BBE4993F05A0707E4F0F71D948093FFA1A0D6EA48310E901CD0ED1C14E2FBDF69C92462D070A9664F
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:#.# Copyright (c) 2004, 2013, Oracle and/or its affiliates. All rights reserved..# ORACLE PROPRIETARY/CONFIDENTIAL. Use is subject to license terms..#..error.internal.badmsg=\u5185\u90E8\u9519\u8BEF, \u672A\u77E5\u6D88\u606F.error.badinst.nojre=\u9519\u8BEF\u5B89\u88C5\u3002\u914D\u7F6E\u6587\u4EF6\u4E2D\u627E\u4E0D\u5230 JRE.error.launch.execv=\u8C03\u7528 Java Web Start (execv) \u65F6\u9047\u5230\u9519\u8BEF.error.launch.sysexec=\u8C03\u7528 Java Web Start (SysExec) \u65F6\u9047\u5230\u9519\u8BEF.error.listener.failed=\u542F\u52A8\u5C4F\u5E55: sysCreateListenerSocket \u5931\u8D25.error.accept.failed=\u542F\u52A8\u5C4F\u5E55: \u63A5\u53D7\u5931\u8D25.error.recv.failed=\u542F\u52A8\u5C4F\u5E55: recv \u5931\u8D25.error.invalid.port=\u542F\u52A8\u5C4F\u5E55: \u672A\u6062\u590D\u6709\u6548\u7AEF\u53E3.error.read=\u8BFB\u53D6\u8D85\u51FA\u7F13\u51B2\u533A\u7ED3\u5C3E.error.xmlparsing=XML \u89E3\u6790\u9519\u8BEF: \u53D1\u73B0\u9519\u8BEF\u7684\u6807\u8BB0\u7C7B\u578B.error.splash.exit=Java

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\deploy\is-OJ52I.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):2860
                                                                                                                                                                                                    Entropy (8bit):4.793521742012267
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:48:pSDUEm98mDhDdDDLc59BXnnyzEEUFggBne8TCHCHb2ttfe4ey1nttAUicf9EEZze:pSDi98mFV45bAUS1HCHb2tjHEElfJo
                                                                                                                                                                                                    MD5:811BAFA6F97801186910E9B1D9927FE2
                                                                                                                                                                                                    SHA1:DC52841C708E3C1EB2A044088A43396D1291BB5E
                                                                                                                                                                                                    SHA-256:926CCADAEC649F621590D1AA5E915481016564E7AB28390C8D68BDAAF4785F1F
                                                                                                                                                                                                    SHA-512:5AE9C27DCE552EA32603B2C87C1510858F86D9D10CADE691B2E54747C3602FE75DE032CF8917DCD4EE160EE4CC5BE2E708B321BB1D5CDEBFA9FE46C2F870CA7C
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:#.# Copyright (c) 2004, 2011, Oracle and/or its affiliates. All rights reserved..# ORACLE PROPRIETARY/CONFIDENTIAL. Use is subject to license terms..#..error.internal.badmsg=internal error, unknown message.error.badinst.nojre=Bad installation. No JRE found in configuration file.error.launch.execv=Error encountered while invoking Java Web Start (execv).error.launch.sysexec=Error encountered while invoking Java Web Start (SysExec) .error.listener.failed=Splash: sysCreateListenerSocket failed.error.accept.failed=Splash: accept failed.error.recv.failed=Splash: recv failed.error.invalid.port=Splash: didn't revive a valid port.error.read=Read past end of buffer.error.xmlparsing=XML Parsing error: wrong kind of token found.error.splash.exit=Java Web Start splash screen process exiting .....\n.# "Last WinSock Error" means the error message for the last operation that failed..error.winsock=\tLast WinSock Error: .error.winsock.load=Couldn't load winsock.dll.error.winsock.start=WSAStartup failed.

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\deploy\messages.properties (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):2860
                                                                                                                                                                                                    Entropy (8bit):4.793521742012267
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:48:pSDUEm98mDhDdDDLc59BXnnyzEEUFggBne8TCHCHb2ttfe4ey1nttAUicf9EEZze:pSDi98mFV45bAUS1HCHb2tjHEElfJo
                                                                                                                                                                                                    MD5:811BAFA6F97801186910E9B1D9927FE2
                                                                                                                                                                                                    SHA1:DC52841C708E3C1EB2A044088A43396D1291BB5E
                                                                                                                                                                                                    SHA-256:926CCADAEC649F621590D1AA5E915481016564E7AB28390C8D68BDAAF4785F1F
                                                                                                                                                                                                    SHA-512:5AE9C27DCE552EA32603B2C87C1510858F86D9D10CADE691B2E54747C3602FE75DE032CF8917DCD4EE160EE4CC5BE2E708B321BB1D5CDEBFA9FE46C2F870CA7C
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:#.# Copyright (c) 2004, 2011, Oracle and/or its affiliates. All rights reserved..# ORACLE PROPRIETARY/CONFIDENTIAL. Use is subject to license terms..#..error.internal.badmsg=internal error, unknown message.error.badinst.nojre=Bad installation. No JRE found in configuration file.error.launch.execv=Error encountered while invoking Java Web Start (execv).error.launch.sysexec=Error encountered while invoking Java Web Start (SysExec) .error.listener.failed=Splash: sysCreateListenerSocket failed.error.accept.failed=Splash: accept failed.error.recv.failed=Splash: recv failed.error.invalid.port=Splash: didn't revive a valid port.error.read=Read past end of buffer.error.xmlparsing=XML Parsing error: wrong kind of token found.error.splash.exit=Java Web Start splash screen process exiting .....\n.# "Last WinSock Error" means the error message for the last operation that failed..error.winsock=\tLast WinSock Error: .error.winsock.load=Couldn't load winsock.dll.error.winsock.start=WSAStartup failed.

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\deploy\messages_de.properties (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:ASCII text, with very long lines (1345)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):3306
                                                                                                                                                                                                    Entropy (8bit):4.888605396125911
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:96:MLHMLhMXQXTyf2IXOZza2uuFMir25pAvAv2ITOsdK:OHOh4QD+JJcFZY+ITOqK
                                                                                                                                                                                                    MD5:D77C3B5274B8161328AB5C78F66DD0D0
                                                                                                                                                                                                    SHA1:D989FE1B8F7904888D5102294EBEFD28D932ECDB
                                                                                                                                                                                                    SHA-256:C9399A33BB9C75345130B99D1D7CE886D9148F1936543587848C47B8540DA640
                                                                                                                                                                                                    SHA-512:696E28B6BC7E834C51AB9821D0D65D1A32F00EB15CAA732047B751288EA73D8D703D3152BF81F267147F8C1538E1BF470748DF41176392F10E622F4C7708DD92
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:#.# Copyright (c) 2004, 2013, Oracle and/or its affiliates. All rights reserved..# ORACLE PROPRIETARY/CONFIDENTIAL. Use is subject to license terms..#..error.internal.badmsg=interner Fehler, unbekannte Meldung.error.badinst.nojre=Ung\u00FCltige Installation. Keine JRE in Konfigurationsdatei gefunden.error.launch.execv=Fehler beim Aufrufen von Java Web Start (execv) aufgetreten.error.launch.sysexec=Fehler beim Aufrufen von Java Web Start (SysExec) aufgetreten.error.listener.failed=Startbildschirm: sysCreateListenerSocket nicht erfolgreich.error.accept.failed=Startbildschirm: accept nicht erfolgreich.error.recv.failed=Startbildschirm: recv nicht erfolgreich.error.invalid.port=Startbildschirm: Reaktivierung eines g\u00FCltigen Ports nicht m\u00F6glich.error.read=\u00DCber Pufferende hinaus gelesen.error.xmlparsing=XML-Parsefehler: Falscher Tokentyp gefunden.error.splash.exit=Prozess f\u00FCr Startbildschirm von Java Web Start wird beendet.....\n.# "Last WinSock Error" means the error mess

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\deploy\messages_es.properties (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:ASCII text, with very long lines (1475)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):3600
                                                                                                                                                                                                    Entropy (8bit):4.74546152535042
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:96:ovLS0y45dMsqf52i3nkrBpW/QiQdjY0CQ1G:oTSWw3foFNp71G
                                                                                                                                                                                                    MD5:6D32848BD173B9444B71922616E0645E
                                                                                                                                                                                                    SHA1:1B0334B79DB481C3A59BE6915D5118D760C97BAA
                                                                                                                                                                                                    SHA-256:BE987D93E23AB7318DB095727DEDD8461BA6D98B9409EF8FC7F5C79FA9666B84
                                                                                                                                                                                                    SHA-512:8E9E92D3229FF80761010E4878B4A33BFB9F0BD053040FE152565CFB2819467E9A92609B3786F9BDBF0D7934CF3C7D20BC3369FE1AD7D0DF7FADF561C3FDCA3C
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:#.# Copyright (c) 2004, 2013, Oracle and/or its affiliates. All rights reserved..# ORACLE PROPRIETARY/CONFIDENTIAL. Use is subject to license terms..#..error.internal.badmsg=Error interno, mensaje desconocido.error.badinst.nojre=Instalaci\u00F3n incorrecta. No se ha encontrado JRE en el archivo de configuraci\u00F3n.error.launch.execv=Se ha encontrado un error al llamar a Java Web Start (execv).error.launch.sysexec=Se ha encontrado un error al llamar a Java Web Start (SysExec) .error.listener.failed=Pantalla de Presentaci\u00F3n: fallo de sysCreateListenerSocket.error.accept.failed=Pantalla de Presentaci\u00F3n: fallo de accept.error.recv.failed=Pantalla de Presentaci\u00F3n: fallo de recv.error.invalid.port=Pantalla de Presentaci\u00F3n: no se ha activado un puerto v\u00E1lido.error.read=Lectura m\u00E1s all\u00E1 del final del buffer.error.xmlparsing=Error de an\u00E1lisis de XML: se ha encontrado un tipo de token no v\u00E1lido.error.splash.exit=Saliendo del proceso de la pantalla d

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\deploy\messages_fr.properties (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:ASCII text, with very long lines (1575)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):3409
                                                                                                                                                                                                    Entropy (8bit):4.800862996269612
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:48:pcj7LwORE+DNaQCJhSNiZGBk9zghSqvS//oTnvDHt65NA3gBne8p6KF/uoYuh1Lq:pc3LwqiJhSNiZNQSov0U4t1S4x8X/
                                                                                                                                                                                                    MD5:C11AB66FEDE3042EE75DFD19032C8A72
                                                                                                                                                                                                    SHA1:69BD2D03C2064F8679DE5B4E430EA61B567C69C5
                                                                                                                                                                                                    SHA-256:8DEEEC35ED29348F5755801F42675E3BF3FA7AD4B1E414ACCA283C4DA40E4D77
                                                                                                                                                                                                    SHA-512:072F8923DF111F82F482D65651758B8B4BA2486CB0EA08FB8B113F472A42A1C3BCB00DAE7D1780CF371E2C2BD955D8B66658D5EE15E548B1EEA16B312FDCBDF9
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:#.# Copyright (c) 2004, 2011, Oracle and/or its affiliates. All rights reserved..# ORACLE PROPRIETARY/CONFIDENTIAL. Use is subject to license terms..#..error.internal.badmsg=erreur interne, message inconnu.error.badinst.nojre=Installation incorrecte. JRE introuvable dans le fichier de configuration.error.launch.execv=Erreur lors de l'appel de Java Web Start (execv).error.launch.sysexec=Erreur lors de l'appel de Java Web Start (SysExec) .error.listener.failed=Accueil : \u00E9chec de sysCreateListenerSocket.error.accept.failed=Accueil : \u00E9chec d'accept.error.recv.failed=Accueil : \u00E9chec de recv.error.invalid.port=Accueil : impossible de r\u00E9activer un port valide.error.read=Lecture apr\u00E8s la fin de tampon.error.xmlparsing=Erreur d'analyse XML : type incorrect de jeton.error.splash.exit=Le processus d'affichage de l'\u00E9cran d'accueil de Java Web Start est en cours de fermeture...\n.# "Last WinSock Error" means the error message for the last operation that failed..error.w

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\deploy\messages_it.properties (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:ASCII text, with very long lines (1392)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):3223
                                                                                                                                                                                                    Entropy (8bit):4.671266438569996
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:48:pbv+eaVtVVdMDCU02B9a8+eYbuKY8t5gBne8uo265eLaqMQ6URhmwgFs+ur6N:paearV4l+e6uKY8t5C26+7RhZgRN
                                                                                                                                                                                                    MD5:A81C4B0F3BF9A499429E14A881010EF6
                                                                                                                                                                                                    SHA1:DBE49949308F28540A42AE6CD2AD58AFBF615592
                                                                                                                                                                                                    SHA-256:550954F1F80FE0E73D74EB10AD529B454D5EBC626EB94A6B294D7D2ACF06F372
                                                                                                                                                                                                    SHA-512:6FED61CBCD7FE82C15C9A312ACED9D93836EBCFFAF3E13543BC9DD8B4C88400C371D2365FEEE0F1BB844A6372D4128376568A5B6FE666FD6213636FCBD8C7791
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:#.# Copyright (c) 2004, 2011, Oracle and/or its affiliates. All rights reserved..# ORACLE PROPRIETARY/CONFIDENTIAL. Use is subject to license terms..#..error.internal.badmsg=errore interno, messaggio sconosciuto.error.badinst.nojre=Installazione errata. Impossibile trovare il JRE nel file di configurazione.error.launch.execv=Errore durante la chiamata di Java Web Start (execv).error.launch.sysexec=Errore durante la chiamata di Java Web Start (SysExec) .error.listener.failed=Apertura: sysCreateListenerSocket non riuscito.error.accept.failed=Apertura: accept non riuscito.error.recv.failed=Apertura: recv non riuscito.error.invalid.port=Apertura: impossibile identificare una porta valida.error.read=Tentativo di lettura dopo la fine del buffer.error.xmlparsing=Errore durante l'analisi XML: trovato un tipo di token errato.error.splash.exit=Uscita dal processo di schermata iniziale di Java Web Start in corso...\n.# "Last WinSock Error" means the error message for the last operation that faile

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\deploy\messages_ja.properties (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:ASCII text, with very long lines (2924)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):6349
                                                                                                                                                                                                    Entropy (8bit):4.575777726495053
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:96:Ltk1ZccBD8M25jCTDrk9/RoaG7THG9o7f6tEflA44CAmIbIC3j5pN/o8woJb:W1xBY1CG6OlG2r
                                                                                                                                                                                                    MD5:B7279F1C3BA0B63806F37F6B9D33C314
                                                                                                                                                                                                    SHA1:751170A7CDEFCB1226604AC3F8196E06A04FD7AC
                                                                                                                                                                                                    SHA-256:8D499C1CB14D58E968A823E11D5B114408C010B053B3B38CFEF7EBF9FB49096F
                                                                                                                                                                                                    SHA-512:4A3BF898A36D55010C8A8F92E5A784516475BDFFFCD337D439D6DA251DDB97BCC7E26F104AC5602320019ED5C0B8DC8883B2581760AFEA9C59C74982574D164B
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:#.# Copyright (c) 2004, 2013, Oracle and/or its affiliates. All rights reserved..# ORACLE PROPRIETARY/CONFIDENTIAL. Use is subject to license terms..#..error.internal.badmsg=\u5185\u90E8\u30A8\u30E9\u30FC\u3001\u4E0D\u660E\u306A\u30E1\u30C3\u30BB\u30FC\u30B8.error.badinst.nojre=\u30A4\u30F3\u30B9\u30C8\u30FC\u30EB\u304C\u6B63\u3057\u304F\u3042\u308A\u307E\u305B\u3093\u3002\u69CB\u6210\u30D5\u30A1\u30A4\u30EB\u5185\u306BJRE\u304C\u3042\u308A\u307E\u305B\u3093.error.launch.execv=Java Web Start\u306E\u547C\u51FA\u3057\u4E2D\u306B\u30A8\u30E9\u30FC\u304C\u767A\u751F\u3057\u307E\u3057\u305F(execv).error.launch.sysexec=Java Web Start\u306E\u547C\u51FA\u3057\u4E2D\u306B\u30A8\u30E9\u30FC\u304C\u767A\u751F\u3057\u307E\u3057\u305F(SysExec) .error.listener.failed=\u30B9\u30D7\u30E9\u30C3\u30B7\u30E5: sysCreateListenerSocket\u306B\u5931\u6557\u3057\u307E\u3057\u305F.error.accept.failed=\u30B9\u30D7\u30E9\u30C3\u30B7\u30E5: accept\u306B\u5931\u6557\u3057\u307E\u3057\u305F.error.recv.failed=\u30B9\

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\deploy\messages_ko.properties (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:ASCII text, with very long lines (2601)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):5712
                                                                                                                                                                                                    Entropy (8bit):4.758283080201437
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:96:fiX7fdokXLqlz9yx3f7yhJxpmG32i0HkZr+ywc8b8+/moD7yct070DL70Dj:g7ucLoINAYGbT/44i4
                                                                                                                                                                                                    MD5:FED33982E349F696EF21E35ED0DBBDE3
                                                                                                                                                                                                    SHA1:BF9E055B5AB138AD6D49769E2B7630B7938848D6
                                                                                                                                                                                                    SHA-256:D9C95C31B4C1092F32BDCF40D5232B31CC09FB5B68564067C1C2A5F59D3869FA
                                                                                                                                                                                                    SHA-512:88B16B7C3ACFED2FC4B1E3A14006FEF532147EB1E2930D8966E90629069462FB2E8CBF65F561E6CBC9A946F39D1866583CB02D6BB84C60C71428F489DAAA61EF
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:#.# Copyright (c) 2004, 2016, Oracle and/or its affiliates. All rights reserved..# ORACLE PROPRIETARY/CONFIDENTIAL. Use is subject to license terms..#..error.internal.badmsg=\uB0B4\uBD80 \uC624\uB958\uAC00 \uBC1C\uC0DD\uD588\uC2B5\uB2C8\uB2E4. \uC54C \uC218 \uC5C6\uB294 \uBA54\uC2DC\uC9C0\uC785\uB2C8\uB2E4..error.badinst.nojre=\uC124\uCE58\uAC00 \uC798\uBABB\uB418\uC5C8\uC2B5\uB2C8\uB2E4. \uAD6C\uC131 \uD30C\uC77C\uC5D0\uC11C JRE\uB97C \uCC3E\uC744 \uC218 \uC5C6\uC2B5\uB2C8\uB2E4..error.launch.execv=Java Web Start(execv)\uB97C \uD638\uCD9C\uD558\uB294 \uC911 \uC624\uB958\uAC00 \uBC1C\uC0DD\uD588\uC2B5\uB2C8\uB2E4..error.launch.sysexec=Java Web Start(SysExec)\uB97C \uD638\uCD9C\uD558\uB294 \uC911 \uC624\uB958\uAC00 \uBC1C\uC0DD\uD588\uC2B5\uB2C8\uB2E4. .error.listener.failed=\uC2A4\uD50C\uB798\uC2DC: sysCreateListenerSocket\uC744 \uC2E4\uD328\uD588\uC2B5\uB2C8\uB2E4..error.accept.failed=\uC2A4\uD50C\uB798\uC2DC: \uC2B9\uC778\uC744 \uC2E4\uD328\uD588\uC2B5\uB2C8\uB2E4..error.recv.failed=

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\deploy\messages_pt_BR.properties (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:ASCII text, with very long lines (1319)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):3285
                                                                                                                                                                                                    Entropy (8bit):4.837889715420947
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:48:R+OfaeLkDcUfLYgIYu9WvXx6K6GBxLy1gBne8u6K0NCMc6MTNTjtA7NZdlw7ZHAz:R1fybjfSIX8pGBxLy1Ba+mZdlw7Zs
                                                                                                                                                                                                    MD5:ED15A441A20EA85C29521A0C7C8C3097
                                                                                                                                                                                                    SHA1:24E4951743521AB9A11381C77BD0CDB1ED30F5B5
                                                                                                                                                                                                    SHA-256:4140663A49040FF191C07D2D04588402263EC2E1679A9A1A79B790A137EE7FB8
                                                                                                                                                                                                    SHA-512:BE5F0639DE6B0AC95792987D0AF83CA77495F7F49953698C8B18692DE982F77B68FE63159E8CD7537D62A71209A9FFABBECF046AD82D8341F613D39F180F9C83
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:#.# Copyright (c) 2004, 2016, Oracle and/or its affiliates. All rights reserved..# ORACLE PROPRIETARY/CONFIDENTIAL. Use is subject to license terms..#..error.internal.badmsg=erro interno, mensagem desconhecida.error.badinst.nojre=Instala\u00E7\u00E3o incorreta. Nenhum JRE encontrado no arquivo de configura\u00E7\u00E3o.error.launch.execv=Erro encontrado ao chamar Java Web Start (execv).error.launch.sysexec=Erro encontrado ao chamar Java Web Start (SysExec) .error.listener.failed=Tela Inicial: falha em sysCreateListenerSocket.error.accept.failed=Tela Inicial: falha na fun\u00E7\u00E3o accept.error.recv.failed=Tela Inicial: falha na fun\u00E7\u00E3o recv.error.invalid.port=Tela Inicial: n\u00E3o reativou uma porta v\u00E1lida.error.read=Ler ap\u00F3s o final do buffer.error.xmlparsing=Erro durante o parsing de XML: tipo incorreto de token encontrado.error.splash.exit=Saindo do processamento da tela inicial do Java Web .....\n.# "Last WinSock Error" means the error message for the last op

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\deploy\messages_sv.properties (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:ASCII text, with very long lines (1386)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):3409
                                                                                                                                                                                                    Entropy (8bit):4.897253332398417
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:96:pB+L1Q6sQcqRo/hM7M4ogqxwvpvykU/2/7JCh91XlK7Q/vm2QAfr:vM1TsGk1CzJA1KGm2QIr
                                                                                                                                                                                                    MD5:A6005BE45C88900A15BC80D461B60C30
                                                                                                                                                                                                    SHA1:CA3E18B5AEA928A8465656C86970D9584D85EF7F
                                                                                                                                                                                                    SHA-256:5CCEE63720FCAC2A136CF1FA90CBAC05040F89FFE8C082C2D067247BFCD76B87
                                                                                                                                                                                                    SHA-512:9442FFB47BF0F158A44A81A16B2AB94BB36FAC2F75B0C9467654AB9A8DF26A63C0C7A7717DEAF5476068BC0A0D602B828CE1E8D229CBFAAF201C24C0F78BE1F9
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:#.# Copyright (c) 2004, 2011, Oracle and/or its affiliates. All rights reserved..# ORACLE PROPRIETARY/CONFIDENTIAL. Use is subject to license terms..#..error.internal.badmsg=internt fel, ok\u00E4nt meddelande.error.badinst.nojre=Felaktig installation. Ingen JRE har hittats i konfigurationsfilen.error.launch.execv=Ett fel intr\u00E4ffade under starten av Java Web Start (execv).error.launch.sysexec=Ett fel intr\u00E4ffade under starten av Java Web Start (SysExec) .error.listener.failed=V\u00E4lkomstsk\u00E4rm: sysCreateListenerSocket utf\u00F6rdes inte.error.accept.failed=V\u00E4lkomstsk\u00E4rm: kunde inte accepteras.error.recv.failed=V\u00E4lkomstsk\u00E4rm: kunde inte mottaga.error.invalid.port=V\u00E4lkomstsk\u00E4rm: \u00E5terskapade inte en giltig port.error.read=L\u00E4ste f\u00F6rbi slutet av bufferten.error.xmlparsing=XML-tolkningsfel: fel typ av igenk\u00E4nningstecken hittades.error.splash.exit=Java Web Start - v\u00E4lkomstsk\u00E4rmen avslutas .....\n.# "Last WinSock Error"

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\deploy\messages_zh_CN.properties (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:ASCII text, with very long lines (1857)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):4072
                                                                                                                                                                                                    Entropy (8bit):5.01527031899567
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:96:Ln7OVgLO4c5tgvDgEY4tnf7OgdbywfK0eSm91js:3OVTjqvIwPtK1js
                                                                                                                                                                                                    MD5:E6F84C081895ACDFD98DA0F496E1DD3D
                                                                                                                                                                                                    SHA1:1C2B96673DDDD3596890EF4FC22017D484A1F652
                                                                                                                                                                                                    SHA-256:A1752A0175F490F61E0AAD46DC6887C19711F078309062D5260E164AC844F61A
                                                                                                                                                                                                    SHA-512:D4D28780147E22678CD8E7415CACFAD533AE5AF31D74426BBE4993F05A0707E4F0F71D948093FFA1A0D6EA48310E901CD0ED1C14E2FBDF69C92462D070A9664F
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:#.# Copyright (c) 2004, 2013, Oracle and/or its affiliates. All rights reserved..# ORACLE PROPRIETARY/CONFIDENTIAL. Use is subject to license terms..#..error.internal.badmsg=\u5185\u90E8\u9519\u8BEF, \u672A\u77E5\u6D88\u606F.error.badinst.nojre=\u9519\u8BEF\u5B89\u88C5\u3002\u914D\u7F6E\u6587\u4EF6\u4E2D\u627E\u4E0D\u5230 JRE.error.launch.execv=\u8C03\u7528 Java Web Start (execv) \u65F6\u9047\u5230\u9519\u8BEF.error.launch.sysexec=\u8C03\u7528 Java Web Start (SysExec) \u65F6\u9047\u5230\u9519\u8BEF.error.listener.failed=\u542F\u52A8\u5C4F\u5E55: sysCreateListenerSocket \u5931\u8D25.error.accept.failed=\u542F\u52A8\u5C4F\u5E55: \u63A5\u53D7\u5931\u8D25.error.recv.failed=\u542F\u52A8\u5C4F\u5E55: recv \u5931\u8D25.error.invalid.port=\u542F\u52A8\u5C4F\u5E55: \u672A\u6062\u590D\u6709\u6548\u7AEF\u53E3.error.read=\u8BFB\u53D6\u8D85\u51FA\u7F13\u51B2\u533A\u7ED3\u5C3E.error.xmlparsing=XML \u89E3\u6790\u9519\u8BEF: \u53D1\u73B0\u9519\u8BEF\u7684\u6807\u8BB0\u7C7B\u578B.error.splash.exit=Java

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\deploy\messages_zh_HK.properties (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:ASCII text, with very long lines (1729)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):3752
                                                                                                                                                                                                    Entropy (8bit):5.14936903006307
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:96:zMWCQv8u9/IzdG/JvFWlHaQzWy/owZFomWdYQCfQ/ydQCyJ:gWCQv7VIxG/JodaQ7PoHWQaQ/6QCY
                                                                                                                                                                                                    MD5:880BAACB176553DEAB39EDBE4B74380D
                                                                                                                                                                                                    SHA1:37A57AAD121C14C25E149206179728FA62203BF0
                                                                                                                                                                                                    SHA-256:FF4A3A92BC92CB08D2C32C435810440FD264EDD63E56EFA39430E0240C835620
                                                                                                                                                                                                    SHA-512:3039315BB283198AF9090BD3D31CFAE68EE73BC2B118BBAE0B32812D4E3FD0F11CE962068D4A17B065DAB9A66EF651B9CB8404C0A2DEFCE74BB6B2D1D93646D5
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:#.# Copyright (c) 2004, 2013, Oracle and/or its affiliates. All rights reserved..# ORACLE PROPRIETARY/CONFIDENTIAL. Use is subject to license terms..#..error.internal.badmsg=\u5167\u90E8\u932F\u8AA4\uFF0C\u4E0D\u660E\u7684\u8A0A\u606F.error.badinst.nojre=\u5B89\u88DD\u932F\u8AA4\u3002\u5728\u7D44\u614B\u6A94\u4E2D\u627E\u4E0D\u5230 JRE.error.launch.execv=\u547C\u53EB Java Web Start (execv) \u6642\u9047\u5230\u932F\u8AA4.error.launch.sysexec=\u547C\u53EB Java Web Start (SysExec) \u6642\u9047\u5230\u932F\u8AA4.error.listener.failed=Splash: sysCreateListenerSocket \u5931\u6557.error.accept.failed=Splash: \u63A5\u53D7\u5931\u6557.error.recv.failed=Splash: recv \u5931\u6557.error.invalid.port=Splash: \u6709\u6548\u7684\u9023\u63A5\u57E0\u5C1A\u672A\u56DE\u5FA9.error.read=\u8B80\u53D6\u8D85\u51FA\u7DE9\u885D\u5340\u7D50\u5C3E.error.xmlparsing=XML \u5256\u6790\u932F\u8AA4: \u627E\u5230\u932F\u8AA4\u7684\u8A18\u865F\u7A2E\u985E.error.splash.exit=Java Web Start \u9583\u73FE\u87A2\u5E55\u8655\u7

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\deploy\messages_zh_TW.properties (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:ASCII text, with very long lines (1729)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):3752
                                                                                                                                                                                                    Entropy (8bit):5.14936903006307
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:96:zMWCQv8u9/IzdG/JvFWlHaQzWy/owZFomWdYQCfQ/ydQCyJ:gWCQv7VIxG/JodaQ7PoHWQaQ/6QCY
                                                                                                                                                                                                    MD5:880BAACB176553DEAB39EDBE4B74380D
                                                                                                                                                                                                    SHA1:37A57AAD121C14C25E149206179728FA62203BF0
                                                                                                                                                                                                    SHA-256:FF4A3A92BC92CB08D2C32C435810440FD264EDD63E56EFA39430E0240C835620
                                                                                                                                                                                                    SHA-512:3039315BB283198AF9090BD3D31CFAE68EE73BC2B118BBAE0B32812D4E3FD0F11CE962068D4A17B065DAB9A66EF651B9CB8404C0A2DEFCE74BB6B2D1D93646D5
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:#.# Copyright (c) 2004, 2013, Oracle and/or its affiliates. All rights reserved..# ORACLE PROPRIETARY/CONFIDENTIAL. Use is subject to license terms..#..error.internal.badmsg=\u5167\u90E8\u932F\u8AA4\uFF0C\u4E0D\u660E\u7684\u8A0A\u606F.error.badinst.nojre=\u5B89\u88DD\u932F\u8AA4\u3002\u5728\u7D44\u614B\u6A94\u4E2D\u627E\u4E0D\u5230 JRE.error.launch.execv=\u547C\u53EB Java Web Start (execv) \u6642\u9047\u5230\u932F\u8AA4.error.launch.sysexec=\u547C\u53EB Java Web Start (SysExec) \u6642\u9047\u5230\u932F\u8AA4.error.listener.failed=Splash: sysCreateListenerSocket \u5931\u6557.error.accept.failed=Splash: \u63A5\u53D7\u5931\u6557.error.recv.failed=Splash: recv \u5931\u6557.error.invalid.port=Splash: \u6709\u6548\u7684\u9023\u63A5\u57E0\u5C1A\u672A\u56DE\u5FA9.error.read=\u8B80\u53D6\u8D85\u51FA\u7DE9\u885D\u5340\u7D50\u5C3E.error.xmlparsing=XML \u5256\u6790\u932F\u8AA4: \u627E\u5230\u932F\u8AA4\u7684\u8A18\u865F\u7A2E\u985E.error.splash.exit=Java Web Start \u9583\u73FE\u87A2\u5E55\u8655\u7

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\deploy\splash.gif (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:GIF image data, version 89a, 320 x 139
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):8590
                                                                                                                                                                                                    Entropy (8bit):7.910688771816331
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:192:91m4OqvVyG+LMIcBc2qPjHmxJCCG/h97dIYhOX:9/OqdivcqzjH3tfDE
                                                                                                                                                                                                    MD5:249053609EAF5B17DDD42149FC24C469
                                                                                                                                                                                                    SHA1:20E7AEC75F6D036D504277542E507EB7DC24AAE8
                                                                                                                                                                                                    SHA-256:113B01304EBBF3CC729A5CA3452DDA2093BD8B3DDC2BA29E5E1C1605661F90BE
                                                                                                                                                                                                    SHA-512:9C04A20E2FA70E4BCFAC729E366A0802F6F5167EA49475C2157C8E2741C4E4B8452D14C75F67906359C12F1514F9FB7E9AF8E736392AC8434F0A5811F7DDE0CB
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:GIF89a@................................................FFF...T..W..V..Is.Kv.W..W..U..Hr.P|.O{.Mx.Gq.Jt.Fo.Fp.V..U..Gp.T..Lw.P|.R..Q~.S..S..Nz.Lw.Hq.Ju.X..V..Lx.It.U..Hs.Ny.Nz.P}.R~.S..R~.R..Q}.Q}.My.Lv.It.O{.Ku.My.Oz.Gp.Gq.Hr.....................WWW.........Ry.uuu............i......ggg...]..................{..y..d..........Sz................s............i...............c............v.....X........r...........]........^........p.....z.........r..Y..l..m...............]................Mu........Qw.Nw.........v.....b..j.......V}.]........d.....k........v........Lu....S|.U{.Oy................W........Lv.U..R}.....Nv.Gp.Nx.Ks....Jr....Hq......V~.T..S~.Z.....Gq.O{.......W..Qz.......Lw.Z.....T...........S~....Lt.Kv....V.................Fo.......!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="ht

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\deploy\splash@2x.gif (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:GIF image data, version 89a, 640 x 278
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):15276
                                                                                                                                                                                                    Entropy (8bit):7.949850025334252
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:192:onqkbSDLFgIBL0IgyZCE/oIuuemXclVO/HemZ8GbRdziHm6tIclW3ZYvvebtssZn:lKMLWkpgy8sdsnOmEyPLaYoauAdI
                                                                                                                                                                                                    MD5:CB81FED291361D1DD745202659857B1B
                                                                                                                                                                                                    SHA1:0AE4A5BDA2A6D628FAC51462390B503C99509FDC
                                                                                                                                                                                                    SHA-256:9DD5CCD6BDFDAAD38F7D05A14661108E629FDD207FC7776268B566F7941E1435
                                                                                                                                                                                                    SHA-512:4A383107AC2D642F4EB63EE7E7E85A8E2F63C67B41CA55EBAE56B52CECFE8A301AAF14E6536553CBC3651519DB5C10FC66588C84C9840D496F5AE980EF2ED2B9
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:GIF89a..............................................FFF...W..V..Is.Hr.W..W..U..P|.T..Kv.O{.V..Mx....S..Fp.Jt.Lw.Gp.Gq.Lw.U..T..R..Q~.Fo.Nz.R~.R..Q}.My.Ju.It.Oz.Gp.Nz.Gq.V..Ny.Hq.P|.P}.S..S..S..Q}.Ku.Ku.Hr.Lx.X..Mx.It.U..Is.Hs.T..O{.R~.T..O{.Kv.My.Lv..........i...........]..WWWu...........ggguuut.......................................Ry.......{..............b..........................^..l.................X}....a..{.....c..................v..m........T{.f.....l........X.........................j..U|...........`........j..g..U~........^.....Qz.Jr.Nw.p.....v.....p.....Gp....r..Mt.......y..q.....]..Nv............Tz.Y.....[.....Pw....Ox..............X.....Y..X..W..V..S|............Mx....Mv.Kt.U..Hq.Lv.W.....Mu.i..Q{.Gq.Lt.S~.T..U..Kv................Fo.......!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="ht

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\deploy\splash_11-lic.gif (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:GIF image data, version 89a, 320 x 139
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):7805
                                                                                                                                                                                                    Entropy (8bit):7.877495465139721
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:96:S88k2wenvMs3iHrSI3yy73VWOcaJpGvrrXqJBcqgbf5bD0jmzDBoqCN2IWsyh:SFHhs73n73V4airrXq41Ll3vBmN2YU
                                                                                                                                                                                                    MD5:9E8F541E6CEBA93C12D272840CC555F8
                                                                                                                                                                                                    SHA1:8DEF364E07F40142822DF84B5BB4F50846CB5E4E
                                                                                                                                                                                                    SHA-256:C5578AC349105DE51C1E9109D22C7843AAB525C951E312700C73D5FD427281B9
                                                                                                                                                                                                    SHA-512:2AB06CAE68DEC9D92B66288466F24CC25505AF954FA038748D6F294D1CFFB72FCC7C07BA8928001D6C487D1BF71FE0AF1B1AA0F35120E5F6B1B2C209BA596CE2
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:GIF89a@...................................{...........c.....P|.l.....].............Ry.........S{.i.....U~........................uuuV..b........T.....WWW}..R~.......Hr.v..T|.It..........n.............e..f.....].........Hq.`........Y.....i..r.._..l...........]..Y.....v..................s..f.....z.....\........Jr.r.....................i..e.....p.....Y..m........Z..Sz.Ow....Y..Nx.{..w..Jr.T..R}....Pw.Lt.s..`..W..W..Lv...........................................FFF...W..V..Is.Kv.W..W..U..Hr.O{.Mx.Jt.Gq.Fp.Gp.Lw.Fo.U..T..Q~.R..P|.Lw.S..S..Ju.Nz.V..X..V..U..Ny.Hs.My.Ku.My.Q}.R~.P}.Q}.R..S..S..O{.Oz.Lx.Nz.Lv.It.Gp.Gq....ggg.....................S...............S|....Gp........Mw.S~.Px.Nz.Pz.......Lt.Kv.a.....V.....r.................Fo.......!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c014 79.156797, 2014/08/20-09:53:02 "> <rdf:RDF xmlns:rdf="ht

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\deploy\splash_11@2x-lic.gif (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:GIF image data, version 89a, 640 x 278
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):12250
                                                                                                                                                                                                    Entropy (8bit):7.901446927123525
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:192:Zzv4QPei/ueMFJ2M4xSGb/xGEyddpTa7Kv9I1BDc3KR3q6xmwJePYueHjAPZKGMr:5vTWvmxSGbkpTaYe1dc3KR3q7wJsOHmu
                                                                                                                                                                                                    MD5:3FE2013854A5BDAA488A6D7208D5DDD3
                                                                                                                                                                                                    SHA1:D2BFF9BBF7920CA743B81A0EE23B0719B4D057CA
                                                                                                                                                                                                    SHA-256:FC39D09D187739E580E47569556DE0D19AF28B53DF5372C7E0538FD26EDB7988
                                                                                                                                                                                                    SHA-512:E3048E8E0C22F6B200E5275477309083AA0435C0F33D1994C10CE65A52F357EE7CF7081F85C00876F438DFA1EE59B542D602287EC02EA340BFDF90C0C6ABD548
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:GIF89a.......{.....k......{...........P|.b..V......................Hr.Hq.......................]...........X...........f.............i............R~....u..It.u.....l..T~.......Qz.......^..Q~....i.......b.............Qx.Y..Y.....q..p.....v..............a..U|......T..Y........................^..n........f.....Tz.e..j..f..Ox.p..Y~.Ov.......y..Z..h.....l.....W.....w.....R|.p.....X~.a........Pw.Ks.Ir.......^.....Kt.FFF\........Ox...........W..U..Nw.Mu.W..V..Is.V..Hr.R~.W..W..U..T..O{.Kv.Gp.S..Mx.Lw.Fp.Lw.U..T..Jt.R..Gq.Fo.Ju.My.R..Q}.R~.Nz.Oz.It.Nz.V..V..Gp.Ny.Ku.P|.Ku.Gq.P}.S..Q}.S..S..Is.Lx.U..O{.Hs.T..O{.My.Mx.Kv.Lv............iii...YYY.............xxx........._.....U..Gp.U..Lv.Mw....Oz......S|.S}.Hq.\..Kv....Mv.P{.W..T........Mw.T.....Nz.q..Fo.......!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c014 79.156797, 2014/08/20-09:53:02 "> <rdf:RDF xmlns:rdf="ht

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\ext\access-bridge-32.jar (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Java archive data (JAR)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):188021
                                                                                                                                                                                                    Entropy (8bit):7.795060733492253
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:pX6M8CrEqFoaEvEdFqsvnk5vmJszZP4S8s0Cpo/iF0PeNRV2f1cPWZXBpZ:ek4rEXvnQvmOz1RWCpoqFip1CWZxT
                                                                                                                                                                                                    MD5:C6D329A325B042D0D83569FAAE0B4A5B
                                                                                                                                                                                                    SHA1:E275418CF133F25ECE4BEC9755EF5083CB4FA52F
                                                                                                                                                                                                    SHA-256:3166BA6DDD7AEB5E56DE44A51F8754F9492ED1F7CE088D500FD637859878ABE6
                                                                                                                                                                                                    SHA-512:92CDEE49B9F0498EA9789E53EE256C2F4D0DD89AFCC89DAF936A053517E66706C85CBB2F2E9ECE3C8BFCC9990A0145E5185EBDD9D23D0D5D8BB04B9F10DE119C
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK........J..I................META-INF/......PK..............PK........J..I................META-INF/MANIFEST.MF.M..LK-...K-*...R0.3..r.JM,IM.u.........+h..%&.*8.....%...k.r.r..PK..<:S1C...D...PK...........I............/...com/sun/java/accessibility/AccessBridge$1.class.S.n.@.=.........6.....BU.D.T..CQ.x.8+...F.u...$...>..B.....5.....9.gfg......St....,........sp....z*. ......".e........MG.|N..(...a.=..9!Tz.@..GJ.W./...s<..8&t.9...m......8..Jt.`..:....Q.?.a....H......y.$.Y..a.....m.c5...K.....'.....Y.`^.5..|..z_.q.*....]2p....[..P..b.A.C...W..j..(H3.....a.~...;.Z.^,.T...6QB..L.+g...%l_R....H.V..el&..#F.~6.1.9.C.g$M.+.vn..&........k 8 ...._..."G=.6P.#._@.o(}.........s`..Oy..A.Q&|...._a...c...2.....g$.+..k..:n.s7q..x....?PK....&.........PK...........I............0...com/sun/java/accessibility/AccessBridge$10.class.TYO.Q...e`.. ..X.j;...W.Z*j.u.....7ep.!3w._.1&...&....>.....q..m.s.{..l...._...n..0(IN.!...VajH`D.(.v.$.U....v....$g%9.!....N..T.Wq.!.d..e.Vj.

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\ext\cldrdata.jar (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Java archive data (JAR)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):3860502
                                                                                                                                                                                                    Entropy (8bit):7.967063452934236
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:98304:r1LPgjRCB+szqH+dIDVF0dtGN+VdEq6gQV61P4Js6RIf:r1LIUtzhsVFAFfl/N4i6yf
                                                                                                                                                                                                    MD5:530683A462DDB76AC1EB1DF6A068E0E5
                                                                                                                                                                                                    SHA1:54E34C95C0C0BC1EF1126CF2A94A728D39B239E4
                                                                                                                                                                                                    SHA-256:B897DD3475FDE617833CE81843A4E78234D54180668139129418DA6ECFF75176
                                                                                                                                                                                                    SHA-512:150D9D996C7C4F879F3147E52AE79772F6A71B0D0BDAB41745F33C4DA990FE3A6B0A7C500DD76E3C06378246F82F080C2A0C186C000A7D9FEB2BEB72EA96414A
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK........F..I................META-INF/......PK..............PK........F..I................META-INF/MANIFEST.MF.M..LK-...K-*...R0.3..r.q.B........E..%.).N. e.z.......E..9....E..E.%@...\.\.PK...n..N...Z...PK...........I................sun/text/resources/cldr/aa/FormatData_aa.classmPMO.@.}........(.@..xB....!b,1i8..6X..I.5._.'.....(..".9.yy3.f?..?..`?...*6T.5l....aG......=...mqN.......t...:6g.;`^....d.L..\0.|.b...w&.....c.;...8%H...........RqA.......b. ..p./G......B0..K.Sx6...>4\....Zy.!..".R.N....T....=..c~d.7...3(5.<.....a;F....\....a8@..a.@..d^.]YV"k....U...2'#...rX.K...ue...O....bZ.:CB...jZ.]3...2M.s....3}.ct%.GV..PK...]..d.......PK...........I................sun/text/resources/cldr/af/FormatData_af.classuV.x[W.>...a[y......R.+-..K].I.4..(...b.=....a.h...({..B!...{.U......w../...y...?.;w>.u..w..A.......xE.nFxe.nAx...^.p+.k.^..z.7 ...M.oFx..[...v.3..!.....Bx7.{.nGx/....@x?...."..A..!|....G.>..1..#|....B......A.,...>..../"|...._A.*........o"|.....A...........".

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\ext\dnsns.jar (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Java archive data (JAR)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):8286
                                                                                                                                                                                                    Entropy (8bit):7.791118848115783
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:192:9T5jIgU7WbMC8kXmHTEIWB7EH+mqcEb+wYtvEmQ+6Nb:9TZU7WbM0WTFWBAH+BCrEmQX
                                                                                                                                                                                                    MD5:E40F359A3CB63EA6933C3C33F70ECA4D
                                                                                                                                                                                                    SHA1:E137348C81ED32BAB2C59C9DDDA0AD285B5286A8
                                                                                                                                                                                                    SHA-256:360D67E745BBAD4B0307EF6B9C726DCEA929897839BFFC3C7466AC3312356A36
                                                                                                                                                                                                    SHA-512:E24CA3B0FBC0D156381E2D4B633C46EFEF813ED58E82189763EF8C268AB6F54F549334F4F08FA8162A427DA66196473AF26C3EB3F2EDB5BD69F82D3E89777172
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK........F..I................META-INF/......PK..............PK........F..I................META-INF/MANIFEST.MF.M..LK-...K-*...R0.3..r.JM,IM.u.........+h..%&.*8.....%...k.r.r..PK..<:S1C...D...PK...........I............2...sun/net/spi/nameservice/dns/DNSNameService$1.class.S]O.A.=......./@."e.,(>AH.` )..g.......l../j....LD..F_.M.xw.j.....s.{g.~.........d.n...9.0e.N..i.E.......~A.&.H..7....[<.7|....]f_.....r.)W....*~(B....nM..F.Z!.z.....Ye.(...B.3..2.AM0......pO..x.!.#.0U.I.G..Tu.&..L.......e.![.U..;...-.2.6.<.02P..9...R.......la...*.H....!.."-..H..E].Z.k^.W:p.J^s. .x .c..7j>.A..T...TfG...f....!.6zm.p.F..-.q.K.....1.!.w.C+,2..J....0.!C...0Lw...@..s[.cmp%I-.5..o...1.D].]q..4..-.t1...m.q.3.;\....D.+/..../...N....uv...R.|<<.2M...4...O.yz.F*A...).3{.....7....]..g.i..9&m.[.......K_.}.,;)}F..VR.w........|I.+..B.a...F.-C....h......Y...N...t..D.:.<..d..u`..r..B...PK..K.".u.......PK...........I............2...sun/net/spi/nameservice/dns/DNSNameService$2.class.

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\ext\is-1D2NG.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Java archive data (JAR)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):44516
                                                                                                                                                                                                    Entropy (8bit):7.904882348558591
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:768:0YVp70qfgKbWnXuZ9QvfFjJr0cRtkZQnWn109FqyvjE4p:0Kp70WgfnXuefJ+ckQnWn10vqw3p
                                                                                                                                                                                                    MD5:24DC1AEDEDDA5A229AF0694CC252BA9A
                                                                                                                                                                                                    SHA1:E42328BAFCA8639B79628DBA7867ABBEB25226E8
                                                                                                                                                                                                    SHA-256:5091F95D1C7D030FFF0A1F805B5A6D8B4EB498F4F0BEE70C06A5763326658EE5
                                                                                                                                                                                                    SHA-512:9E54903978729B6092BCC11610D46BF7904FD2503C61F2EB506A6278FBEB847B028684AD735F38F8E5731648B32A4D31744E41773768978D8A0DB1B1B00039CE
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK........J..I................META-INF/......PK..............PK........J..I................META-INF/MANIFEST.MF.M..LK-...K-*...R0.3..r.JM,IM.u.........+h..%&.*8.....%...k.r.r..PK..<:S1C...D...PK...........I............Z...com/sun/java/accessibility/util/AccessibilityEventMonitor$AccessibilityEventListener.class.Wkp.........5..5..A6`l..C\j.A...eb)..)dm....J+..h...I.&&...L.4.3.$.aH.q.....M...i..m......KNf4.y..~.9g.>.....[p.:....n..p....(........#.D'".ta/.>.D7.|.s.!..f.o......#\w?o...;q..]x....B...~.....t..4>?.#N.1$Aw........;..#j.HJ0%..p...M.5...V[.. ...*......P...).qZ)......a-i...H2.EM..H.2l.H.eX_.>..(..J_..Lj.Z\3G...,...C|.....T..$,.q.OX...[.u..Qg..6..:...iz.q.-.*...:sD@9j.2[..w..I3a.r....cXM..m..}P..J.WU.d`o.nhD.3.=).)..o2..F*...8^k...f)t.........G...e|.....C*K."#.F...,.m.q..I8)....$..x^......e..?..c.D..8..e..7...U..8..dl...rc.s.7d..3...x.....E`.....n/.8.qY......i.~BQ..\.1.K2~.K...s.C.YN...@.Lh...i....PwwW.W...2.z....<%..F..+..xW.e...K.W0...3......J..)S.

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\ext\is-4IUEM.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Java archive data (JAR)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):188021
                                                                                                                                                                                                    Entropy (8bit):7.795060733492253
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:pX6M8CrEqFoaEvEdFqsvnk5vmJszZP4S8s0Cpo/iF0PeNRV2f1cPWZXBpZ:ek4rEXvnQvmOz1RWCpoqFip1CWZxT
                                                                                                                                                                                                    MD5:C6D329A325B042D0D83569FAAE0B4A5B
                                                                                                                                                                                                    SHA1:E275418CF133F25ECE4BEC9755EF5083CB4FA52F
                                                                                                                                                                                                    SHA-256:3166BA6DDD7AEB5E56DE44A51F8754F9492ED1F7CE088D500FD637859878ABE6
                                                                                                                                                                                                    SHA-512:92CDEE49B9F0498EA9789E53EE256C2F4D0DD89AFCC89DAF936A053517E66706C85CBB2F2E9ECE3C8BFCC9990A0145E5185EBDD9D23D0D5D8BB04B9F10DE119C
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK........J..I................META-INF/......PK..............PK........J..I................META-INF/MANIFEST.MF.M..LK-...K-*...R0.3..r.JM,IM.u.........+h..%&.*8.....%...k.r.r..PK..<:S1C...D...PK...........I............/...com/sun/java/accessibility/AccessBridge$1.class.S.n.@.=.........6.....BU.D.T..CQ.x.8+...F.u...$...>..B.....5.....9.gfg......St....,........sp....z*. ......".e........MG.|N..(...a.=..9!Tz.@..GJ.W./...s<..8&t.9...m......8..Jt.`..:....Q.?.a....H......y.$.Y..a.....m.c5...K.....'.....Y.`^.5..|..z_.q.*....]2p....[..P..b.A.C...W..j..(H3.....a.~...;.Z.^,.T...6QB..L.+g...%l_R....H.V..el&..#F.~6.1.9.C.g$M.+.vn..&........k 8 ...._..."G=.6P.#._@.o(}.........s`..Oy..A.Q&|...._a...c...2.....g$.+..k..:n.s7q..x....?PK....&.........PK...........I............0...com/sun/java/accessibility/AccessBridge$10.class.TYO.Q...e`.. ..X.j;...W.Z*j.u.....7ep.!3w._.1&...&....>.....q..m.s.{..l...._...n..0(IN.!...VajH`D.(.v.$.U....v....$g%9.!....N..T.Wq.!.d..e.Vj.

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\ext\is-6S9SK.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Java archive data (JAR)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):2204781
                                                                                                                                                                                                    Entropy (8bit):6.726313285963922
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:24576:U9LcjpUw4eh5iUAWTTEvMOPnPFdRLyk2yp2Q0G1Oio:scjmw4ejiUAWOMOv9dRLkyp2vG1G
                                                                                                                                                                                                    MD5:67BC6B3A36DD2646B9D0034656FDA15C
                                                                                                                                                                                                    SHA1:F182207E68553B74337990EB549331BC02D991D1
                                                                                                                                                                                                    SHA-256:807109249EDD170531CCCA95F80C00382D22EFAA017EE13D96193AD46515F508
                                                                                                                                                                                                    SHA-512:D5076E7BC050671F063AE23D05717DFA5C733B155586B3BC025EB1F80B971AEE2C85E2AF6B5CC388E6E39F27C55E9923C136AE255B81089680A476BD977BA805
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK........F..I................META-INF/....PK........F..I<:S1D...D.......META-INF/MANIFEST.MFManifest-Version: 1.0..Created-By: 1.7.0_07 (Oracle Corporation)....PK...........Iv.^.........,...sun/text/resources/ar/CollationData_ar.class.......4..........J& . = .= .= .= .= .= .= .= .= .= .= .= .= .= .= .= .= .= .= .= .= .= .= .= .= .= .= .= .= .= .= .= .= .& 0 < . < .& 1 < . < .& 2 < . < .& 3 < . < .& 4 < . < .& 5 < . < .& 6 < . < .& 7 < . < .& 8 < . < .& 9 < . < .& . < .< .< .< .< .< .< .& Z < .; .; .; .; .; .< .< .< .< .= .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .; .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\ext\is-6U3VD.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Java archive data (JAR)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):3860502
                                                                                                                                                                                                    Entropy (8bit):7.967063452934236
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:98304:r1LPgjRCB+szqH+dIDVF0dtGN+VdEq6gQV61P4Js6RIf:r1LIUtzhsVFAFfl/N4i6yf
                                                                                                                                                                                                    MD5:530683A462DDB76AC1EB1DF6A068E0E5
                                                                                                                                                                                                    SHA1:54E34C95C0C0BC1EF1126CF2A94A728D39B239E4
                                                                                                                                                                                                    SHA-256:B897DD3475FDE617833CE81843A4E78234D54180668139129418DA6ECFF75176
                                                                                                                                                                                                    SHA-512:150D9D996C7C4F879F3147E52AE79772F6A71B0D0BDAB41745F33C4DA990FE3A6B0A7C500DD76E3C06378246F82F080C2A0C186C000A7D9FEB2BEB72EA96414A
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK........F..I................META-INF/......PK..............PK........F..I................META-INF/MANIFEST.MF.M..LK-...K-*...R0.3..r.q.B........E..%.).N. e.z.......E..9....E..E.%@...\.\.PK...n..N...Z...PK...........I................sun/text/resources/cldr/aa/FormatData_aa.classmPMO.@.}........(.@..xB....!b,1i8..6X..I.5._.'.....(..".9.yy3.f?..?..`?...*6T.5l....aG......=...mqN.......t...:6g.;`^....d.L..\0.|.b...w&.....c.;...8%H...........RqA.......b. ..p./G......B0..K.Sx6...>4\....Zy.!..".R.N....T....=..c~d.7...3(5.<.....a;F....\....a8@..a.@..d^.]YV"k....U...2'#...rX.K...ue...O....bZ.:CB...jZ.]3...2M.s....3}.ct%.GV..PK...]..d.......PK...........I................sun/text/resources/cldr/af/FormatData_af.classuV.x[W.>...a[y......R.+-..K].I.4..(...b.=....a.h...({..B!...{.U......w../...y...?.;w>.u..w..A.......xE.nFxe.nAx...^.p+.k.^..z.7 ...M.oFx..[...v.3..!.....Bx7.{.nGx/....@x?...."..A..!|....G.>..1..#|....B......A.,...>..../"|...._A.*........o"|.....A...........".

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\ext\is-7SRG1.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Java archive data (JAR)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):2022531
                                                                                                                                                                                                    Entropy (8bit):7.9336202648552385
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:49152:JByzlOa0JkhC/7mSawmjnE9MSoNNmFBTpyLu:JBy0/J9KSaw8E96NIBTl
                                                                                                                                                                                                    MD5:75642799E5E3C02F549ABE77ED53713C
                                                                                                                                                                                                    SHA1:711DBFE8954C6EED697477DBB1AC67093142A4FF
                                                                                                                                                                                                    SHA-256:C76228FE532A4F86366C98C1141C0D1917315D44723F86C118792F963D109AC9
                                                                                                                                                                                                    SHA-512:09567FDD186255D17735D8896F7DA83B0DD7874726B5284C1CDFEA32DCAC95A9A4719BDDA27B39542E658E803C9DA0D6AEF347D543AFFDF9589AB9A6985C0C65
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK........C..I................META-INF/......PK..............PK........C..I................META-INF/MANIFEST.MFm....0.E.&...:.P.0.vr....y.3T.-i..."..XoN...g....`..Rh.sf.B.F...P.5/....N(......|.Y..IC.c)..K9...N%.).S.D.qVC.#.....C..v....&..R.kf..&.......i7\..-oz.....PK..L...........PK........:..I............6...jdk/internal/dynalink/beans/AbstractJavaLinker$1.class.S.N.Q..N[.mY.".....T......7.%....A...t..n..m........k51.....2..H.51....o..|..9?~~;....9..J.Y.g...5......M%.4......z....=..v.OF"..7.#....-.e......nU...G^ K.a/.BF.....y.....*C.C.^..!.R.eH.....j....aK.M...3].....=..;'.;]j*..>C....#*.:..Z.(.N...JvEX.I.e..A..."j...C....t.C.q..:..>.J1}...z`..v...[.. .QTa..kXeX..'.1O.c..1...x..W..a.....3.Gl.VG8.C.tE5P...rN.&.v.....F.V.{.say.0^~m.....e....VW.B..x.h..u.i.K..F..j.[;;..Z.z.^f.8.q~.nR.n....Q.2..$.)B.$..|.;.....'.&. .j|@.E....FP#....A-..."...b.n.".H/c..Ho..s.I./.X..p...}..]F....SP.L.u."@..$o.9.b.'.!.;X~6..PK..]./.<...H...PK........:..I............K...jdk/internal

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\ext\is-CBGG6.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v2.0 to extract, compression method=deflate
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):280161
                                                                                                                                                                                                    Entropy (8bit):7.902858247753408
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:FGqFp1ARBxras5Ynoc9YZi1uXJzlt9jnEpeAa8bQkr16/mfGrcux2mjBETpv:FGC2RPQoFBl3bue98skp0mfwc8dETl
                                                                                                                                                                                                    MD5:35301F5D8B9390A4F8D293856F2C5722
                                                                                                                                                                                                    SHA1:3E03B24852BF437DFAE6A779E270EEE60AF5B641
                                                                                                                                                                                                    SHA-256:2B7AF7DE33F3D565C79794AC7B1454CF5CBDB94BB098C58D1D24A171FE82CF96
                                                                                                                                                                                                    SHA-512:09862D625B35E71BE2710AD3B106AE9E7AD87BDEB81F11317B9D1F18A8260F7DE8114085DFFF0FF2C7283CA5A1125CFC91ED2E1EAEAAE9A1F5C5386AF094E935
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK...........H................META-INF/MANIFEST.MF..I..F.-....^..@.1.DG|.. @..q`"...H....V.%....{)fVU..C..6.5........O....TwUZ.......l.c...')......:..k.o...}......o...F....K....}.I..??.}.W.OL.wm..~.e.........=L._..zZ........O...?..=..P..KX?.C.........?...i8........7t...|....~-.....?^.?..E...../..]..y..`..;..ax..........a..-....x..s.l....t.s&9\.....#ox.M........t..xl.._....x{...&1....z.Ga.L.<.N.,.T.^|.....eZ{..\)..p.,./w..TBH...=m..._b..O..,.....#.. y.B.4^~.6.F...%IHY...`...z.....(Z.??2>O........R5.6.->..Q..@..,z.9........#0.......g....J.6.0.j.7r.J0...<?f...*r|....4nQ.;4.M.+i...$g.Y.t..k.F.X..2xc.=....Ax.....Ks..c.....r..+..].....Y!).Y).\....T.$....d..*Q;D............%.T......:.KUa.C.6..R~`.yH..*.G.0({...Wm...D..T..M4.!$.=1..D..;..S......;r.v.4.Fb.W.<.n..W..!`..tz.s.3.:...g.....ch...@..{...c._...&I.d.t.{......N.M9+..4b$.......7\.%u:...P)a..'}..;...*<...E..C.|=q..Hn.f%.+....Ys.( ......o......2..?4..?~..2..>4.. .i....L.....m.D..&....R..

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\ext\is-FQUJ4.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Java archive data (JAR)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):18218535
                                                                                                                                                                                                    Entropy (8bit):5.974892364742322
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:49152:9kMaDalw/liWL8t1S8dVju8FGfPsQQt6f2pXF7alpUoOht9Zw+yvpPxkU3fWijUV:9eWwtqfS8z1FGfPbg66TDwtuijUMgP
                                                                                                                                                                                                    MD5:8D919E76DFC15CCAE11ECA6D37062F53
                                                                                                                                                                                                    SHA1:407059276C832B8478CFC627A70440AC02080D88
                                                                                                                                                                                                    SHA-256:958845347D6C466811DCEC327D428E5C396C8363CEF25389C958EED87D908926
                                                                                                                                                                                                    SHA-512:29575E502A8881B296CA8072011E3351CFE63A4045E4409F411128243E4EFCED5751D6BC0E87A6AF9148373C01AC8B75B5BA8E26BC963CE337FDD78EF364CDC6
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK........|`.I................META-INF/....PK........{`.I..>.g...g.......META-INF/MANIFEST.MFManifest-Version: 1.0..Ant-Version: Apache Ant 1.8.2..Created-By: 1.8.0_40-b27 (Oracle Corporation)....PK.........Y.I................com/PK.........Y.I................com/sun/PK.........Z.I................com/sun/deploy/PK.........Z.I................com/sun/deploy/uitoolkit/PK.........Z.I................com/sun/deploy/uitoolkit/impl/PK........|`.I............!...com/sun/deploy/uitoolkit/impl/fx/PK........|`.I............$...com/sun/deploy/uitoolkit/impl/fx/ui/PK........|`.I................com/sun/deploy/uitoolkit/impl/fx/ui/resources/PK........z`.I............4...com/sun/deploy/uitoolkit/impl/fx/ui/resources/image/PK........x`.I................com/sun/glass/PK........z`.I................com/sun/glass/events/PK........|`.I................com/sun/glass/ui/PK........z`.I................com/sun/glass/ui/delegate/PK........|`.I................com/sun/glass/ui/win/PK.........Y.I................com/su

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\ext\is-I0VT2.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v2.0 to extract, compression method=deflate
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):32699
                                                                                                                                                                                                    Entropy (8bit):7.878192531974338
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:768:iLy1giOqjU0jNVmOTuDQJD/RpAczsikFfg0y+7aBTS73dyPoXvvKv2PtvHubyKhi:i4giOaU0jNVmOCADZpVsiUf3yua5S7t7
                                                                                                                                                                                                    MD5:2249EAC4F859C7BC578AFD2F7B771249
                                                                                                                                                                                                    SHA1:76BA0E08C6B3DF9FB1551F00189323DAC8FC818C
                                                                                                                                                                                                    SHA-256:A0719CAE8271F918C8613FEB92A7591D0A6E7D04266F62144B2EAB7844D00C75
                                                                                                                                                                                                    SHA-512:DB5415BC542F4910166163F9BA34BC33AF1D114A73D852B143B2C3E28F59270827006693D6DF460523E26516CAB351D2EE3F944D715AE86CD12D926D09F92454
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK........)..H................META-INF/MANIFEST.MF....X.........ad2....@..%E..M.^.x.. O_dW.5Qi..8.....).aY=.!.Q....g..AM..&0....d.*./#..yM+......g.[.O..$....I?>X9..G......h.]...".y....do.O..2.Y.\^...}+....p2..u.]...V0}....&..a.C...-.....n.....M...M.F..,.....v@...>>|..["J...U7")..#b.oV.a...l.g..e.s..L.D..={.-gLEt.....!/... q....z.J...0.2e...=.....[]{..N...1....Z.....2...I.k...Sy..Qm...{....;.On..!.@..S.IZ..=......Lo.N4..|.j...!.l..G..}.Q....u....ADh.z.w.-..@%.@...!.".R.nHE.P]..J!..E.9Sw.LM7.&...[v..~.P...bp;.....:id.e..o.h..8.C....l...70..].gp..7.<.P.....Zj.....M......-.(@~...M^.....asJ.Y.1.e...(qW..h.c.Iu...-.A..?.5.Ex.S.oc6.).Qkr..+....|..._..H..!7..hs.r.;.z=.....*#.c....6...O+q.I.....|.4.V....Y.T.....4XO..4.>..1.$h..lu..l0..?...w.......o.u....6..)BG'..f......d.v...........<.i..Bj..d..L.....G.r@1.....0..d......'...........*.rK....5x..8.V..9(..Y.`'.k.N....3b.rx.p..c...M_j%..U.z.|Y.1\....d...-I.<g........-.h.*.F...me.F..p.c.o..

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\ext\is-L9IJ7.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Java archive data (JAR)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):8286
                                                                                                                                                                                                    Entropy (8bit):7.791118848115783
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:192:9T5jIgU7WbMC8kXmHTEIWB7EH+mqcEb+wYtvEmQ+6Nb:9TZU7WbM0WTFWBAH+BCrEmQX
                                                                                                                                                                                                    MD5:E40F359A3CB63EA6933C3C33F70ECA4D
                                                                                                                                                                                                    SHA1:E137348C81ED32BAB2C59C9DDDA0AD285B5286A8
                                                                                                                                                                                                    SHA-256:360D67E745BBAD4B0307EF6B9C726DCEA929897839BFFC3C7466AC3312356A36
                                                                                                                                                                                                    SHA-512:E24CA3B0FBC0D156381E2D4B633C46EFEF813ED58E82189763EF8C268AB6F54F549334F4F08FA8162A427DA66196473AF26C3EB3F2EDB5BD69F82D3E89777172
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK........F..I................META-INF/......PK..............PK........F..I................META-INF/MANIFEST.MF.M..LK-...K-*...R0.3..r.JM,IM.u.........+h..%&.*8.....%...k.r.r..PK..<:S1C...D...PK...........I............2...sun/net/spi/nameservice/dns/DNSNameService$1.class.S]O.A.=......./@."e.,(>AH.` )..g.......l../j....LD..F_.M.xw.j.....s.{g.~.........d.n...9.0e.N..i.E.......~A.&.H..7....[<.7|....]f_.....r.)W....*~(B....nM..F.Z!.z.....Ye.(...B.3..2.AM0......pO..x.!.#.0U.I.G..Tu.&..L.......e.![.U..;...-.2.6.<.02P..9...R.......la...*.H....!.."-..H..E].Z.k^.W:p.J^s. .x .c..7j>.A..T...TfG...f....!.6zm.p.F..-.q.K.....1.!.w.C+,2..J....0.!C...0Lw...@..s[.cmp%I-.5..o...1.D].]q..4..-.t1...m.q.3.;\....D.+/..../...N....uv...R.|<<.2M...4...O.yz.F*A...).3{.....7....]..g.i..9&m.[.......K_.}.,;)}F..VR.w........|I.+..B.a...F.-C....h......Y...N...t..D.:.<..d..u`..r..B...PK..K.".u.......PK...........I............2...sun/net/spi/nameservice/dns/DNSNameService$2.class.

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\ext\is-M96OR.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v2.0 to extract, compression method=deflate
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):42154
                                                                                                                                                                                                    Entropy (8bit):7.935808625225927
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:768:1AESQ7Oqlw6pOVkJBlrQbgZgJ4SlKUKvfkM/4ZW58eKMpP/p5BZmQEnrn6RDan3f:1MQO0w6pOyxrnZgJNlKF/4C80Rx5e2R2
                                                                                                                                                                                                    MD5:319324D6C53147C299B951BCCF855CCF
                                                                                                                                                                                                    SHA1:97593CC48694C7D95F0151225B1F3C035405B47A
                                                                                                                                                                                                    SHA-256:0D1BAB4B77D6F0CC1DD6D330EF70E3BE81D159EF900CE75A9CBDCF26289D84BE
                                                                                                                                                                                                    SHA-512:D0475F230A59AD633DF64FE7624A6277D17A7B4F982F582AEF6B9C735348FBBC5DE7189AFE0FADCEFC3D7507127FBBE7CCB530C39D514719A21B6266814CDA41
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK.........vI................META-INF/MANIFEST.MF..K..H.........v....;b..((..P.2...B.%O?.boll.t..\....3._..........f.....>?.I.....[..'.,c.6..;......i.Q..>..H.L..$......'......z.)..c0b3.g...d......,y.V..>.Sc.<e(.-Tq....'.-Az.6.I.!././>..2{~b.pK.L..]7...?>...s-.U;...B......]._!Xv..1..Nu!Z.....z.c.z...bBP.......F..sA1X6..k...!...Ux../..^5..p.b..0O.R....AV..U.6.i........"..#RXj.b.q.-~..@._..B5...a....9...#.......Zk._...\Dmwy..Y.E.I.Oe.....qO....#.......3.-S.cH56...H.:{H.~P........U2S+.fE.[.$..BmCH.E{;pe..C.Z..<......n.HZ....D.ib..'@.s...O.c..Ocu.I.j..d...}..0u...o=.g.!.,.r.-H....@........>.P..w...g.......r.rN.+0...\.Z{...|a....*3..'..1Ej.....*..%.H.8.........v.............F..... .r.........X.*@G.mE..Kn....)l......[c!..........Y....&...[.Q......./g?q....%..2....D...[..%Z..8..ih...zI..q>.._.jn3....^$Vv.W)>....G.|..3.Ab.6.Q.(R$6..e.`...m.....F....EW.Q..0.0.^.|.|X...]W'.......N.'..1[..A....]SW.I.`.B5'/.<^......0.....21h......A....Z.&p...!}..f5..{.N

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\ext\is-MD9LI.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Java archive data (JAR)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):68924
                                                                                                                                                                                                    Entropy (8bit):7.9507410585665905
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:1536:9SeEypJHbd836l1MIeEfqjGWb26U2jARnbismp/J:YeEyp9dFl1leEPuan2smD
                                                                                                                                                                                                    MD5:62F5C758160EE10591097F6CC79BF86D
                                                                                                                                                                                                    SHA1:0577B523114BD97A21B5A348C9963F5446D9D423
                                                                                                                                                                                                    SHA-256:415EEB1C5BCFB1E68B49B95DEFF8A9D48A646B0C6A527A3A80091A329E2777C1
                                                                                                                                                                                                    SHA-512:EB50AB9B3C883066095CF6482E9EB114267A4CFEDAC62D6AC0D501727901AFBB345D68067EE25420593694D80D516CD845950BCE60802AD0511B26F0A9EBE0F3
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK........4..I................META-INF/......PK..............PK........4..I................META-INF/MANIFEST.MF.....@.E....)..$6.t.,"..........f..ob.+..so.V..Ct&.....E,Ea:M.l.0.Ci.....kM.;..?..zRAS.;...W..!..^..#.C..]-.K.L.8vT.V...s&..D..(H.A..lJ...7+..ul`]...M...JQ..Q........PK...x.K....L...PK........%..I............-...com/sun/nio/zipfs/JarFileSystemProvider.class.U]S.U.~NH.a.@..B.\.!.$.U[.X..J..H..G...$,Mv.....z....9...........Z.d..a.1.y...<..s.y...~....x&c......q..B.`B.......'b.4...'e.1%......i!f../aV.L......B,.XD..KX.......V..^..@....`SD..`[.C._0.'..p.2.EF...SV.3t-.&OW.Yn....i....vx..=..]}O.J.Y.2.m..q.Tmc.Z.....H.arW[[I.7.L...F.k.E&...../.z.J...,U. QD...%....v...".+s.-f.....e..3....."..bvu[..b..Ag.<I7U*.^J..j....~.W\.2....i.j..1C7..:..U.QM.UG.d.c`4.8.Pf..MA.E.;0...1.r..bX..$l>h..%..,h.*..."^=m.90]}.T.}'.&...B;m.-.9.\T....x.p.laD.....#..U.r..P..o...(.a.....`.E.....*1..4-......fT......H.*kN..1....r.Z"7.J+d....B5.'U...e.).!...rt...^.p3..k.8.j.:..k5T...."

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\ext\is-NMA8A.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):1511
                                                                                                                                                                                                    Entropy (8bit):5.142622776492157
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:24:EV677x6CFRf08P86xX+4jz98ht4QLlJVzDOFw5DOFFVzDOFvVzDOFz5qlV/FRARV:EE796OfT0OZjzGs6lDitfitigXFqX6Kp
                                                                                                                                                                                                    MD5:77ABE2551C7A5931B70F78962AC5A3C7
                                                                                                                                                                                                    SHA1:A8BB53A505D7002DEF70C7A8788B9A2EA8A1D7BC
                                                                                                                                                                                                    SHA-256:C557F0C9053301703798E01DC0F65E290B0AE69075FB49FCC0E68C14B21D87F4
                                                                                                                                                                                                    SHA-512:9FE671380335804D4416E26C1E00CDED200687DB484F770EBBDB8631A9C769F0A449C661CB38F49C41463E822BEB5248E69FD63562C3D8C508154C5D64421935
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:% VERSION 2..% WARNING: this file is auto-generated; do not edit..% UNSUPPORTED: this file and its format may change and/or..% may be removed in a future release..! access-bridge-32.jar..com/sun/java/accessibility/..! access-bridge.jar..com/sun/java/accessibility/..! cldrdata.jar..sun/text..sun/util..# dnsns.jar..META-INF/services/sun.net.spi.nameservice.NameServiceDescriptor..sun/net..! jaccess.jar..com/sun/java/accessibility/..# localedata.jar..sun/text..sun/util..# nashorn.jar..jdk/nashorn..META-INF/services/javax.script.ScriptuserFactory..jdk/internal..# sunec.jar..sun/security..META-INF/ORACLE_J.RSA..META-INF/ORACLE_J.SF..# sunjce_provider.jar..com/sun/crypto/..META-INF/ORACLE_J.RSA..META-INF/ORACLE_J.SF..# sunmscapi.jar..sun/security..META-INF/ORACLE_J.RSA..META-INF/ORACLE_J.SF..# sunpkcs11.jar..sun/security..META-INF/ORACLE_J.RSA..META-INF/ORACLE_J.SF..# zipfs.jar..META-INF/services/java.nio.file.spi.FileSystemProvider..com/sun/nio/..# jfxrt.jar..META-INF/INDEX.LIST..com/sun

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\ext\is-TUEMP.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v2.0 to extract, compression method=deflate
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):251327
                                                                                                                                                                                                    Entropy (8bit):7.951485363771875
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:6144:GJ+LIFVys2YON2lJmF5BwP5PYYGhscw1g0yHSno9O:GJMUVLbON8JK5BwP5PYYQlw1g0v2O
                                                                                                                                                                                                    MD5:9F5ABE7CCB653F571167E27822DF93D2
                                                                                                                                                                                                    SHA1:97F0F18B2D0A5ED5A01A682027EFA9FB8BAE1A5C
                                                                                                                                                                                                    SHA-256:2AAD2465AB8903C7F66A46B34D0D4ECBEEA72D44AFEDAAC9822E48B5B175595D
                                                                                                                                                                                                    SHA-512:629F56D9EB6A4634A54A2DC207D02F6BF94849DEAA4D0A093C7709AC4AB651881CDEED547D466F2679968F4B7896CD553F61A6FC6583EDE90A2053F09864669A
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK.........vI................META-INF/MANIFEST.MF.zG.f...U.....l@".U.,.. ..". 2...G3.0._=h...#!....:.A...0..&..7..>..A?.$..*.'........J..I....9.c~O>q...M...=.........'.M.<.?.....'...*..4}.._..//...b..OQs.m........U0.M..D..=..O.2&....z.......,.E....?1}..I.+.~97.<7..........._.8..W.....8$......e4.0..]....}r..1.$.QH......-..ax..D.z@._.<{...F..c.........}i....o..Wf.2rl.z..>>...6.AF.L.)...*..A..Q...j@kYDja.i.L....$,..6^.$.#......<...|~...WR.-....=r8.R.L.|...t..g.#.x._y.^B.R9....KY/..#WU..X&j.nA@Z.....F|.xh.>...jY.....U...9.+..18.b...\.(!Uk..`..D...> .`.W.-..:.mrb\.;.............D.t.D..b.6......z.....qq............l/0.OB...m....oa.cN.Y..WR..K7...X.9.@I...@...!.@.....(W.}M...%./..X...q^g...'..6;.,a..q..M0.|p".....qn..%^...vS&.+1.pX3^}.J./...8+..g..d.q%..7..."..<.......H.H..>...zf. ..c..G.k.WR.I..#-;!.`...!.Y<..H)..L...J.....{.;..D:..^4...I..v+........=......~....Qp....|h.v...N..{.z.o..(<.c.^.u....gZ.v~%s.Y.p.z.&..6R....J-J.Up..f....d..

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\ext\jaccess.jar (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Java archive data (JAR)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):44516
                                                                                                                                                                                                    Entropy (8bit):7.904882348558591
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:768:0YVp70qfgKbWnXuZ9QvfFjJr0cRtkZQnWn109FqyvjE4p:0Kp70WgfnXuefJ+ckQnWn10vqw3p
                                                                                                                                                                                                    MD5:24DC1AEDEDDA5A229AF0694CC252BA9A
                                                                                                                                                                                                    SHA1:E42328BAFCA8639B79628DBA7867ABBEB25226E8
                                                                                                                                                                                                    SHA-256:5091F95D1C7D030FFF0A1F805B5A6D8B4EB498F4F0BEE70C06A5763326658EE5
                                                                                                                                                                                                    SHA-512:9E54903978729B6092BCC11610D46BF7904FD2503C61F2EB506A6278FBEB847B028684AD735F38F8E5731648B32A4D31744E41773768978D8A0DB1B1B00039CE
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK........J..I................META-INF/......PK..............PK........J..I................META-INF/MANIFEST.MF.M..LK-...K-*...R0.3..r.JM,IM.u.........+h..%&.*8.....%...k.r.r..PK..<:S1C...D...PK...........I............Z...com/sun/java/accessibility/util/AccessibilityEventMonitor$AccessibilityEventListener.class.Wkp.........5..5..A6`l..C\j.A...eb)..)dm....J+..h...I.&&...L.4.3.$.aH.q.....M...i..m......KNf4.y..~.9g.>.....[p.:....n..p....(........#.D'".ta/.>.D7.|.s.!..f.o......#\w?o...;q..]x....B...~.....t..4>?.#N.1$Aw........;..#j.HJ0%..p...M.5...V[.. ...*......P...).qZ)......a-i...H2.EM..H.2l.H.eX_.>..(..J_..Lj.Z\3G...,...C|.....T..$,.q.OX...[.u..Qg..6..:...iz.q.-.*...:sD@9j.2[..w..I3a.r....cXM..m..}P..J.WU.d`o.nhD.3.=).)..o2..F*...8^k...f)t.........G...e|.....C*K."#.F...,.m.q..I8)....$..x^......e..?..c.D..8..e..7...U..8..dl...rc.s.7d..3...x.....E`.....n/.8.qY......i.~BQ..\.1.K2~.K...s.C.YN...@.Lh...i....PwwW.W...2.z....<%..F..+..xW.e...K.W0...3......J..)S.

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\ext\jfxrt.jar (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Java archive data (JAR)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):18218535
                                                                                                                                                                                                    Entropy (8bit):5.974892364742322
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:49152:9kMaDalw/liWL8t1S8dVju8FGfPsQQt6f2pXF7alpUoOht9Zw+yvpPxkU3fWijUV:9eWwtqfS8z1FGfPbg66TDwtuijUMgP
                                                                                                                                                                                                    MD5:8D919E76DFC15CCAE11ECA6D37062F53
                                                                                                                                                                                                    SHA1:407059276C832B8478CFC627A70440AC02080D88
                                                                                                                                                                                                    SHA-256:958845347D6C466811DCEC327D428E5C396C8363CEF25389C958EED87D908926
                                                                                                                                                                                                    SHA-512:29575E502A8881B296CA8072011E3351CFE63A4045E4409F411128243E4EFCED5751D6BC0E87A6AF9148373C01AC8B75B5BA8E26BC963CE337FDD78EF364CDC6
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK........|`.I................META-INF/....PK........{`.I..>.g...g.......META-INF/MANIFEST.MFManifest-Version: 1.0..Ant-Version: Apache Ant 1.8.2..Created-By: 1.8.0_40-b27 (Oracle Corporation)....PK.........Y.I................com/PK.........Y.I................com/sun/PK.........Z.I................com/sun/deploy/PK.........Z.I................com/sun/deploy/uitoolkit/PK.........Z.I................com/sun/deploy/uitoolkit/impl/PK........|`.I............!...com/sun/deploy/uitoolkit/impl/fx/PK........|`.I............$...com/sun/deploy/uitoolkit/impl/fx/ui/PK........|`.I................com/sun/deploy/uitoolkit/impl/fx/ui/resources/PK........z`.I............4...com/sun/deploy/uitoolkit/impl/fx/ui/resources/image/PK........x`.I................com/sun/glass/PK........z`.I................com/sun/glass/events/PK........|`.I................com/sun/glass/ui/PK........z`.I................com/sun/glass/ui/delegate/PK........|`.I................com/sun/glass/ui/win/PK.........Y.I................com/su

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\ext\localedata.jar (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Java archive data (JAR)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):2204781
                                                                                                                                                                                                    Entropy (8bit):6.726313285963922
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:24576:U9LcjpUw4eh5iUAWTTEvMOPnPFdRLyk2yp2Q0G1Oio:scjmw4ejiUAWOMOv9dRLkyp2vG1G
                                                                                                                                                                                                    MD5:67BC6B3A36DD2646B9D0034656FDA15C
                                                                                                                                                                                                    SHA1:F182207E68553B74337990EB549331BC02D991D1
                                                                                                                                                                                                    SHA-256:807109249EDD170531CCCA95F80C00382D22EFAA017EE13D96193AD46515F508
                                                                                                                                                                                                    SHA-512:D5076E7BC050671F063AE23D05717DFA5C733B155586B3BC025EB1F80B971AEE2C85E2AF6B5CC388E6E39F27C55E9923C136AE255B81089680A476BD977BA805
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK........F..I................META-INF/....PK........F..I<:S1D...D.......META-INF/MANIFEST.MFManifest-Version: 1.0..Created-By: 1.7.0_07 (Oracle Corporation)....PK...........Iv.^.........,...sun/text/resources/ar/CollationData_ar.class.......4..........J& . = .= .= .= .= .= .= .= .= .= .= .= .= .= .= .= .= .= .= .= .= .= .= .= .= .= .= .= .= .= .= .= .= .& 0 < . < .& 1 < . < .& 2 < . < .& 3 < . < .& 4 < . < .& 5 < . < .& 6 < . < .& 7 < . < .& 8 < . < .& 9 < . < .& . < .< .< .< .< .< .< .& Z < .; .; .; .; .; .< .< .< .< .= .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .; .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .< .

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\ext\meta-index (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):1511
                                                                                                                                                                                                    Entropy (8bit):5.142622776492157
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:24:EV677x6CFRf08P86xX+4jz98ht4QLlJVzDOFw5DOFFVzDOFvVzDOFz5qlV/FRARV:EE796OfT0OZjzGs6lDitfitigXFqX6Kp
                                                                                                                                                                                                    MD5:77ABE2551C7A5931B70F78962AC5A3C7
                                                                                                                                                                                                    SHA1:A8BB53A505D7002DEF70C7A8788B9A2EA8A1D7BC
                                                                                                                                                                                                    SHA-256:C557F0C9053301703798E01DC0F65E290B0AE69075FB49FCC0E68C14B21D87F4
                                                                                                                                                                                                    SHA-512:9FE671380335804D4416E26C1E00CDED200687DB484F770EBBDB8631A9C769F0A449C661CB38F49C41463E822BEB5248E69FD63562C3D8C508154C5D64421935
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:% VERSION 2..% WARNING: this file is auto-generated; do not edit..% UNSUPPORTED: this file and its format may change and/or..% may be removed in a future release..! access-bridge-32.jar..com/sun/java/accessibility/..! access-bridge.jar..com/sun/java/accessibility/..! cldrdata.jar..sun/text..sun/util..# dnsns.jar..META-INF/services/sun.net.spi.nameservice.NameServiceDescriptor..sun/net..! jaccess.jar..com/sun/java/accessibility/..# localedata.jar..sun/text..sun/util..# nashorn.jar..jdk/nashorn..META-INF/services/javax.script.ScriptuserFactory..jdk/internal..# sunec.jar..sun/security..META-INF/ORACLE_J.RSA..META-INF/ORACLE_J.SF..# sunjce_provider.jar..com/sun/crypto/..META-INF/ORACLE_J.RSA..META-INF/ORACLE_J.SF..# sunmscapi.jar..sun/security..META-INF/ORACLE_J.RSA..META-INF/ORACLE_J.SF..# sunpkcs11.jar..sun/security..META-INF/ORACLE_J.RSA..META-INF/ORACLE_J.SF..# zipfs.jar..META-INF/services/java.nio.file.spi.FileSystemProvider..com/sun/nio/..# jfxrt.jar..META-INF/INDEX.LIST..com/sun

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\ext\nashorn.jar (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Java archive data (JAR)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):2022531
                                                                                                                                                                                                    Entropy (8bit):7.9336202648552385
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:49152:JByzlOa0JkhC/7mSawmjnE9MSoNNmFBTpyLu:JBy0/J9KSaw8E96NIBTl
                                                                                                                                                                                                    MD5:75642799E5E3C02F549ABE77ED53713C
                                                                                                                                                                                                    SHA1:711DBFE8954C6EED697477DBB1AC67093142A4FF
                                                                                                                                                                                                    SHA-256:C76228FE532A4F86366C98C1141C0D1917315D44723F86C118792F963D109AC9
                                                                                                                                                                                                    SHA-512:09567FDD186255D17735D8896F7DA83B0DD7874726B5284C1CDFEA32DCAC95A9A4719BDDA27B39542E658E803C9DA0D6AEF347D543AFFDF9589AB9A6985C0C65
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK........C..I................META-INF/......PK..............PK........C..I................META-INF/MANIFEST.MFm....0.E.&...:.P.0.vr....y.3T.-i..."..XoN...g....`..Rh.sf.B.F...P.5/....N(......|.Y..IC.c)..K9...N%.).S.D.qVC.#.....C..v....&..R.kf..&.......i7\..-oz.....PK..L...........PK........:..I............6...jdk/internal/dynalink/beans/AbstractJavaLinker$1.class.S.N.Q..N[.mY.".....T......7.%....A...t..n..m........k51.....2..H.51....o..|..9?~~;....9..J.Y.g...5......M%.4......z....=..v.OF"..7.#....-.e......nU...G^ K.a/.BF.....y.....*C.C.^..!.R.eH.....j....aK.M...3].....=..;'.;]j*..>C....#*.:..Z.(.N...JvEX.I.e..A..."j...C....t.C.q..:..>.J1}...z`..v...[.. .QTa..kXeX..'.1O.c..1...x..W..a.....3.Gl.VG8.C.tE5P...rN.&.v.....F.V.{.say.0^~m.....e....VW.B..x.h..u.i.K..F..j.[;;..Z.z.^f.8.q~.nR.n....Q.2..$.)B.$..|.;.....'.&. .j|@.E....FP#....A-..."...b.n.".H/c..Ho..s.I./.X..p...}..]F....SP.L.u."@..$o.9.b.'.!.;X~6..PK..]./.<...H...PK........:..I............K...jdk/internal

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\ext\sunec.jar (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v2.0 to extract, compression method=deflate
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):42154
                                                                                                                                                                                                    Entropy (8bit):7.935808625225927
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:768:1AESQ7Oqlw6pOVkJBlrQbgZgJ4SlKUKvfkM/4ZW58eKMpP/p5BZmQEnrn6RDan3f:1MQO0w6pOyxrnZgJNlKF/4C80Rx5e2R2
                                                                                                                                                                                                    MD5:319324D6C53147C299B951BCCF855CCF
                                                                                                                                                                                                    SHA1:97593CC48694C7D95F0151225B1F3C035405B47A
                                                                                                                                                                                                    SHA-256:0D1BAB4B77D6F0CC1DD6D330EF70E3BE81D159EF900CE75A9CBDCF26289D84BE
                                                                                                                                                                                                    SHA-512:D0475F230A59AD633DF64FE7624A6277D17A7B4F982F582AEF6B9C735348FBBC5DE7189AFE0FADCEFC3D7507127FBBE7CCB530C39D514719A21B6266814CDA41
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK.........vI................META-INF/MANIFEST.MF..K..H.........v....;b..((..P.2...B.%O?.boll.t..\....3._..........f.....>?.I.....[..'.,c.6..;......i.Q..>..H.L..$......'......z.)..c0b3.g...d......,y.V..>.Sc.<e(.-Tq....'.-Az.6.I.!././>..2{~b.pK.L..]7...?>...s-.U;...B......]._!Xv..1..Nu!Z.....z.c.z...bBP.......F..sA1X6..k...!...Ux../..^5..p.b..0O.R....AV..U.6.i........"..#RXj.b.q.-~..@._..B5...a....9...#.......Zk._...\Dmwy..Y.E.I.Oe.....qO....#.......3.-S.cH56...H.:{H.~P........U2S+.fE.[.$..BmCH.E{;pe..C.Z..<......n.HZ....D.ib..'@.s...O.c..Ocu.I.j..d...}..0u...o=.g.!.,.r.-H....@........>.P..w...g.......r.rN.+0...\.Z{...|a....*3..'..1Ej.....*..%.H.8.........v.............F..... .r.........X.*@G.mE..Kn....)l......[c!..........Y....&...[.Q......./g?q....%..2....D...[..%Z..8..ih...zI..q>.._.jn3....^$Vv.W)>....G.|..3.Ab.6.Q.(R$6..e.`...m.....F....EW.Q..0.0.^.|.|X...]W'.......N.'..1[..A....]SW.I.`.B5'/.<^......0.....21h......A....Z.&p...!}..f5..{.N

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\ext\sunjce_provider.jar (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v2.0 to extract, compression method=deflate
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):280161
                                                                                                                                                                                                    Entropy (8bit):7.902858247753408
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:FGqFp1ARBxras5Ynoc9YZi1uXJzlt9jnEpeAa8bQkr16/mfGrcux2mjBETpv:FGC2RPQoFBl3bue98skp0mfwc8dETl
                                                                                                                                                                                                    MD5:35301F5D8B9390A4F8D293856F2C5722
                                                                                                                                                                                                    SHA1:3E03B24852BF437DFAE6A779E270EEE60AF5B641
                                                                                                                                                                                                    SHA-256:2B7AF7DE33F3D565C79794AC7B1454CF5CBDB94BB098C58D1D24A171FE82CF96
                                                                                                                                                                                                    SHA-512:09862D625B35E71BE2710AD3B106AE9E7AD87BDEB81F11317B9D1F18A8260F7DE8114085DFFF0FF2C7283CA5A1125CFC91ED2E1EAEAAE9A1F5C5386AF094E935
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK...........H................META-INF/MANIFEST.MF..I..F.-....^..@.1.DG|.. @..q`"...H....V.%....{)fVU..C..6.5........O....TwUZ.......l.c...')......:..k.o...}......o...F....K....}.I..??.}.W.OL.wm..~.e.........=L._..zZ........O...?..=..P..KX?.C.........?...i8........7t...|....~-.....?^.?..E...../..]..y..`..;..ax..........a..-....x..s.l....t.s&9\.....#ox.M........t..xl.._....x{...&1....z.Ga.L.<.N.,.T.^|.....eZ{..\)..p.,./w..TBH...=m..._b..O..,.....#.. y.B.4^~.6.F...%IHY...`...z.....(Z.??2>O........R5.6.->..Q..@..,z.9........#0.......g....J.6.0.j.7r.J0...<?f...*r|....4nQ.;4.M.+i...$g.Y.t..k.F.X..2xc.=....Ax.....Ks..c.....r..+..].....Y!).Y).\....T.$....d..*Q;D............%.T......:.KUa.C.6..R~`.yH..*.G.0({...Wm...D..T..M4.!$.=1..D..;..S......;r.v.4.Fb.W.<.n..W..!`..tz.s.3.:...g.....ch...@..{...c._...&I.d.t.{......N.M9+..4b$.......7\.%u:...P)a..'}..;...*<...E..C.|=q..Hn.f%.+....Ys.( ......o......2..?4..?~..2..>4.. .i....L.....m.D..&....R..

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\ext\sunmscapi.jar (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v2.0 to extract, compression method=deflate
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):32699
                                                                                                                                                                                                    Entropy (8bit):7.878192531974338
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:768:iLy1giOqjU0jNVmOTuDQJD/RpAczsikFfg0y+7aBTS73dyPoXvvKv2PtvHubyKhi:i4giOaU0jNVmOCADZpVsiUf3yua5S7t7
                                                                                                                                                                                                    MD5:2249EAC4F859C7BC578AFD2F7B771249
                                                                                                                                                                                                    SHA1:76BA0E08C6B3DF9FB1551F00189323DAC8FC818C
                                                                                                                                                                                                    SHA-256:A0719CAE8271F918C8613FEB92A7591D0A6E7D04266F62144B2EAB7844D00C75
                                                                                                                                                                                                    SHA-512:DB5415BC542F4910166163F9BA34BC33AF1D114A73D852B143B2C3E28F59270827006693D6DF460523E26516CAB351D2EE3F944D715AE86CD12D926D09F92454
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK........)..H................META-INF/MANIFEST.MF....X.........ad2....@..%E..M.^.x.. O_dW.5Qi..8.....).aY=.!.Q....g..AM..&0....d.*./#..yM+......g.[.O..$....I?>X9..G......h.]...".y....do.O..2.Y.\^...}+....p2..u.]...V0}....&..a.C...-.....n.....M...M.F..,.....v@...>>|..["J...U7")..#b.oV.a...l.g..e.s..L.D..={.-gLEt.....!/... q....z.J...0.2e...=.....[]{..N...1....Z.....2...I.k...Sy..Qm...{....;.On..!.@..S.IZ..=......Lo.N4..|.j...!.l..G..}.Q....u....ADh.z.w.-..@%.@...!.".R.nHE.P]..J!..E.9Sw.LM7.&...[v..~.P...bp;.....:id.e..o.h..8.C....l...70..].gp..7.<.P.....Zj.....M......-.(@~...M^.....asJ.Y.1.e...(qW..h.c.Iu...-.A..?.5.Ex.S.oc6.).Qkr..+....|..._..H..!7..hs.r.;.z=.....*#.c....6...O+q.I.....|.4.V....Y.T.....4XO..4.>..1.$h..lu..l0..?...w.......o.u....6..)BG'..f......d.v...........<.i..Bj..d..L.....G.r@1.....0..d......'...........*.rK....5x..8.V..9(..Y.`'.k.N....3b.rx.p..c...M_j%..U.z.|Y.1\....d...-I.<g........-.h.*.F...me.F..p.c.o..

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\ext\sunpkcs11.jar (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v2.0 to extract, compression method=deflate
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):251327
                                                                                                                                                                                                    Entropy (8bit):7.951485363771875
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:6144:GJ+LIFVys2YON2lJmF5BwP5PYYGhscw1g0yHSno9O:GJMUVLbON8JK5BwP5PYYQlw1g0v2O
                                                                                                                                                                                                    MD5:9F5ABE7CCB653F571167E27822DF93D2
                                                                                                                                                                                                    SHA1:97F0F18B2D0A5ED5A01A682027EFA9FB8BAE1A5C
                                                                                                                                                                                                    SHA-256:2AAD2465AB8903C7F66A46B34D0D4ECBEEA72D44AFEDAAC9822E48B5B175595D
                                                                                                                                                                                                    SHA-512:629F56D9EB6A4634A54A2DC207D02F6BF94849DEAA4D0A093C7709AC4AB651881CDEED547D466F2679968F4B7896CD553F61A6FC6583EDE90A2053F09864669A
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK.........vI................META-INF/MANIFEST.MF.zG.f...U.....l@".U.,.. ..". 2...G3.0._=h...#!....:.A...0..&..7..>..A?.$..*.'........J..I....9.c~O>q...M...=.........'.M.<.?.....'...*..4}.._..//...b..OQs.m........U0.M..D..=..O.2&....z.......,.E....?1}..I.+.~97.<7..........._.8..W.....8$......e4.0..]....}r..1.$.QH......-..ax..D.z@._.<{...F..c.........}i....o..Wf.2rl.z..>>...6.AF.L.)...*..A..Q...j@kYDja.i.L....$,..6^.$.#......<...|~...WR.-....=r8.R.L.|...t..g.#.x._y.^B.R9....KY/..#WU..X&j.nA@Z.....F|.xh.>...jY.....U...9.+..18.b...\.(!Uk..`..D...> .`.W.-..:.mrb\.;.............D.t.D..b.6......z.....qq............l/0.OB...m....oa.cN.Y..WR..K7...X.9.@I...@...!.@.....(W.}M...%./..X...q^g...'..6;.,a..q..M0.|p".....qn..%^...vS&.+1.pX3^}.J./...8+..g..d.q%..7..."..<.......H.H..>...zf. ..c..G.k.WR.I..#-;!.`...!.Y<..H)..L...J.....{.;..D:..^4...I..v+........=......~....Qp....|h.v...N..{.z.o..(<.c.^.u....gZ.v~%s.Y.p.z.&..6R....J-J.Up..f....d..

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\ext\zipfs.jar (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Java archive data (JAR)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):68924
                                                                                                                                                                                                    Entropy (8bit):7.9507410585665905
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:1536:9SeEypJHbd836l1MIeEfqjGWb26U2jARnbismp/J:YeEyp9dFl1leEPuan2smD
                                                                                                                                                                                                    MD5:62F5C758160EE10591097F6CC79BF86D
                                                                                                                                                                                                    SHA1:0577B523114BD97A21B5A348C9963F5446D9D423
                                                                                                                                                                                                    SHA-256:415EEB1C5BCFB1E68B49B95DEFF8A9D48A646B0C6A527A3A80091A329E2777C1
                                                                                                                                                                                                    SHA-512:EB50AB9B3C883066095CF6482E9EB114267A4CFEDAC62D6AC0D501727901AFBB345D68067EE25420593694D80D516CD845950BCE60802AD0511B26F0A9EBE0F3
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK........4..I................META-INF/......PK..............PK........4..I................META-INF/MANIFEST.MF.....@.E....)..$6.t.,"..........f..ob.+..so.V..Ct&.....E,Ea:M.l.0.Ci.....kM.;..?..zRAS.;...W..!..^..#.C..]-.K.L.8vT.V...s&..D..(H.A..lJ...7+..ul`]...M...JQ..Q........PK...x.K....L...PK........%..I............-...com/sun/nio/zipfs/JarFileSystemProvider.class.U]S.U.~NH.a.@..B.\.!.$.U[.X..J..H..G...$,Mv.....z....9...........Z.d..a.1.y...<..s.y...~....x&c......q..B.`B.......'b.4...'e.1%......i!f../aV.L......B,.XD..KX.......V..^..@....`SD..`[.C._0.'..p.2.EF...SV.3t-.&OW.Yn....i....vx..=..]}O.J.Y.2.m..q.Tmc.Z.....H.arW[[I.7.L...F.k.E&...../.z.J...,U. QD...%....v...".+s.-f.....e..3....."..bvu[..b..Ag.<I7U*.^J..j....~.W\.2....i.j..1C7..:..U.QM.UG.d.c`4.8.Pf..MA.E.;0...1.r..bX..$l>h..%..,h.*..."^=m.90]}.T.}'.&...B;m.-.9.\T....x.p.laD.....#..U.r..P..o...(.a.....`.E.....*1..4-......fT......H.*kN..1....r.Z"7.J+d....B5.'U...e.).!...rt...^.p3..k.8.j.:..k5T...."

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\flavormap.properties (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):3928
                                                                                                                                                                                                    Entropy (8bit):4.86616891434286
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:96:pTgwOsORUjdjTD6QfxWkVIyiVyV2mjuVwwY:Jgw5TjdjTtpWk6ylV2zwwY
                                                                                                                                                                                                    MD5:D8B47B11E300EF3E8BE3E6E50AC6910B
                                                                                                                                                                                                    SHA1:2D5ED3B53072B184D67B1A4E26AEC2DF908DDC55
                                                                                                                                                                                                    SHA-256:C2748E07B59398CC40CACCCD47FC98A70C562F84067E9272383B45A8DF72A692
                                                                                                                                                                                                    SHA-512:8C5F3E1619E8A92B9D9CF5932392B1CB9F77625316B9EEF447E4DCE54836D90951D9EE70FFD765482414DD51B816649F846E40FD07B4FBDD5080C056ADBBAE6F
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:#.# This properties file is used to initialize the default.# java.awt.datatransfer.SystemFlavorMap. It contains the Win32 platform-.# specific, default mappings between common Win32 Clipboard atoms and platform-.# independent MIME type strings, which will be converted into.# java.awt.datatransfer.DataFlavors..#.# These default mappings may be augmented by specifying the.#.# AWT.DnD.flavorMapFileURL .#.# property in the appropriate awt.properties file. The specified properties URL.# will be loaded into the SystemFlavorMap..#.# The standard format is:.#.# <native>=<MIME type>.#.# <native> should be a string identifier that the native platform will.# recognize as a valid data format. <MIME type> should specify both a MIME.# primary type and a MIME subtype separated by a '/'. The MIME type may include.# parameters, where each parameter is a key/value pair separated by '=', and.# where each parameter to the MIME type is separated by a ';'..#.# Because SystemFlavorMap implements Flavor

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\fontconfig.bfc (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:raw G3 (Group 3) FAX
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):3770
                                                                                                                                                                                                    Entropy (8bit):4.414778819875262
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:96:i7WgWWWW81dp83p3D7WOk4BxciETBT5BLrws+LW/Be6Ji:iBWWWW8/e53vNxci8juWC
                                                                                                                                                                                                    MD5:827F00E05F3C5272AEF3BF456CF52BF5
                                                                                                                                                                                                    SHA1:280EF454A4644D1E17C7AFAC3B94249ED6BBDCBE
                                                                                                                                                                                                    SHA-256:0F2265F0113A757C15D51FA53409D630478378FD0856EF547780B40AC6C87156
                                                                                                                                                                                                    SHA-512:F6F4F9B7EEEA090081CC0FFE9D2DB705F832CF0AF9882B00AC97ECAE89F8C77A8D62EB6F224D78B7195172EDCFF74CD21A2459A7ED9CD6DDB29B3CC32398C4BC
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:...&.........:.^.p.........#.]...........6.>.:.-.9.<.=.3./.0.;.4...2.8.1.5.7................................................................................................................................................................................. .!............. .!.................................................................................E.D.J.G.B.H.F.C.@.A.?.I...........................................................................................!.".#.$.%.&.'.(.).*.+.+.+.+.+.K.O.W.`.h.g.Z.Y.f.X.T.^.a.b.c.[.Q.\.R.U.L.S.P.].e.N.V._.d.M.i.l.....t.s.n.}.|.......r.q.~.u.m.y...v.z.x.{.........j.w.k.o.........p.......................................................................................................................................................".......#........... .................#.(.-.2.7.<.A.F.K.P.U.[.a.g.m.s.y.........................................................!.).6.<.I.V.e.l.~.............................&.2.>.H.S.\.h.q.}.............................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\fontconfig.properties.src (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):10568
                                                                                                                                                                                                    Entropy (8bit):5.183430724132545
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:192:y+e6a1nsNi8bTeOiO/Ywca9nB2RwhCdvBMGuo6wj:ylnHIR9B2Rwhivj
                                                                                                                                                                                                    MD5:A15D4F6635BFB05282B88458D33C1309
                                                                                                                                                                                                    SHA1:A3D930002D0C8BF2FD263CB21EC089D233FFF106
                                                                                                                                                                                                    SHA-256:115B2049DE908E5D9BAD5BDE2ED035E85A7ADE35BF323BFD3D491A8C218146F1
                                                                                                                                                                                                    SHA-512:9B089BD2723F11BDEFA2CE1BE5804C595811BECD8F1ED922E0CFB43DC4C8CEE637E5AE2594A8F3B2B50B750174C9EDB7E30BF7451D6EFA5ECA8741EE86D8205C
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:#.# .# Copyright (c) 2003, 2011, Oracle and/or its affiliates. All rights reserved..# ORACLE PROPRIETARY/CONFIDENTIAL. Use is subject to license terms..#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#..# Version..version=1..# Component Font Mappings..allfonts.chinese-ms936=SimSun.allfonts.chinese-ms936-extb=SimSun-ExtB.allfonts.chinese-gb18030=SimSun-18030.allfonts.chinese-gb18030-extb=SimSun-ExtB.allfonts.chinese-hkscs=MingLiU_HKSCS.allfonts.chinese-ms950-extb=MingLiU-ExtB.allfonts.devanagari=Mangal.allfonts.dingbats=Wingdings.allfonts.lucida=Lucida Sans Regular.allfonts.symbol=Symbol.allfonts.symbols=Segoe UI Symbol.allfonts.thai=Lucida Sans Regular.allfonts.georgian=Sylfaen..serif.plain.alphabetic=Times New Roman.serif.plain.chinese-ms950=MingLiU.serif.plain.chinese-ms950-extb=MingLiU-ExtB.serif.plain.hebrew=David.serif.plain.japanese=MS Mincho.serif.plain.korean=Batang..serif.bold.alphabetic=Times New Roman Bold.serif.bold.chinese-ms950=PMingLiU.serif.bold.chinese-ms950-extb=PMingLiU-ExtB

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\fonts\LucidaBrightDemiBold.ttf (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:TrueType Font data, 15 tables, 1st "LTSH", 16 names, Macintosh, Copyright (c) 2000 Bigelow & Holmes Inc. Pat. Des 289,422.Lucida BrightDemiboldLucida Bright Dem
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):75144
                                                                                                                                                                                                    Entropy (8bit):6.849420541001734
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:768:H8Jwt1GIlZ6l0/9tRWhc0x/YxvsTjyIDXCrGU/tlDaKAgKrTLznvzDJIZmjFA0zG:Mwtze9xQcQ/LDaKAgK3LLvzFogbFt5WD
                                                                                                                                                                                                    MD5:AF0C5C24EF340AEA5CCAC002177E5C09
                                                                                                                                                                                                    SHA1:B5C97F985639E19A3B712193EE48B55DDA581FD1
                                                                                                                                                                                                    SHA-256:72CEE3E6DF72AD577AF49C59DCA2D0541060F95A881845950595E5614C486244
                                                                                                                                                                                                    SHA-512:6CE87441E223543394B7242AC0CB63505888B503EC071BBF7DB857B5C935B855719B818090305E17C1197DE882CCC90612FB1E0A0E5D2731F264C663EB8DA3F9
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:...........pLTSH$....#.....OS/2p.{........Vcmap.U.z...T...jcvt 8.E.........fpgm..1.........glyf@>.7...l....hdmx..(:...t..1.head.?....T...6hhea.U........$hmtx..ys...... loca..\4........maxp.8......... name..#.........postM.IA.......prepbM.h.......W.............).......).....d. ............................B&H.. . .3.D.\...... ................................................................................................ !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`a.bcdefghijklmnopqrstuvwxyz{|}~......................................................................................................P...T.@.....~.............&.. . . . . " & 0 : D t .!"!&"."."."."."."+"H"`"e%................3..... .............&.. . . . . & 0 9 D t .!"!&"."."."."."."+"H"`"d%................3.........W.......M...d...............1.....j.y........t.q._./.0.......v.t.r.p.g.T.....R..........................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\fonts\LucidaBrightDemiItalic.ttf (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:TrueType Font data, 15 tables, 1st "LTSH", 16 names, Macintosh, Copyright (c) 2000 Bigelow & Holmes Inc.Lucida BrightDemibold ItalicLucida Bright Demibold Itali
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):75124
                                                                                                                                                                                                    Entropy (8bit):6.805969666701276
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:1536:lww80sTGzcKHwxWL0T+qHi/sbA06PoNORsr5sOnD0OyuusGa7bs4J:lwL0i97WL0T+qHA9cOR05FD0Oyup74w
                                                                                                                                                                                                    MD5:793AE1AB32085C8DE36541BB6B30DA7C
                                                                                                                                                                                                    SHA1:1FD1F757FEBF3E5F5FBB7FBF7A56587A40D57DE7
                                                                                                                                                                                                    SHA-256:895C5262CDB6297C13725515F849ED70609DBD7C49974A382E8BBFE4A3D75F8C
                                                                                                                                                                                                    SHA-512:A92ADDD0163F6D81C3AEABD63FF5C293E71A323F4AEDFB404F6F1CDE7F84C2A995A30DFEC84A9CAF8FFAF8E274EDD0D7822E6AABB2B0608696A360CABFC866C6
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:...........pLTSH.....#.....OS/2k.{........Vcmap.U.z...T...jcvt =jC.........fpgm..1.........glyf.......h...Jhdmx.......`..1.head..X.......6hhea...;.......$hmtx.b......... loca..\....0....maxp...:...D... name .7]...d....postM..A........prep.C.f....................).......).....d. ............................B&H..!. .3.D.\...... ................................................................................................ !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`a.bcdefghijklmnopqrstuvwxyz{|}~......................................................................................................P...T.@.....~.............&.. . . . . " & 0 : D t .!"!&"."."."."."."+"H"`"e%................3..... .............&.. . . . . & 0 9 D t .!"!&"."."."."."."+"H"`"d%................3.........W.......M...d...............1.....j.y........t.q._./.0.......v.t.r.p.g.T.....R..........................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\fonts\LucidaBrightItalic.ttf (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:TrueType Font data, 15 tables, 1st "LTSH", 16 names, Macintosh, Copyright (c) 2000 Bigelow & Holmes Inc. Pat. Des 289,773.Lucida BrightItalicLucida Bright Itali
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):80856
                                                                                                                                                                                                    Entropy (8bit):6.821405620058844
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:1536:jw9ESkPFybxWj1V7zbPUoOPjp85rFqXpLboVklDNTc2Wt:jwZO0xWPTU7l85rFYpLbott
                                                                                                                                                                                                    MD5:4D666869C97CDB9E1381A393FFE50A3A
                                                                                                                                                                                                    SHA1:AA5C037865C563726ECD63D61CA26443589BE425
                                                                                                                                                                                                    SHA-256:D68819A70B60FF68CA945EF5AD358C31829E43EC25024A99D17174C626575E06
                                                                                                                                                                                                    SHA-512:1D1F61E371E4A667C90C2CE315024AE6168E47FE8A5C02244DBF3DF26E8AC79F2355AC7E36D4A81D82C52149197892DAED1B4C19241575256BB4541F8B126AE2
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:...........pLTSH...2..:L....OS/2p.|y.......Vcmap.U.z...T...jcvt F.;.........fpgm..1.........glyf.}.....@....hdmx?..p......1.head.A![.......6hhea.......P...$hmtx3..9...t... loca6..........maxp.......... name...p.......~postM..A...H....prep.......................).......).6...d. ............................B&H.... .3.D.\...... ................................................................................................ !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`a.bcdefghijklmnopqrstuvwxyz{|}~......................................................................................................P...T.@.....~.............&.. . . . . " & 0 : D t .!"!&"."."."."."."+"H"`"e%................3..... .............&.. . . . . & 0 9 D t .!"!&"."."."."."."+"H"`"d%................3.........W.......M...d...............1.....j.y........t.q._./.0.......v.t.r.p.g.T.....R..........................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\fonts\LucidaBrightRegular.ttf (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:TrueType Font data, 15 tables, 1st "LTSH", 16 names, Macintosh, Copyright (c) 2000 Bigelow & Holmes Inc. Pat. Des 289,421.Lucida BrightRegularLucida Bright Regu
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):344908
                                                                                                                                                                                                    Entropy (8bit):6.939775499317555
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:6144:oBfQeUG2CCTufrmOufymM8hvFHp277tS9iZFYSATxNm:oNQ3vCCTcaFNJw7tSgYS82
                                                                                                                                                                                                    MD5:630A6FA16C414F3DE6110E46717AAD53
                                                                                                                                                                                                    SHA1:5D7ED564791C900A8786936930BA99385653139C
                                                                                                                                                                                                    SHA-256:0FAAACA3C730857D3E50FBA1BBAD4CA2330ADD217B35E22B7E67F02809FAC923
                                                                                                                                                                                                    SHA-512:0B7CDE0FACE982B5867AEBFB92918404ADAC7FB351A9D47DCD9FE86C441CACA4DD4EC22E36B61025092220C0A8730D292DA31E9CAFD7808C56CDBF34ECD05035
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:...........pLTSHN..U..=....~OS/2...S.......Vcmap..tO...T....cvt =|t>.......tfpgm..1....`....glyf.J.........Jhdmx]......D....head.WD...h...6hhea.j.........$hmtxW.6|........loca............maxp......4.... nameJO....4....rpost..g...8,..M.prep.].O.......T.............).......).....d. .............."....`........B&H..@. ...D.]...... ................................................................................................ !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`a.bcdefghijklmnopqrstuvwxyz{|}~......................................................................................................|...........~.............&.u.z.~.......................O.\.....................:.R.m.......... . . . . " & 0 : D t .!"!&!.".%....................3.b.r.t....... .............&.t.z.~.........................Q.^...................!.@.`.p........ . . . . & 0 9 D t .!"!&!.".%....................3.^.p.t.v.........W.......M......................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\fonts\LucidaSansDemiBold.ttf (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:TrueType Font data, 15 tables, 1st "LTSH", 19 names, Macintosh, Copyright (c) 1999, 2001 by Bigelow & Holmes Inc. Pat. Des. 289,420.Lucida SansDemiboldLucida Sa
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):317896
                                                                                                                                                                                                    Entropy (8bit):6.869598480468745
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:6144:R5OO1ZjNDE7/MsTJ30otegK4zJwz3UhG5jXsrg2HLzYv7cf0R7o7+WX/ov2DG:bOO11CEo9xzJwljXsrhHQ7cMuX/16
                                                                                                                                                                                                    MD5:5DD099908B722236AA0C0047C56E5AF2
                                                                                                                                                                                                    SHA1:92B79FEFC35E96190250C602A8FED85276B32A95
                                                                                                                                                                                                    SHA-256:53773357D739F89BC10087AB2A829BA057649784A9ACBFFEE18A488B2DCCB9EE
                                                                                                                                                                                                    SHA-512:440534EB2076004BEA66CF9AC2CE2B37C10FBF5CC5E0DD8B8A8EDEA25E3613CE8A59FFCB2500F60528BBF871FF37F1D0A3C60396BC740CCDB4324177C38BE97A
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:...........pLTSH_R.a........OS/2...........Vcmapz.$L.......Zcvt ...y...8...hfpgm..1.........glyf......\....hdmx..0A.......hhead..&..:H...6hhea......:....$hmtx.,Z:..:.....loca.~'...T.....maxp......n.... name..=%..n....Kpost$.#...s$..[?prep......d...a..........................................)........2'............'........ ....................".".............0.%...............%...........)....................... ......0 ..............................) ) ) ) ...........................................2.2.2.2.).......................................................'"'"'"1....0.........................................................................................................'.....'...........)..,...&,....#............./&.....&.&.$.....$...$........'....... ....)...."...,.......+.....'....).,.....-)..)................... ..."..................,.........(.........,........................../..2.......+.........,.#) .....................+..).........0......+...............,.,.,......

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\fonts\LucidaSansRegular.ttf (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:TrueType Font data, 18 tables, 1st "GDEF", 19 names, Macintosh, Copyright (c) 1999 by Bigelow & Holmes Inc. Pat. Des. 289,420.Lucida SansRegularLucida Sans Regu
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):698236
                                                                                                                                                                                                    Entropy (8bit):6.892888039120645
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:12288:6obn11t7t7DxT+3+OQ64cctiOAq12ZX/DmfT6R83Sd8uvx7wSnyER4ky+SH/KPKQ:6oTJZzHniOAZ783Sd8uvx7wSnyER4kyI
                                                                                                                                                                                                    MD5:B75309B925371B38997DF1B25C1EA508
                                                                                                                                                                                                    SHA1:39CC8BCB8D4A71D4657FC92EF0B9F4E3E9E67ADD
                                                                                                                                                                                                    SHA-256:F8D877B0B64600E736DFE436753E8E11ACB022E59B5D7723D7D221D81DC2FCDE
                                                                                                                                                                                                    SHA-512:9C792EF3116833C90103F27CFD26A175AB1EB11286959F77062893A2E15DE44D79B27E5C47694CBBA734CC05A9A5BEFA72E991C7D60EAB1495AAC14C5CAD901D
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:........... GDEF..|.......GPOS.......L...HGSUB.f.........LTSH...........uOS/2.#GQ...,...Vcmap..4........4cvt .y..........fpgm.!&.........glyf. ..........hdmx...M...(...\head..........6hhea...........$hmtx.S........-.loca'.c......-.maxp...Y....... nameW..r........post.&-.........prep.........................).......).....d. ...................{........B&H..@. ...D.]......`................................................................................................ !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`a.bcdefghijklmnopqrstuvwxyz{|}~..........................................................................................................".....".~...............E.u.z.~.......................O.\...............................:.R.m.............9.M.T.p.:.[.... . F p . . .!8!.!.".#.#.#!$i%.%.%.%.%.%.%.%$%,%4%<%l%.%.%.%.%.%.%.%.%.%.%.%.%.%.%.%.&.&.&.&.&<&@&B&`&c&f&k'.'.'''K'M'R'V'^'g'.'.'................ .3.....6.<.>.A.D.N.b.r.t......... .........P.......t.z.~

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\fonts\LucidaTypewriterBold.ttf (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:TrueType Font data, 13 tables, 1st "OS/2", 16 names, Macintosh, Copyright (c) 1999, 2001 by Bigelow & Holmes Inc.Lucida Sans TypewriterBoldLucida Sans Typewrite
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):234068
                                                                                                                                                                                                    Entropy (8bit):6.901545053424004
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:6144:3BPS7w5KIMtYwqcO3GbA4MJcs2ME9UGQ2n9gM/oD:xVMtgcGGPMJcs4b9gM/4
                                                                                                                                                                                                    MD5:A0C96AA334F1AEAA799773DB3E6CBA9C
                                                                                                                                                                                                    SHA1:A5DA2EB49448F461470387C939F0E69119310E0B
                                                                                                                                                                                                    SHA-256:FC908259013B90F1CBC597A510C6DD7855BF9E7830ABE3FC3612AB4092EDCDE2
                                                                                                                                                                                                    SHA-512:A43CF773A42B4CEBF4170A6C94060EA2602D2D7FA7F6500F69758A20DC5CC3ED1793C7CEB9B44CE8640721CA919D2EF7F9568C5AF58BA6E3CF88EAE19A95E796
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:...........POS/2..........VcmapW......4....cvt .M/.........fpgm..1.........glyf|......@....head.c....L...6hhea...........$hmtx.e.........tloca..h..."....xmaxp......7.... name......7.....post1..%..;h..I.prep.......4... .............3.......3...1.f................+...x.........B&H.. . ...D.]......`................................................................................................ !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`a....................................................................................................................................x...........~...............u.z.~.......................O.\...............................:.R.m...........:.[.... . . . " & 0 3 : < > D . . . . .!.!.!.!"!&!.!^!.!.".".".".".".".")"+"H"a"e#.#.#!%.%.%.%.%.%.%.%$%,%4%<%l%.%.%.%.%.%.%.%.%.%.%.%.%.%.%.&<&@&B&`&c&f&k...................3...b.r.t....... ...............t.z.~.........................Q.^.............................!.@.`.p...........?.... . . . &

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\fonts\LucidaTypewriterRegular.ttf (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:TrueType Font data, 13 tables, 1st "OS/2", 16 names, Macintosh, Copyright (c) 1999 by Bigelow & Holmes Inc.Lucida Sans TypewriterRegularLucida Sans Typewriter R
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):242700
                                                                                                                                                                                                    Entropy (8bit):6.936925430880877
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:VwzZsJcCrn271g+UGFDUnrrHqMyBtlc3+fzx5R1zeqZdDgfSkecUfEDpEXzSyPMx:GWcCrn2C46Ak+naqaucYEDpEX3gZoO9
                                                                                                                                                                                                    MD5:C1397E8D6E6ABCD727C71FCA2132E218
                                                                                                                                                                                                    SHA1:C144DCAFE4FAF2E79CFD74D8134A631F30234DB1
                                                                                                                                                                                                    SHA-256:D9D0AAB0354C3856DF81AFAC49BDC586E930A77428CB499007DDE99ED31152FF
                                                                                                                                                                                                    SHA-512:DA70826793C7023E61F272D37E2CC2983449F26926746605C550E9D614ACBF618F73D03D0C6351B9537703B05007CD822E42E6DC74423CB5CC736B31458D33B1
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:...........POS/2...s.......`cmap..Rh...<....cvt m......@...<fpgm..1....|....glyf..;}...8....head.,j..2L...6hhea......2....$hmtx.....2.....loca.PB...H(....maxp.z....].... namex.R...].....post...Q..ax..I.prep.UJ....\.................).......).....d. ..............{.............B&H..@. ...D.\...... ........=..... ......................................................................................... !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`a.bcdefghijklmnopqrstuvwxyz{|}~..................................................................................................................~...............u.z.~.......................O.\...............................:.R.m...........:.[.... . . . " & 0 3 : < > D . . . .!.!.!.!"!&!.!^!.!.".".".".".".".")"+"H"a"e#.#.#!%.%.%.%.%.%.%.%$%,%4%<%l%.%.%.%.%.%.%.%.%.%.%.%.%.%.%.&<&@&B&`&c&f&k.........................3...b.r.t....... ...............t.z.~.........................Q.^.............................!.@.`.p...........?..

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\fonts\is-2OMH7.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:TrueType Font data, 15 tables, 1st "LTSH", 16 names, Macintosh, Copyright (c) 2000 Bigelow & Holmes Inc.Lucida BrightDemibold ItalicLucida Bright Demibold Itali
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):75124
                                                                                                                                                                                                    Entropy (8bit):6.805969666701276
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:1536:lww80sTGzcKHwxWL0T+qHi/sbA06PoNORsr5sOnD0OyuusGa7bs4J:lwL0i97WL0T+qHA9cOR05FD0Oyup74w
                                                                                                                                                                                                    MD5:793AE1AB32085C8DE36541BB6B30DA7C
                                                                                                                                                                                                    SHA1:1FD1F757FEBF3E5F5FBB7FBF7A56587A40D57DE7
                                                                                                                                                                                                    SHA-256:895C5262CDB6297C13725515F849ED70609DBD7C49974A382E8BBFE4A3D75F8C
                                                                                                                                                                                                    SHA-512:A92ADDD0163F6D81C3AEABD63FF5C293E71A323F4AEDFB404F6F1CDE7F84C2A995A30DFEC84A9CAF8FFAF8E274EDD0D7822E6AABB2B0608696A360CABFC866C6
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:...........pLTSH.....#.....OS/2k.{........Vcmap.U.z...T...jcvt =jC.........fpgm..1.........glyf.......h...Jhdmx.......`..1.head..X.......6hhea...;.......$hmtx.b......... loca..\....0....maxp...:...D... name .7]...d....postM..A........prep.C.f....................).......).....d. ............................B&H..!. .3.D.\...... ................................................................................................ !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`a.bcdefghijklmnopqrstuvwxyz{|}~......................................................................................................P...T.@.....~.............&.. . . . . " & 0 : D t .!"!&"."."."."."."+"H"`"e%................3..... .............&.. . . . . & 0 9 D t .!"!&"."."."."."."+"H"`"d%................3.........W.......M...d...............1.....j.y........t.q._./.0.......v.t.r.p.g.T.....R..........................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\fonts\is-93U18.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:TrueType Font data, 15 tables, 1st "LTSH", 19 names, Macintosh, Copyright (c) 1999, 2001 by Bigelow & Holmes Inc. Pat. Des. 289,420.Lucida SansDemiboldLucida Sa
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):317896
                                                                                                                                                                                                    Entropy (8bit):6.869598480468745
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:6144:R5OO1ZjNDE7/MsTJ30otegK4zJwz3UhG5jXsrg2HLzYv7cf0R7o7+WX/ov2DG:bOO11CEo9xzJwljXsrhHQ7cMuX/16
                                                                                                                                                                                                    MD5:5DD099908B722236AA0C0047C56E5AF2
                                                                                                                                                                                                    SHA1:92B79FEFC35E96190250C602A8FED85276B32A95
                                                                                                                                                                                                    SHA-256:53773357D739F89BC10087AB2A829BA057649784A9ACBFFEE18A488B2DCCB9EE
                                                                                                                                                                                                    SHA-512:440534EB2076004BEA66CF9AC2CE2B37C10FBF5CC5E0DD8B8A8EDEA25E3613CE8A59FFCB2500F60528BBF871FF37F1D0A3C60396BC740CCDB4324177C38BE97A
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:...........pLTSH_R.a........OS/2...........Vcmapz.$L.......Zcvt ...y...8...hfpgm..1.........glyf......\....hdmx..0A.......hhead..&..:H...6hhea......:....$hmtx.,Z:..:.....loca.~'...T.....maxp......n.... name..=%..n....Kpost$.#...s$..[?prep......d...a..........................................)........2'............'........ ....................".".............0.%...............%...........)....................... ......0 ..............................) ) ) ) ...........................................2.2.2.2.).......................................................'"'"'"1....0.........................................................................................................'.....'...........)..,...&,....#............./&.....&.&.$.....$...$........'....... ....)...."...,.......+.....'....).,.....-)..)................... ..."..................,.........(.........,........................../..2.......+.........,.#) .....................+..).........0......+...............,.,.,......

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\fonts\is-9PS8G.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:TrueType Font data, 18 tables, 1st "GDEF", 19 names, Macintosh, Copyright (c) 1999 by Bigelow & Holmes Inc. Pat. Des. 289,420.Lucida SansRegularLucida Sans Regu
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):698236
                                                                                                                                                                                                    Entropy (8bit):6.892888039120645
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:12288:6obn11t7t7DxT+3+OQ64cctiOAq12ZX/DmfT6R83Sd8uvx7wSnyER4ky+SH/KPKQ:6oTJZzHniOAZ783Sd8uvx7wSnyER4kyI
                                                                                                                                                                                                    MD5:B75309B925371B38997DF1B25C1EA508
                                                                                                                                                                                                    SHA1:39CC8BCB8D4A71D4657FC92EF0B9F4E3E9E67ADD
                                                                                                                                                                                                    SHA-256:F8D877B0B64600E736DFE436753E8E11ACB022E59B5D7723D7D221D81DC2FCDE
                                                                                                                                                                                                    SHA-512:9C792EF3116833C90103F27CFD26A175AB1EB11286959F77062893A2E15DE44D79B27E5C47694CBBA734CC05A9A5BEFA72E991C7D60EAB1495AAC14C5CAD901D
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:........... GDEF..|.......GPOS.......L...HGSUB.f.........LTSH...........uOS/2.#GQ...,...Vcmap..4........4cvt .y..........fpgm.!&.........glyf. ..........hdmx...M...(...\head..........6hhea...........$hmtx.S........-.loca'.c......-.maxp...Y....... nameW..r........post.&-.........prep.........................).......).....d. ...................{........B&H..@. ...D.]......`................................................................................................ !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`a.bcdefghijklmnopqrstuvwxyz{|}~..........................................................................................................".....".~...............E.u.z.~.......................O.\...............................:.R.m.............9.M.T.p.:.[.... . F p . . .!8!.!.".#.#.#!$i%.%.%.%.%.%.%.%$%,%4%<%l%.%.%.%.%.%.%.%.%.%.%.%.%.%.%.%.&.&.&.&.&<&@&B&`&c&f&k'.'.'''K'M'R'V'^'g'.'.'................ .3.....6.<.>.A.D.N.b.r.t......... .........P.......t.z.~

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\fonts\is-BANTS.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:TrueType Font data, 13 tables, 1st "OS/2", 16 names, Macintosh, Copyright (c) 1999, 2001 by Bigelow & Holmes Inc.Lucida Sans TypewriterBoldLucida Sans Typewrite
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):234068
                                                                                                                                                                                                    Entropy (8bit):6.901545053424004
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:6144:3BPS7w5KIMtYwqcO3GbA4MJcs2ME9UGQ2n9gM/oD:xVMtgcGGPMJcs4b9gM/4
                                                                                                                                                                                                    MD5:A0C96AA334F1AEAA799773DB3E6CBA9C
                                                                                                                                                                                                    SHA1:A5DA2EB49448F461470387C939F0E69119310E0B
                                                                                                                                                                                                    SHA-256:FC908259013B90F1CBC597A510C6DD7855BF9E7830ABE3FC3612AB4092EDCDE2
                                                                                                                                                                                                    SHA-512:A43CF773A42B4CEBF4170A6C94060EA2602D2D7FA7F6500F69758A20DC5CC3ED1793C7CEB9B44CE8640721CA919D2EF7F9568C5AF58BA6E3CF88EAE19A95E796
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:...........POS/2..........VcmapW......4....cvt .M/.........fpgm..1.........glyf|......@....head.c....L...6hhea...........$hmtx.e.........tloca..h..."....xmaxp......7.... name......7.....post1..%..;h..I.prep.......4... .............3.......3...1.f................+...x.........B&H.. . ...D.]......`................................................................................................ !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`a....................................................................................................................................x...........~...............u.z.~.......................O.\...............................:.R.m...........:.[.... . . . " & 0 3 : < > D . . . . .!.!.!.!"!&!.!^!.!.".".".".".".".")"+"H"a"e#.#.#!%.%.%.%.%.%.%.%$%,%4%<%l%.%.%.%.%.%.%.%.%.%.%.%.%.%.%.&<&@&B&`&c&f&k...................3...b.r.t....... ...............t.z.~.........................Q.^.............................!.@.`.p...........?.... . . . &

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\fonts\is-J80V2.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:TrueType Font data, 13 tables, 1st "OS/2", 16 names, Macintosh, Copyright (c) 1999 by Bigelow & Holmes Inc.Lucida Sans TypewriterRegularLucida Sans Typewriter R
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):242700
                                                                                                                                                                                                    Entropy (8bit):6.936925430880877
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:VwzZsJcCrn271g+UGFDUnrrHqMyBtlc3+fzx5R1zeqZdDgfSkecUfEDpEXzSyPMx:GWcCrn2C46Ak+naqaucYEDpEX3gZoO9
                                                                                                                                                                                                    MD5:C1397E8D6E6ABCD727C71FCA2132E218
                                                                                                                                                                                                    SHA1:C144DCAFE4FAF2E79CFD74D8134A631F30234DB1
                                                                                                                                                                                                    SHA-256:D9D0AAB0354C3856DF81AFAC49BDC586E930A77428CB499007DDE99ED31152FF
                                                                                                                                                                                                    SHA-512:DA70826793C7023E61F272D37E2CC2983449F26926746605C550E9D614ACBF618F73D03D0C6351B9537703B05007CD822E42E6DC74423CB5CC736B31458D33B1
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:...........POS/2...s.......`cmap..Rh...<....cvt m......@...<fpgm..1....|....glyf..;}...8....head.,j..2L...6hhea......2....$hmtx.....2.....loca.PB...H(....maxp.z....].... namex.R...].....post...Q..ax..I.prep.UJ....\.................).......).....d. ..............{.............B&H..@. ...D.\...... ........=..... ......................................................................................... !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`a.bcdefghijklmnopqrstuvwxyz{|}~..................................................................................................................~...............u.z.~.......................O.\...............................:.R.m...........:.[.... . . . " & 0 3 : < > D . . . .!.!.!.!"!&!.!^!.!.".".".".".".".")"+"H"a"e#.#.#!%.%.%.%.%.%.%.%$%,%4%<%l%.%.%.%.%.%.%.%.%.%.%.%.%.%.%.&<&@&B&`&c&f&k.........................3...b.r.t....... ...............t.z.~.........................Q.^.............................!.@.`.p...........?..

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\fonts\is-K7D6Q.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:TrueType Font data, 15 tables, 1st "LTSH", 16 names, Macintosh, Copyright (c) 2000 Bigelow & Holmes Inc. Pat. Des 289,422.Lucida BrightDemiboldLucida Bright Dem
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):75144
                                                                                                                                                                                                    Entropy (8bit):6.849420541001734
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:768:H8Jwt1GIlZ6l0/9tRWhc0x/YxvsTjyIDXCrGU/tlDaKAgKrTLznvzDJIZmjFA0zG:Mwtze9xQcQ/LDaKAgK3LLvzFogbFt5WD
                                                                                                                                                                                                    MD5:AF0C5C24EF340AEA5CCAC002177E5C09
                                                                                                                                                                                                    SHA1:B5C97F985639E19A3B712193EE48B55DDA581FD1
                                                                                                                                                                                                    SHA-256:72CEE3E6DF72AD577AF49C59DCA2D0541060F95A881845950595E5614C486244
                                                                                                                                                                                                    SHA-512:6CE87441E223543394B7242AC0CB63505888B503EC071BBF7DB857B5C935B855719B818090305E17C1197DE882CCC90612FB1E0A0E5D2731F264C663EB8DA3F9
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:...........pLTSH$....#.....OS/2p.{........Vcmap.U.z...T...jcvt 8.E.........fpgm..1.........glyf@>.7...l....hdmx..(:...t..1.head.?....T...6hhea.U........$hmtx..ys...... loca..\4........maxp.8......... name..#.........postM.IA.......prepbM.h.......W.............).......).....d. ............................B&H.. . .3.D.\...... ................................................................................................ !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`a.bcdefghijklmnopqrstuvwxyz{|}~......................................................................................................P...T.@.....~.............&.. . . . . " & 0 : D t .!"!&"."."."."."."+"H"`"e%................3..... .............&.. . . . . & 0 9 D t .!"!&"."."."."."."+"H"`"d%................3.........W.......M...d...............1.....j.y........t.q._./.0.......v.t.r.p.g.T.....R..........................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\fonts\is-LE232.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:TrueType Font data, 15 tables, 1st "LTSH", 16 names, Macintosh, Copyright (c) 2000 Bigelow & Holmes Inc. Pat. Des 289,421.Lucida BrightRegularLucida Bright Regu
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):344908
                                                                                                                                                                                                    Entropy (8bit):6.939775499317555
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:6144:oBfQeUG2CCTufrmOufymM8hvFHp277tS9iZFYSATxNm:oNQ3vCCTcaFNJw7tSgYS82
                                                                                                                                                                                                    MD5:630A6FA16C414F3DE6110E46717AAD53
                                                                                                                                                                                                    SHA1:5D7ED564791C900A8786936930BA99385653139C
                                                                                                                                                                                                    SHA-256:0FAAACA3C730857D3E50FBA1BBAD4CA2330ADD217B35E22B7E67F02809FAC923
                                                                                                                                                                                                    SHA-512:0B7CDE0FACE982B5867AEBFB92918404ADAC7FB351A9D47DCD9FE86C441CACA4DD4EC22E36B61025092220C0A8730D292DA31E9CAFD7808C56CDBF34ECD05035
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:...........pLTSHN..U..=....~OS/2...S.......Vcmap..tO...T....cvt =|t>.......tfpgm..1....`....glyf.J.........Jhdmx]......D....head.WD...h...6hhea.j.........$hmtxW.6|........loca............maxp......4.... nameJO....4....rpost..g...8,..M.prep.].O.......T.............).......).....d. .............."....`........B&H..@. ...D.]...... ................................................................................................ !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`a.bcdefghijklmnopqrstuvwxyz{|}~......................................................................................................|...........~.............&.u.z.~.......................O.\.....................:.R.m.......... . . . . " & 0 : D t .!"!&!.".%....................3.b.r.t....... .............&.t.z.~.........................Q.^...................!.@.`.p........ . . . . & 0 9 D t .!"!&!.".%....................3.^.p.t.v.........W.......M......................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\fonts\is-QL3AF.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:TrueType Font data, 15 tables, 1st "LTSH", 16 names, Macintosh, Copyright (c) 2000 Bigelow & Holmes Inc. Pat. Des 289,773.Lucida BrightItalicLucida Bright Itali
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):80856
                                                                                                                                                                                                    Entropy (8bit):6.821405620058844
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:1536:jw9ESkPFybxWj1V7zbPUoOPjp85rFqXpLboVklDNTc2Wt:jwZO0xWPTU7l85rFYpLbott
                                                                                                                                                                                                    MD5:4D666869C97CDB9E1381A393FFE50A3A
                                                                                                                                                                                                    SHA1:AA5C037865C563726ECD63D61CA26443589BE425
                                                                                                                                                                                                    SHA-256:D68819A70B60FF68CA945EF5AD358C31829E43EC25024A99D17174C626575E06
                                                                                                                                                                                                    SHA-512:1D1F61E371E4A667C90C2CE315024AE6168E47FE8A5C02244DBF3DF26E8AC79F2355AC7E36D4A81D82C52149197892DAED1B4C19241575256BB4541F8B126AE2
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:...........pLTSH...2..:L....OS/2p.|y.......Vcmap.U.z...T...jcvt F.;.........fpgm..1.........glyf.}.....@....hdmx?..p......1.head.A![.......6hhea.......P...$hmtx3..9...t... loca6..........maxp.......... name...p.......~postM..A...H....prep.......................).......).6...d. ............................B&H.... .3.D.\...... ................................................................................................ !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`a.bcdefghijklmnopqrstuvwxyz{|}~......................................................................................................P...T.@.....~.............&.. . . . . " & 0 : D t .!"!&"."."."."."."+"H"`"e%................3..... .............&.. . . . . & 0 9 D t .!"!&"."."."."."."+"H"`"d%................3.........W.......M...d...............1.....j.y........t.q._./.0.......v.t.r.p.g.T.....R..........................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\hijrah-config-umalqura.properties (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):13962
                                                                                                                                                                                                    Entropy (8bit):3.4283479014478493
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:96:RgZass+YXdGOS8NhN9Yd9Yq67IwOYUuUS9O0:RyJO/BFi9YqAInYUuUmO0
                                                                                                                                                                                                    MD5:1EDDFB1EE252055556F40CDC79632E98
                                                                                                                                                                                                    SHA1:84AA425100740722E91F4725CAF849E7863D12BA
                                                                                                                                                                                                    SHA-256:69BECFE0D45B62BBDBCF6FE111A8A3A041FB749B6CF38E8A2F670607E17C9EE2
                                                                                                                                                                                                    SHA-512:A0FDBF42FF105C9A2F12179124606A720DF8F32365605644E15600767E5732312777A58390FDB1A9B1C0B152CCC29496133B278A6E5736B38AF2B5FAB251D40C
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:# Copyright (c) 2013, Oracle and/or its affiliates. All rights reserved..# ORACLE PROPRIETARY/CONFIDENTIAL. Use is subject to license terms..#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.# This properties file defines a Hijrah calendar variant..#.# Fields:.#.# <version> ::= 'version' '=' <version string>.# <id> ::= 'id' '=' <id string>.# <type> ::= 'type' '=' <type string>.# <iso-start> ::= 'iso-start' '=' <start date in the ISO calendar>.# <year> ::= <yyyy> '=' <nn nn nn nn nn nn nn nn nn nn nn nn>.#.# version ... (Required).#.# id ... (Required).# Identifies the Java Chronology.#.# type ... (Required).# Identifies the type of calendar in the standard calendar ID scheme.# iso-start ... (Required).# Specifies the corresponding ISO date to the first Hijrah day.# in the defined range of dates.#.# year ... (Required).# Number of days for each month of a Hijrah year.# * Each line defines a year. The years must be in chronological.#

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\i386\is-L5FK9.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):623
                                                                                                                                                                                                    Entropy (8bit):4.956046853743128
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:12:QcwmIzDhHlB725iwoXH3ExOvadDfI3xizh49g1n8OEDfI7yO7:QhDBfOoXHjifIBMB1XqfI77
                                                                                                                                                                                                    MD5:9AEF14A90600CD453C4E472BA83C441F
                                                                                                                                                                                                    SHA1:10C53C9FE9970D41A84CB45C883EA6C386482199
                                                                                                                                                                                                    SHA-256:9E86B24FF2B19D814BBAEDD92DF9F0E1AE86BF11A86A92989C9F91F959B736E1
                                                                                                                                                                                                    SHA-512:481562547BF9E37D270D9A2881AC9C86FC8F928B5C176E9BAF6B8F7B72FB9827C84EF0C84B60894656A6E82DD141779B8D283C6E7A0E85D2829EA071C6DB7D14
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:# Copyright (c) 2001, 2013, Oracle and/or its affiliates. All rights reserved..# ORACLE PROPRIETARY/CONFIDENTIAL. Use is subject to license terms..#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.# List of JVMs that can be used as an option to java, javac, etc..# Order is important -- first in this list is the default JVM..# NOTE that this both this file and its format are UNSUPPORTED and.# WILL GO AWAY in a future release..#.# You may also select a JVM in an arbitrary location with the.# "-XXaltjvm=<jvm_dir>" option, but that too is unsupported.# and may not be available in a future release..#.-client KNOWN.-server KNOWN.

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\i386\jvm.cfg (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):623
                                                                                                                                                                                                    Entropy (8bit):4.956046853743128
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:12:QcwmIzDhHlB725iwoXH3ExOvadDfI3xizh49g1n8OEDfI7yO7:QhDBfOoXHjifIBMB1XqfI77
                                                                                                                                                                                                    MD5:9AEF14A90600CD453C4E472BA83C441F
                                                                                                                                                                                                    SHA1:10C53C9FE9970D41A84CB45C883EA6C386482199
                                                                                                                                                                                                    SHA-256:9E86B24FF2B19D814BBAEDD92DF9F0E1AE86BF11A86A92989C9F91F959B736E1
                                                                                                                                                                                                    SHA-512:481562547BF9E37D270D9A2881AC9C86FC8F928B5C176E9BAF6B8F7B72FB9827C84EF0C84B60894656A6E82DD141779B8D283C6E7A0E85D2829EA071C6DB7D14
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:# Copyright (c) 2001, 2013, Oracle and/or its affiliates. All rights reserved..# ORACLE PROPRIETARY/CONFIDENTIAL. Use is subject to license terms..#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.# List of JVMs that can be used as an option to java, javac, etc..# Order is important -- first in this list is the default JVM..# NOTE that this both this file and its format are UNSUPPORTED and.# WILL GO AWAY in a future release..#.# You may also select a JVM in an arbitrary location with the.# "-XXaltjvm=<jvm_dir>" option, but that too is unsupported.# and may not be available in a future release..#.-client KNOWN.-server KNOWN.

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\images\cursors\cursors.properties (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):1280
                                                                                                                                                                                                    Entropy (8bit):4.9763389414972465
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:24:RlwQtG0Bf29d3ptAMZGpfFGZWpHN07mBpQKf4TpxV4jp504Tz8pFMafpXs:RlwQM0BfEpZSKyCycXW44Cfy
                                                                                                                                                                                                    MD5:269D03935907969C3F11D43FEF252EF1
                                                                                                                                                                                                    SHA1:713ACB9EFF5F0B14A109E6C2771F62EAC9B57D7C
                                                                                                                                                                                                    SHA-256:7B8B63F78E2F732BD58BF8F16144C4802C513A52970C18DC0BDB789DD04078E4
                                                                                                                                                                                                    SHA-512:94D8EE79847CD07681645D379FEEF6A4005F1836AC00453FB685422D58113F641E60053F611802B0FF8F595B2186B824675A91BF3E68D336EF5BD72FAFB2DCC5
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:#.#.# Cursors Properties file.#.# Names GIF89 sources for Custom Cursors and their associated HotSpots.#.# Note: the syntax of the property name is significant and is parsed.# by java.awt.Cursor.#.# The syntax is: Cursor.<name>.<geom>.File=win32_<filename>.# Cursor.<name>.<geom>.HotSpot=<x>,<y>.#. Cursor.<name>.<geom>.Name=<localized name>.#.Cursor.CopyDrop.32x32.File=win32_CopyDrop32x32.gif.Cursor.CopyDrop.32x32.HotSpot=0,0.Cursor.CopyDrop.32x32.Name=CopyDrop32x32.#.Cursor.MoveDrop.32x32.File=win32_MoveDrop32x32.gif.Cursor.MoveDrop.32x32.HotSpot=0,0.Cursor.MoveDrop.32x32.Name=MoveDrop32x32.#.Cursor.LinkDrop.32x32.File=win32_LinkDrop32x32.gif.Cursor.LinkDrop.32x32.HotSpot=0,0.Cursor.LinkDrop.32x32.Name=LinkDrop32x32.#.Cursor.CopyNoDrop.32x32.File=win32_CopyNoDrop32x32.gif.Cursor.CopyNoDrop.32x32.HotSpot=6,2.Cursor.CopyNoDrop.32x32.Name=CopyNoDrop32x32.#.Cursor.MoveNoDrop.32x32.File=win32_MoveNoDrop32x32.gif.Cursor.MoveNoDrop.32x32.HotSpot=6,2.Cursor.MoveNoDrop.32

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\images\cursors\invalid32x32.gif (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:GIF image data, version 89a, 32 x 32
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):153
                                                                                                                                                                                                    Entropy (8bit):6.2813106319833665
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:Csl7X/7/xlXlLaFGkDPF4V0Pee1F/sjtH5ybOCb1C3sxlWn:NljDjkFHF4V0Peene15tutsn
                                                                                                                                                                                                    MD5:1E9D8F133A442DA6B0C74D49BC84A341
                                                                                                                                                                                                    SHA1:259EDC45B4569427E8319895A444F4295D54348F
                                                                                                                                                                                                    SHA-256:1A1D3079D49583837662B84E11D8C0870698511D9110E710EB8E7EB20DF7AE3B
                                                                                                                                                                                                    SHA-512:63D6F70C8CAB9735F0F857F5BF99E319F6AE98238DC7829DD706B7D6855C70BE206E32E3E55DF884402483CF8BEBAD00D139283AF5C0B85DC1C5BF8F253ACD37
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:GIF89a . ................!.......,.... . ...j.?...o..T....._]-..9.`..D...f........^...n.`.%C......<..E..S&QL.....n+...R....'|N...."U........(8HXhx.X..;

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\images\cursors\is-778AL.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):1280
                                                                                                                                                                                                    Entropy (8bit):4.9763389414972465
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:24:RlwQtG0Bf29d3ptAMZGpfFGZWpHN07mBpQKf4TpxV4jp504Tz8pFMafpXs:RlwQM0BfEpZSKyCycXW44Cfy
                                                                                                                                                                                                    MD5:269D03935907969C3F11D43FEF252EF1
                                                                                                                                                                                                    SHA1:713ACB9EFF5F0B14A109E6C2771F62EAC9B57D7C
                                                                                                                                                                                                    SHA-256:7B8B63F78E2F732BD58BF8F16144C4802C513A52970C18DC0BDB789DD04078E4
                                                                                                                                                                                                    SHA-512:94D8EE79847CD07681645D379FEEF6A4005F1836AC00453FB685422D58113F641E60053F611802B0FF8F595B2186B824675A91BF3E68D336EF5BD72FAFB2DCC5
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:#.#.# Cursors Properties file.#.# Names GIF89 sources for Custom Cursors and their associated HotSpots.#.# Note: the syntax of the property name is significant and is parsed.# by java.awt.Cursor.#.# The syntax is: Cursor.<name>.<geom>.File=win32_<filename>.# Cursor.<name>.<geom>.HotSpot=<x>,<y>.#. Cursor.<name>.<geom>.Name=<localized name>.#.Cursor.CopyDrop.32x32.File=win32_CopyDrop32x32.gif.Cursor.CopyDrop.32x32.HotSpot=0,0.Cursor.CopyDrop.32x32.Name=CopyDrop32x32.#.Cursor.MoveDrop.32x32.File=win32_MoveDrop32x32.gif.Cursor.MoveDrop.32x32.HotSpot=0,0.Cursor.MoveDrop.32x32.Name=MoveDrop32x32.#.Cursor.LinkDrop.32x32.File=win32_LinkDrop32x32.gif.Cursor.LinkDrop.32x32.HotSpot=0,0.Cursor.LinkDrop.32x32.Name=LinkDrop32x32.#.Cursor.CopyNoDrop.32x32.File=win32_CopyNoDrop32x32.gif.Cursor.CopyNoDrop.32x32.HotSpot=6,2.Cursor.CopyNoDrop.32x32.Name=CopyNoDrop32x32.#.Cursor.MoveNoDrop.32x32.File=win32_MoveNoDrop32x32.gif.Cursor.MoveNoDrop.32x32.HotSpot=6,2.Cursor.MoveNoDrop.32

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\images\cursors\is-AFKR3.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:GIF image data, version 89a, 32 x 32
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):153
                                                                                                                                                                                                    Entropy (8bit):6.2813106319833665
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:Csl7X/7/xlXlLaFGkDPF4V0Pee1F/sjtH5ybOCb1C3sxlWn:NljDjkFHF4V0Peene15tutsn
                                                                                                                                                                                                    MD5:1E9D8F133A442DA6B0C74D49BC84A341
                                                                                                                                                                                                    SHA1:259EDC45B4569427E8319895A444F4295D54348F
                                                                                                                                                                                                    SHA-256:1A1D3079D49583837662B84E11D8C0870698511D9110E710EB8E7EB20DF7AE3B
                                                                                                                                                                                                    SHA-512:63D6F70C8CAB9735F0F857F5BF99E319F6AE98238DC7829DD706B7D6855C70BE206E32E3E55DF884402483CF8BEBAD00D139283AF5C0B85DC1C5BF8F253ACD37
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:GIF89a . ................!.......,.... . ...j.?...o..T....._]-..9.`..D...f........^...n.`.%C......<..E..S&QL.....n+...R....'|N...."U........(8HXhx.X..;

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\images\cursors\is-BCONN.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:GIF image data, version 89a, 32 x 32
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):153
                                                                                                                                                                                                    Entropy (8bit):6.2813106319833665
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:Csl7X/7/xlXlLaFGkDPF4V0Pee1F/sjtH5ybOCb1C3sxlWn:NljDjkFHF4V0Peene15tutsn
                                                                                                                                                                                                    MD5:1E9D8F133A442DA6B0C74D49BC84A341
                                                                                                                                                                                                    SHA1:259EDC45B4569427E8319895A444F4295D54348F
                                                                                                                                                                                                    SHA-256:1A1D3079D49583837662B84E11D8C0870698511D9110E710EB8E7EB20DF7AE3B
                                                                                                                                                                                                    SHA-512:63D6F70C8CAB9735F0F857F5BF99E319F6AE98238DC7829DD706B7D6855C70BE206E32E3E55DF884402483CF8BEBAD00D139283AF5C0B85DC1C5BF8F253ACD37
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:GIF89a . ................!.......,.... . ...j.?...o..T....._]-..9.`..D...f........^...n.`.%C......<..E..S&QL.....n+...R....'|N...."U........(8HXhx.X..;

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\images\cursors\is-JE38L.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:GIF image data, version 89a, 32 x 32
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):153
                                                                                                                                                                                                    Entropy (8bit):6.2813106319833665
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:Csl7X/7/xlXlLaFGkDPF4V0Pee1F/sjtH5ybOCb1C3sxlWn:NljDjkFHF4V0Peene15tutsn
                                                                                                                                                                                                    MD5:1E9D8F133A442DA6B0C74D49BC84A341
                                                                                                                                                                                                    SHA1:259EDC45B4569427E8319895A444F4295D54348F
                                                                                                                                                                                                    SHA-256:1A1D3079D49583837662B84E11D8C0870698511D9110E710EB8E7EB20DF7AE3B
                                                                                                                                                                                                    SHA-512:63D6F70C8CAB9735F0F857F5BF99E319F6AE98238DC7829DD706B7D6855C70BE206E32E3E55DF884402483CF8BEBAD00D139283AF5C0B85DC1C5BF8F253ACD37
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:GIF89a . ................!.......,.... . ...j.?...o..T....._]-..9.`..D...f........^...n.`.%C......<..E..S&QL.....n+...R....'|N...."U........(8HXhx.X..;

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\images\cursors\is-JLLIP.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:GIF image data, version 89a, 32 x 32
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):153
                                                                                                                                                                                                    Entropy (8bit):6.2813106319833665
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:Csl7X/7/xlXlLaFGkDPF4V0Pee1F/sjtH5ybOCb1C3sxlWn:NljDjkFHF4V0Peene15tutsn
                                                                                                                                                                                                    MD5:1E9D8F133A442DA6B0C74D49BC84A341
                                                                                                                                                                                                    SHA1:259EDC45B4569427E8319895A444F4295D54348F
                                                                                                                                                                                                    SHA-256:1A1D3079D49583837662B84E11D8C0870698511D9110E710EB8E7EB20DF7AE3B
                                                                                                                                                                                                    SHA-512:63D6F70C8CAB9735F0F857F5BF99E319F6AE98238DC7829DD706B7D6855C70BE206E32E3E55DF884402483CF8BEBAD00D139283AF5C0B85DC1C5BF8F253ACD37
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:GIF89a . ................!.......,.... . ...j.?...o..T....._]-..9.`..D...f........^...n.`.%C......<..E..S&QL.....n+...R....'|N...."U........(8HXhx.X..;

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\images\cursors\is-M3ODK.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:GIF image data, version 89a, 31 x 32
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):147
                                                                                                                                                                                                    Entropy (8bit):6.147949937659802
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:CruuU/XExlHrSauZKwM7Qt/wCvTjh2Azr8ptBNKtWXOh6WoXt2W:KP0UvEKwMcx3UAzADBNXOh6h9p
                                                                                                                                                                                                    MD5:CC8DD9AB7DDF6EFA2F3B8BCFA31115C0
                                                                                                                                                                                                    SHA1:1333F489AC0506D7DC98656A515FEEB6E87E27F9
                                                                                                                                                                                                    SHA-256:12CFCE05229DBA939CE13375D65CA7D303CE87851AE15539C02F11D1DC824338
                                                                                                                                                                                                    SHA-512:9857B329ACD0DB45EA8C16E945B4CFA6DF9445A1EF457E4B8B40740720E8C658301FC3AB8BDD242B7697A65AE1436FD444F1968BD29DA6A89725CDDE1DE387B8
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:GIF89a.. ................!.......,...... ...dL...-....F....o.U.8J..'J.....3...a...."...")..=fPHS......h.Zc.KDj.....-.kj..m.....X,&.......S..;

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\images\cursors\is-NSRBB.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:GIF image data, version 89a, 31 x 32
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):165
                                                                                                                                                                                                    Entropy (8bit):6.347455736310776
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:CruuU/XExlHrBwM7Qt/wCvTjh2Azr8ptBNKtWwUzJ7Ful5u44JyYChWn:KP0URwMcx3UAzADBNwUlBul5TLYMWn
                                                                                                                                                                                                    MD5:89CDF623E11AAF0407328FD3ADA32C07
                                                                                                                                                                                                    SHA1:AE813939F9A52E7B59927F531CE8757636FF8082
                                                                                                                                                                                                    SHA-256:13C783ACD580DF27207DABCCB10B3F0C14674560A23943AC7233DF7F72D4E49D
                                                                                                                                                                                                    SHA-512:2A35311D7DB5466697D7284DE75BABEE9BD0F0E2B20543332FCB6813F06DEBF2457A9C0CF569449C37F371BFEB0D81FB0D219E82B9A77ACC6BAFA07499EAC2F7
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:GIF89a.. ................!.......,...... ...vL...-....F....o.U.8J..'J.....3...a...."...")..=fPHS......h.Zc.KDj........k.-mF.. V..9'......f.T....w.xW.B.....P..;

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\images\cursors\is-OBP3F.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:GIF image data, version 89a, 31 x 32
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):168
                                                                                                                                                                                                    Entropy (8bit):6.465243369905675
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:CruuU/XExlHrZauowM7Qt/wCvTjh2Azr8ptBNKtWwUzJZmQYRNbC1MIQvEn:KP0UpawMcx3UAzADBNwUlZaCzn
                                                                                                                                                                                                    MD5:694A59EFDE0648F49FA448A46C4D8948
                                                                                                                                                                                                    SHA1:4B3843CBD4F112A90D112A37957684C843D68E83
                                                                                                                                                                                                    SHA-256:485CBE5C5144CFCD13CC6D701CDAB96E4A6F8660CBC70A0A58F1B7916BE64198
                                                                                                                                                                                                    SHA-512:CF2DFD500AF64B63CC080151BC5B9DE59EDB99F0E31676056CF1AFBC9D6E2E5AF18DC40E393E043BBBBCB26F42D425AF71CCE6D283E838E67E61D826ED6ECD27
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:GIF89a.. ................!.......,...... ...yL...-....F....o.U.8J..'J.....3...a...."...")..=fPHS......h.Zc.KDj........k.-mF.6.'.....`1]......u.Q.r.V..C......f.P..;

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\images\cursors\win32_CopyDrop32x32.gif (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:GIF image data, version 89a, 31 x 32
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):165
                                                                                                                                                                                                    Entropy (8bit):6.347455736310776
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:CruuU/XExlHrBwM7Qt/wCvTjh2Azr8ptBNKtWwUzJ7Ful5u44JyYChWn:KP0URwMcx3UAzADBNwUlBul5TLYMWn
                                                                                                                                                                                                    MD5:89CDF623E11AAF0407328FD3ADA32C07
                                                                                                                                                                                                    SHA1:AE813939F9A52E7B59927F531CE8757636FF8082
                                                                                                                                                                                                    SHA-256:13C783ACD580DF27207DABCCB10B3F0C14674560A23943AC7233DF7F72D4E49D
                                                                                                                                                                                                    SHA-512:2A35311D7DB5466697D7284DE75BABEE9BD0F0E2B20543332FCB6813F06DEBF2457A9C0CF569449C37F371BFEB0D81FB0D219E82B9A77ACC6BAFA07499EAC2F7
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:GIF89a.. ................!.......,...... ...vL...-....F....o.U.8J..'J.....3...a...."...")..=fPHS......h.Zc.KDj........k.-mF.. V..9'......f.T....w.xW.B.....P..;

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\images\cursors\win32_CopyNoDrop32x32.gif (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:GIF image data, version 89a, 32 x 32
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):153
                                                                                                                                                                                                    Entropy (8bit):6.2813106319833665
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:Csl7X/7/xlXlLaFGkDPF4V0Pee1F/sjtH5ybOCb1C3sxlWn:NljDjkFHF4V0Peene15tutsn
                                                                                                                                                                                                    MD5:1E9D8F133A442DA6B0C74D49BC84A341
                                                                                                                                                                                                    SHA1:259EDC45B4569427E8319895A444F4295D54348F
                                                                                                                                                                                                    SHA-256:1A1D3079D49583837662B84E11D8C0870698511D9110E710EB8E7EB20DF7AE3B
                                                                                                                                                                                                    SHA-512:63D6F70C8CAB9735F0F857F5BF99E319F6AE98238DC7829DD706B7D6855C70BE206E32E3E55DF884402483CF8BEBAD00D139283AF5C0B85DC1C5BF8F253ACD37
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:GIF89a . ................!.......,.... . ...j.?...o..T....._]-..9.`..D...f........^...n.`.%C......<..E..S&QL.....n+...R....'|N...."U........(8HXhx.X..;

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\images\cursors\win32_LinkDrop32x32.gif (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:GIF image data, version 89a, 31 x 32
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):168
                                                                                                                                                                                                    Entropy (8bit):6.465243369905675
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:CruuU/XExlHrZauowM7Qt/wCvTjh2Azr8ptBNKtWwUzJZmQYRNbC1MIQvEn:KP0UpawMcx3UAzADBNwUlZaCzn
                                                                                                                                                                                                    MD5:694A59EFDE0648F49FA448A46C4D8948
                                                                                                                                                                                                    SHA1:4B3843CBD4F112A90D112A37957684C843D68E83
                                                                                                                                                                                                    SHA-256:485CBE5C5144CFCD13CC6D701CDAB96E4A6F8660CBC70A0A58F1B7916BE64198
                                                                                                                                                                                                    SHA-512:CF2DFD500AF64B63CC080151BC5B9DE59EDB99F0E31676056CF1AFBC9D6E2E5AF18DC40E393E043BBBBCB26F42D425AF71CCE6D283E838E67E61D826ED6ECD27
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:GIF89a.. ................!.......,...... ...yL...-....F....o.U.8J..'J.....3...a...."...")..=fPHS......h.Zc.KDj........k.-mF.6.'.....`1]......u.Q.r.V..C......f.P..;

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:GIF image data, version 89a, 32 x 32
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):153
                                                                                                                                                                                                    Entropy (8bit):6.2813106319833665
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:Csl7X/7/xlXlLaFGkDPF4V0Pee1F/sjtH5ybOCb1C3sxlWn:NljDjkFHF4V0Peene15tutsn
                                                                                                                                                                                                    MD5:1E9D8F133A442DA6B0C74D49BC84A341
                                                                                                                                                                                                    SHA1:259EDC45B4569427E8319895A444F4295D54348F
                                                                                                                                                                                                    SHA-256:1A1D3079D49583837662B84E11D8C0870698511D9110E710EB8E7EB20DF7AE3B
                                                                                                                                                                                                    SHA-512:63D6F70C8CAB9735F0F857F5BF99E319F6AE98238DC7829DD706B7D6855C70BE206E32E3E55DF884402483CF8BEBAD00D139283AF5C0B85DC1C5BF8F253ACD37
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:GIF89a . ................!.......,.... . ...j.?...o..T....._]-..9.`..D...f........^...n.`.%C......<..E..S&QL.....n+...R....'|N...."U........(8HXhx.X..;

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\images\cursors\win32_MoveDrop32x32.gif (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:GIF image data, version 89a, 31 x 32
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):147
                                                                                                                                                                                                    Entropy (8bit):6.147949937659802
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:CruuU/XExlHrSauZKwM7Qt/wCvTjh2Azr8ptBNKtWXOh6WoXt2W:KP0UvEKwMcx3UAzADBNXOh6h9p
                                                                                                                                                                                                    MD5:CC8DD9AB7DDF6EFA2F3B8BCFA31115C0
                                                                                                                                                                                                    SHA1:1333F489AC0506D7DC98656A515FEEB6E87E27F9
                                                                                                                                                                                                    SHA-256:12CFCE05229DBA939CE13375D65CA7D303CE87851AE15539C02F11D1DC824338
                                                                                                                                                                                                    SHA-512:9857B329ACD0DB45EA8C16E945B4CFA6DF9445A1EF457E4B8B40740720E8C658301FC3AB8BDD242B7697A65AE1436FD444F1968BD29DA6A89725CDDE1DE387B8
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:GIF89a.. ................!.......,...... ...dL...-....F....o.U.8J..'J.....3...a...."...")..=fPHS......h.Zc.KDj.....-.kj..m.....X,&.......S..;

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\images\cursors\win32_MoveNoDrop32x32.gif (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:GIF image data, version 89a, 32 x 32
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):153
                                                                                                                                                                                                    Entropy (8bit):6.2813106319833665
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:Csl7X/7/xlXlLaFGkDPF4V0Pee1F/sjtH5ybOCb1C3sxlWn:NljDjkFHF4V0Peene15tutsn
                                                                                                                                                                                                    MD5:1E9D8F133A442DA6B0C74D49BC84A341
                                                                                                                                                                                                    SHA1:259EDC45B4569427E8319895A444F4295D54348F
                                                                                                                                                                                                    SHA-256:1A1D3079D49583837662B84E11D8C0870698511D9110E710EB8E7EB20DF7AE3B
                                                                                                                                                                                                    SHA-512:63D6F70C8CAB9735F0F857F5BF99E319F6AE98238DC7829DD706B7D6855C70BE206E32E3E55DF884402483CF8BEBAD00D139283AF5C0B85DC1C5BF8F253ACD37
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:GIF89a . ................!.......,.... . ...j.?...o..T....._]-..9.`..D...f........^...n.`.%C......<..E..S&QL.....n+...R....'|N...."U........(8HXhx.X..;

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\is-0A7UQ.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):13962
                                                                                                                                                                                                    Entropy (8bit):3.4283479014478493
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:96:RgZass+YXdGOS8NhN9Yd9Yq67IwOYUuUS9O0:RyJO/BFi9YqAInYUuUmO0
                                                                                                                                                                                                    MD5:1EDDFB1EE252055556F40CDC79632E98
                                                                                                                                                                                                    SHA1:84AA425100740722E91F4725CAF849E7863D12BA
                                                                                                                                                                                                    SHA-256:69BECFE0D45B62BBDBCF6FE111A8A3A041FB749B6CF38E8A2F670607E17C9EE2
                                                                                                                                                                                                    SHA-512:A0FDBF42FF105C9A2F12179124606A720DF8F32365605644E15600767E5732312777A58390FDB1A9B1C0B152CCC29496133B278A6E5736B38AF2B5FAB251D40C
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:# Copyright (c) 2013, Oracle and/or its affiliates. All rights reserved..# ORACLE PROPRIETARY/CONFIDENTIAL. Use is subject to license terms..#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.# This properties file defines a Hijrah calendar variant..#.# Fields:.#.# <version> ::= 'version' '=' <version string>.# <id> ::= 'id' '=' <id string>.# <type> ::= 'type' '=' <type string>.# <iso-start> ::= 'iso-start' '=' <start date in the ISO calendar>.# <year> ::= <yyyy> '=' <nn nn nn nn nn nn nn nn nn nn nn nn>.#.# version ... (Required).#.# id ... (Required).# Identifies the Java Chronology.#.# type ... (Required).# Identifies the type of calendar in the standard calendar ID scheme.# iso-start ... (Required).# Specifies the corresponding ISO date to the first Hijrah day.# in the defined range of dates.#.# year ... (Required).# Number of days for each month of a Hijrah year.# * Each line defines a year. The years must be in chronological.#

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\is-0GUAC.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):1210
                                                                                                                                                                                                    Entropy (8bit):4.681309933800066
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:24:va19LezUlOGdZ14BilDEwG5u3nVDWc/Wy:iaLGr1OsS5KnVaIWy
                                                                                                                                                                                                    MD5:4F95242740BFB7B133B879597947A41E
                                                                                                                                                                                                    SHA1:9AFCEB218059D981D0FA9F07AAD3C5097CF41B0C
                                                                                                                                                                                                    SHA-256:299C2360B6155EB28990EC49CD21753F97E43442FE8FAB03E04F3E213DF43A66
                                                                                                                                                                                                    SHA-512:99FDD75B8CE71622F85F957AE52B85E6646763F7864B670E993DF0C2C77363EF9CFCE2727BADEE03503CDA41ABE6EB8A278142766BF66F00B4EB39D0D4FC4A87
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:############################################################.# Sound Configuration File.############################################################.#.# This properties file is used to specify default service.# providers for javax.sound.midi.MidiSystem and.# javax.sound.sampled.AudioSystem..#.# The following keys are recognized by MidiSystem methods:.#.# javax.sound.midi.Receiver.# javax.sound.midi.Sequencer.# javax.sound.midi.Synthesizer.# javax.sound.midi.Transmitter.#.# The following keys are recognized by AudioSystem methods:.#.# javax.sound.sampled.Clip.# javax.sound.sampled.Port.# javax.sound.sampled.SourceDataLine.# javax.sound.sampled.TargetDataLine.#.# The values specify the full class name of the service.# provider, or the device name..#.# See the class descriptions for details..#.# Example 1:.# Use MyDeviceProvider as default for SourceDataLines:.# javax.sound.sampled.SourceDataLine=com.xyz.MyDeviceProvider.#.# Example 2:.# Specify the default Synthesizer by it

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\is-0NRFC.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Java archive data (JAR)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):560581
                                                                                                                                                                                                    Entropy (8bit):5.782377075193269
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:12288:I5l+qU67FYWg+YWgYWeoXqgYSq8eh2f/m5NwaHkSIJHvWQ6Q7ooMcgH5lY7TQ5c5:I5l+qU67FYWg+YWgYWeoXqgYSq8eh2fV
                                                                                                                                                                                                    MD5:82B8130E364676524FDCA151D851F1BF
                                                                                                                                                                                                    SHA1:637F477B6E1A531127230BAD5B4DC7E2A971F467
                                                                                                                                                                                                    SHA-256:673753ED33C51CCFC6234A36526C5C52AD1A9DF7D873604E6250AAA88C909261
                                                                                                                                                                                                    SHA-512:F27E5F28D51D97CE86FF3A053633DFF69E1CD2D9E7F989B388777C566DA34E0C708E259DD654F4147A8C14660FD82178545A9EDC4C481094F417E848CBBC7E9B
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK........F..I................META-INF/....PK........F..I.@"T>...>.......META-INF/MANIFEST.MFManifest-Version: 1.0..Implementation-Vendor: Oracle Corporation..Implementation-Title: Java Runtime Environment..Implementation-Version: 1.8.0_121..Specification-Vendor: Oracle Corporation..Created-By: 1.7.0_07 (Oracle Corporation)..Specification-Title: Java Platform API Specification..Specification-Version: 1.8....PK...........IB.<>^...^...8...com/oracle/jrockit/jfr/client/EventSettingsBuilder.class.......4....5.f..g....f..4.h..4.i..j....f..4.k..l....m..4.n..o....f..4.p..q..r....f....s....t....u....v..w..x..y....z..{....|....}....~.................................#.........................)...................................................eventDefaultSets...Ljava/util/ArrayList;...Signature..DLjava/util/ArrayList<Loracle/jrockit/jfr/settings/EventDefaultSet;>;...settings..ALjava/util/ArrayList<Loracle/jrockit/jfr/settings/EventSetting;>;...eventDescriptorType..2Loracle/jrockit/jfr/openmbean/

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\is-15GMT.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Java archive data (JAR)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):583111
                                                                                                                                                                                                    Entropy (8bit):6.068399869771197
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:6144:HAkbJvIQLuITUuIUcV1dfYv96YBv6HZYvs1CEtrM4:gyhUTVr++H3E4
                                                                                                                                                                                                    MD5:D33FBBA48EBC1582FC2D837204BBF4E5
                                                                                                                                                                                                    SHA1:BFFA5634E34890A3B59F785EFE839FB32E28ADB3
                                                                                                                                                                                                    SHA-256:EBCEC97EAFC3DE1DF287B12D44718DC9E17F204869B2E3F47372D773348049CC
                                                                                                                                                                                                    SHA-512:D174E15908751FBF692635B5B35AC5616A7857E6649E15F72B79EEE992136E040364AF8E5DC7BE11E787622FE5AFFF57FBE12EC7B7ECC22A9ADA2560AB430C4D
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK........G..I................META-INF/....PK........G..I.@"T>...>.......META-INF/MANIFEST.MFManifest-Version: 1.0..Implementation-Vendor: Oracle Corporation..Implementation-Title: Java Runtime Environment..Implementation-Version: 1.8.0_121..Specification-Vendor: Oracle Corporation..Created-By: 1.7.0_07 (Oracle Corporation)..Specification-Title: Java Platform API Specification..Specification-Version: 1.8....PK...........I`..b........+...com/sun/net/ssl/internal/ssl/Provider.class.......4.....()V...()Z...<init>...J..%com/sun/net/ssl/internal/ssl/Provider...install...isFIPS...serialVersionUID...sun/security/ssl/SunJSSE.,..c".J-.........(Ljava/lang/String;)V...(Ljava/security/Provider;)V...........................................Code...ConstantValue.1................................................*..............................*+..............................*+.........).............................)...........................PK...........I3.2........;...com/sun/net/ssl/internal/ssl/X50

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\is-1BLDM.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):84355
                                                                                                                                                                                                    Entropy (8bit):4.927199323446014
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:1536:4X/nxfn5rxLyMznYolTzlff5OK3COHoHNG5rb/cxNwmCX1g86K2oWdAqNqc+KMjD:qxn5rxLyMzbf5OK3CJNG51g86A
                                                                                                                                                                                                    MD5:7FC71A62D85CCF12996680A4080AA44E
                                                                                                                                                                                                    SHA1:199DCCAA94E9129A3649A09F8667B552803E1D0E
                                                                                                                                                                                                    SHA-256:01FE24232D0DBEFE339F88C44A3FD3D99FF0E17AE03926CCF90B835332F5F89C
                                                                                                                                                                                                    SHA-512:B0B9B486223CF79CCF9346AAF5C1CA0F9588247A00C826AA9F3D366B7E2EF905AF4D179787DCB02B32870500FD63899538CF6FAFCDD9B573799B255F658CEB1D
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:java/lang/Object..java/lang/String..java/io/Serializable..java/lang/Comparable..java/lang/CharSequence..java/lang/Class..java/lang/reflect/GenericDeclaration..java/lang/reflect/AnnotatedElement..java/lang/reflect/Type..java/lang/Cloneable..java/lang/ClassLoader..java/lang/System..java/lang/Throwable..java/lang/Error..java/lang/ThreadDeath..java/lang/Exception..java/lang/RuntimeException..java/lang/SecurityManager..java/security/ProtectionDomain..java/security/AccessControlContext..java/security/SecureClassLoader..java/lang/ClassNotFoundException..java/lang/ReflectiveOperationException..java/lang/NoClassDefFoundError..java/lang/LinkageError..java/lang/ClassCastException..java/lang/ArrayStoreException..java/lang/VirtualMachineError..java/lang/OutOfMemoryError..java/lang/StackOverflowError..java/lang/IllegalMonitorStateException..java/lang/ref/Reference..java/lang/ref/SoftReference..java/lang/ref/WeakReference..java/lang/ref/FinalReference..java/lang/ref/PhantomReference..sun/misc/Cleaner

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\is-2HK7E.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):4464
                                                                                                                                                                                                    Entropy (8bit):4.834345958771967
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:96:VAcEvEtGObfObz3Obm0ObPOn23CO0V+r/aJ7SFs:PEGG4f4z34m04PeBm27Si
                                                                                                                                                                                                    MD5:2FE77CD007D99DDE926A22094E333E0E
                                                                                                                                                                                                    SHA1:6587F43B93527DD17ABCD5699EB9682B6F08C09B
                                                                                                                                                                                                    SHA-256:16C93910B2785E7CBDDA90D5479AA9687148C2141AC0ADBD0277FDE284F6BBB3
                                                                                                                                                                                                    SHA-512:33D32B1C50BAFC4BCEE1D97D81176E3C9FF6B316536A7A88F76DB92781B4ACB716CC9FF75A97AB32F4469838B370A8DF54B2E2F5FE97F0873B8A44CD2B848FAA
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:############################################################.# .Default Networking Configuration File.#.# This file may contain default values for the networking system properties..# These values are only used when the system properties are not specified.# on the command line or set programatically..# For now, only the various proxy settings can be configured here..############################################################..# Whether or not the DefaultProxySelector will default to System Proxy.# settings when they do exist..# Set it to 'true' to enable this feature and check for platform.# specific proxy settings.# Note that the system properties that do explicitely set proxies.# (like http.proxyHost) do take precedence over the system settings.# even if java.net.useSystemProxies is set to true.. .java.net.useSystemProxies=false..#------------------------------------------------------------------------.# Proxy configuration for the various protocol handlers..# DO NOT uncomment these

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\is-A2DU8.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Java archive data (JAR)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):33932
                                                                                                                                                                                                    Entropy (8bit):7.931081673680949
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:768:SYqnDGqkm6VqjSe/SARvN9kqizgYoojhxQYuWnQ:SYcDhkK/ntNIzB5jhxYmQ
                                                                                                                                                                                                    MD5:43D259C81E99F7376A55FF91A30E1B23
                                                                                                                                                                                                    SHA1:764F248A819635778826E3CE6316F1E8FEA14885
                                                                                                                                                                                                    SHA-256:C6918F1BBFC05A05F2D4C9ECD328D4DABBE0D44930A721679DB7A65482684991
                                                                                                                                                                                                    SHA-512:41B5FCB46915BDE35517B11FB74E83E4525600E0BCB3FE1C4BD122FF5C240514CCBDE3882136E7DB1F692DEFE23B715D3EB45E1031E7E2927BDDF7F2267EB496
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK........w_.I................META-INF/....PK........v_.I.E..Z...g.......META-INF/MANIFEST.MF.M..LK-...K-*...R0.3..r.C.q,HL.HU...%-..x...R.KRSt.*A.-...M.t....4....sR......K..5y.x..PK........,Z.I................javafx/PK........,Z.I................javafx/embed/PK........,Z.I................javafx/embed/swt/PK........+Z.Ij...........%...javafx/embed/swt/CustomTransfer.class.T[S.F.=.MX(..!............8..`h.d....." yd..........4....%..k.N..ka.83..[.....|+...........#.OD..1...1.1.S1....*>..I..TL.....Y..*.S.q.-KAja..6.M.Y7V|.v...e............+...u...Z.....Z......k...O.v.....x..f...M.v...~I....j.N.(.R.... ..n.%).l:.N..,J...-.%.os:.v.K..V.._p.u.l..e...S5...^.....3+.Yy.h.RtGR..y.)..~...g..R.;5K...{.G.*..X.JP....D....8..[3.g...'d.e#Z.|c.j.t..F.w..t.W.j.,K[q.^..E.=M.a..6d.Z..yV.....=..........:.WG.............RA.<......qT...,*.=.....t\......(aI.2.....!..Jp.,..<.x..n.S....N.K.e.W....N.-..`....hmQ.E.fGE..$..n...4I{.......l_.)......?.Z>...t

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\is-B3ME8.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v2.0 to extract, compression method=deflate
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):116446
                                                                                                                                                                                                    Entropy (8bit):7.914039236098481
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:v47Ovr7VDo5Zd5UVokTTNeMAgGHuyCTCK:A0DqZdWBo7DH7CX
                                                                                                                                                                                                    MD5:70EB04D21D1639B5D92165CD9D3940BA
                                                                                                                                                                                                    SHA1:D958ADAC5F1EDEFA22045A1409CCDEFF154779C1
                                                                                                                                                                                                    SHA-256:15C40DB7AB18423A7B653B64033D4639A8BA5F201C20232C6F5DCE0102887231
                                                                                                                                                                                                    SHA-512:2124AD54B1B10CBAF9E06BCC63CF8B2B8479B9787BE5CA94F425B0A506C3722A11C68A073718B9F57B6AC9B84CA87BA2838E843C0536FB0769BA64F2A2BD4B58
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK.........D.I................META-INF/MANIFEST.MF.Y..X..Y.C,j...B.Tfo.$1...6m..Y........L..o%...q.....Kr.$.M...u..../..._.{..;(Z.]>.f$m..x...}..M...).....~z..a.....;.....~.&..'....xQj....U.UY.}...^...........+.y.{...m....*....}..-(^..&.......w............9..-vo...........]...~.......S....Z'.b..&......m...%....7:..k...m......L%..gZU.G...;.P.k.Fz......+.:ps.(^..v.F.b..,s./t.*...(G..D.\.{D.....u....9...K?..0....@.a..b@..=.....xD..Y_....]e.71.R.5L..s*.bP..`.?Y..h...qC...l.r...9tH.PM...1k ..Z.?.n...??..=i^s.).zZ3....wl.udl...w..L.._.x..'..K.....j.....[4...eL.<_l. f".y.xh.... .....'..B....,..i.n.t....+...(.nu.m.6..@)W..q..w....6.2..kT.]...^%k.Y....).QS..q.{.1..A..d.pN.nPZ.]?.O}..3(>.U.1..u..N...p.....>H...t.S....m ..............j.zZ....j....|.M*.o...E..~W'..%..A....3.F..Oy.h.V..2.....&.42.d.A]....).8..U..h..^-q.K.+WI'....QS.u.n.......N..&...)......Z.5......A.O..~y.5.....-.=...B.w.b.yo...... ...!..5.y...Z........')s.d"t~=.o(E..`.N.h...

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\is-B9NIV.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):8400
                                                                                                                                                                                                    Entropy (8bit):5.164879464727495
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:192:qwfOC9OYOxUmHomjgDwlZ+TFXsq2H+aUHCHQj4mEo:qqgniTyq0iV
                                                                                                                                                                                                    MD5:7D4ABBCFB06D083F349E27D7E6972F3C
                                                                                                                                                                                                    SHA1:EB91253590526F7BE7415839CCBF702683639C8C
                                                                                                                                                                                                    SHA-256:D936EE24810B747C54192B4B5A279F21179FE3CEB42D113D025A368EBB7CB5A7
                                                                                                                                                                                                    SHA-512:E5C2FBBC07CD53BAF14F3CC239B56B42B73DE47F9B7904AABF7D97695D2AB8866D0C8179235CBF022245949B9B8E419985E328AA5ED333B14B8B4DE2C82B225E
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:#.# This file describes mapping information between Windows and Java.# time zones..# Format: Each line should include a colon separated fields of Windows.# time zone registry key, time zone mapID, locale (which is most.# likely used in the time zone), and Java time zone ID. Blank lines.# and lines that start with '#' are ignored. Data lines must be sorted.# by mapID (ASCII order)..#.# NOTE.# This table format is not a public interface of any Java.# platforms. No applications should depend on this file in any form..#.# This table has been generated by a program and should not be edited.# manually..#.Romance:-1,64::Europe/Paris:.Romance Standard Time:-1,64::Europe/Paris:.Warsaw:-1,65::Europe/Warsaw:.Central Europe:-1,66::Europe/Prague:.Central Europe Standard Time:-1,66::Europe/Prague:.Prague Bratislava:-1,66::Europe/Prague:.W. Central Africa Standard Time:-1,66:AO:Africa/Luanda:.FLE:-1,67:FI:Europe/Helsinki:.FLE Standard Time:-1,67:FI:Europe/Helsinki:.GFT:-1,6

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\is-BTV2S.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Java archive data (JAR)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):940401
                                                                                                                                                                                                    Entropy (8bit):5.941429591733856
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:6144:FsOC+XLhcw5j2roNPyA/E0EileuX6cm50e727858oSsSHO0ThdTfJDJhEv0IrtZU:3XLTzNPyH7iUvk8XIvfH
                                                                                                                                                                                                    MD5:26DE149A64BC2B19399F971EC93CD360
                                                                                                                                                                                                    SHA1:31FE4E00F8868DE92BD8B4F102A8E290B294723B
                                                                                                                                                                                                    SHA-256:37F5964DE0BCF37C5E1E3A4B8BB3F494F314D96BC2C5DE071CB69749D77D45F5
                                                                                                                                                                                                    SHA-512:798705C731773D49B8F8C151CE1551D1B53995F9606C353F16CBE0D7777DF276FC44F6CDE6D8BB6D89E8F09479CC4F355E34752824766CF40B8DA3E7CE275247
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK.........I................META-INF/....PK.........Iu/u*e...e.......META-INF/MANIFEST.MFManifest-Version: 1.0..Ant-Version: Apache Ant 1.7.1..Created-By: 25.121-b13 (Oracle Corporation)....PK.........I................com/PK.........I................com/sun/PK.........I................com/sun/javaws/PK.........I................com/sun/javaws/exceptions/PK.........I................com/sun/javaws/jnl/PK.........I................com/sun/javaws/net/PK.........I................com/sun/javaws/net/protocol/PK.........I............ ...com/sun/javaws/net/protocol/jar/PK.........I................com/sun/javaws/progress/PK.........I................com/sun/javaws/security/PK.........I................com/sun/javaws/ui/PK.........I................com/sun/javaws/util/PK.........I................com/sun/jnlp/PK.........I................javax/PK.........I................javax/jnlp/PK.........I.T..........#...com/sun/javaws/BrowserSupport.class.......1.&...()V...()Z..

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\is-CP3HB.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):4122
                                                                                                                                                                                                    Entropy (8bit):3.2585384283455134
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:48:BlWxFFGFSupi94blATFxjGph5vLC6/w37ZXQTbVm/eVzOBJ:BlWJEi94blAT+ph5vLkApmGqr
                                                                                                                                                                                                    MD5:F6258230B51220609A60AA6BA70D68F3
                                                                                                                                                                                                    SHA1:B5B95DD1DDCD3A433DB14976E3B7F92664043536
                                                                                                                                                                                                    SHA-256:22458853DA2415F7775652A7F57BB6665F83A9AE9FB8BD3CF05E29AAC24C8441
                                                                                                                                                                                                    SHA-512:B2DFCFDEBF9596F2BB05F021A24335F1EB2A094DCA02B2D7DD1B7C871D5EECDA7D50DA7943B9F85EDB5E92D9BE6B6ADFD24673CE816DF3960E4D68C7F894563F
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:CurD..........................@C..,M...................... K...C..PF..4@...........R...........C......TF...........M..DL...C.......S..........<M...c...................C...C...A..........hK...C...M.......... O......8...PC...C..........@E...............E..............`.......pX...O...........B...C.......O...D..............,J..........................................@J..............XO..........................................0C...........................O...........................................M.......A...............................................................C...O...................................................................O..........TK...........R...O..............8C...........................P.................. C..............................................`C..........PK...............J......0F..pE...................................Q...............................R.......Q...........c...Q...................................................................................C

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\is-DLQFR.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):3928
                                                                                                                                                                                                    Entropy (8bit):4.86616891434286
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:96:pTgwOsORUjdjTD6QfxWkVIyiVyV2mjuVwwY:Jgw5TjdjTtpWk6ylV2zwwY
                                                                                                                                                                                                    MD5:D8B47B11E300EF3E8BE3E6E50AC6910B
                                                                                                                                                                                                    SHA1:2D5ED3B53072B184D67B1A4E26AEC2DF908DDC55
                                                                                                                                                                                                    SHA-256:C2748E07B59398CC40CACCCD47FC98A70C562F84067E9272383B45A8DF72A692
                                                                                                                                                                                                    SHA-512:8C5F3E1619E8A92B9D9CF5932392B1CB9F77625316B9EEF447E4DCE54836D90951D9EE70FFD765482414DD51B816649F846E40FD07B4FBDD5080C056ADBBAE6F
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:#.# This properties file is used to initialize the default.# java.awt.datatransfer.SystemFlavorMap. It contains the Win32 platform-.# specific, default mappings between common Win32 Clipboard atoms and platform-.# independent MIME type strings, which will be converted into.# java.awt.datatransfer.DataFlavors..#.# These default mappings may be augmented by specifying the.#.# AWT.DnD.flavorMapFileURL .#.# property in the appropriate awt.properties file. The specified properties URL.# will be loaded into the SystemFlavorMap..#.# The standard format is:.#.# <native>=<MIME type>.#.# <native> should be a string identifier that the native platform will.# recognize as a valid data format. <MIME type> should specify both a MIME.# primary type and a MIME subtype separated by a '/'. The MIME type may include.# parameters, where each parameter is a key/value pair separated by '=', and.# where each parameter to the MIME type is separated by a ';'..#.# Because SystemFlavorMap implements Flavor

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\is-IC0FR.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):149
                                                                                                                                                                                                    Entropy (8bit):4.558376029276625
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:LFpfBZgZLXnuWxVEzERMLVAAiuKIn7IRAdSPGGzJzGBXlnfMaAHCR1vn:L7APWzTLVAkIiSPhZGBX5kaAHCXn
                                                                                                                                                                                                    MD5:2ED483DF31645D3D00C625C00C1E5A14
                                                                                                                                                                                                    SHA1:27C9B302D2D47AAE04FC1F4EF9127A2835A77853
                                                                                                                                                                                                    SHA-256:68EF2F3C6D7636E39C6626ED1BD700E3A6B796C25A9E5FECA4533ABFACD61CDF
                                                                                                                                                                                                    SHA-512:4BF6D06F2CEAF070DF4BD734370DEF74A6DD545FD40EFD64A948E1422470EF39E37A4909FEEB8F0731D5BADB3DD9086E96DACE6BDCA7BBD3078E8383B16894DA
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:#.# Load the Java Access Bridge class into the JVM.#.#assistive_technologies=com.sun.java.accessibility.AccessBridge.#screen_magnifier_present=true..

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\is-INS8R.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:raw G3 (Group 3) FAX
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):3770
                                                                                                                                                                                                    Entropy (8bit):4.414778819875262
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:96:i7WgWWWW81dp83p3D7WOk4BxciETBT5BLrws+LW/Be6Ji:iBWWWW8/e53vNxci8juWC
                                                                                                                                                                                                    MD5:827F00E05F3C5272AEF3BF456CF52BF5
                                                                                                                                                                                                    SHA1:280EF454A4644D1E17C7AFAC3B94249ED6BBDCBE
                                                                                                                                                                                                    SHA-256:0F2265F0113A757C15D51FA53409D630478378FD0856EF547780B40AC6C87156
                                                                                                                                                                                                    SHA-512:F6F4F9B7EEEA090081CC0FFE9D2DB705F832CF0AF9882B00AC97ECAE89F8C77A8D62EB6F224D78B7195172EDCFF74CD21A2459A7ED9CD6DDB29B3CC32398C4BC
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:...&.........:.^.p.........#.]...........6.>.:.-.9.<.=.3./.0.;.4...2.8.1.5.7................................................................................................................................................................................. .!............. .!.................................................................................E.D.J.G.B.H.F.C.@.A.?.I...........................................................................................!.".#.$.%.&.'.(.).*.+.+.+.+.+.K.O.W.`.h.g.Z.Y.f.X.T.^.a.b.c.[.Q.\.R.U.L.S.P.].e.N.V._.d.M.i.l.....t.s.n.}.|.......r.q.~.u.m.y...v.z.x.{.........j.w.k.o.........p.......................................................................................................................................................".......#........... .................#.(.-.2.7.<.A.F.K.P.U.[.a.g.m.s.y.........................................................!.).6.<.I.V.e.l.~.............................&.2.>.H.S.\.h.q.}.............................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\is-IUA8S.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Java archive data (JAR)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):5014514
                                                                                                                                                                                                    Entropy (8bit):6.572049680612901
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:49152:qVlKtT3nO37H8TieZmOGkaBIWAg78uykL5U1xUPn4qQG0K:rs7jFUTUP4g0K
                                                                                                                                                                                                    MD5:741F19422CA038C0E025AF1086256D9E
                                                                                                                                                                                                    SHA1:237FC913646B36ABA63592E6C948E60161D7FE27
                                                                                                                                                                                                    SHA-256:41325FA84D9212D63843001754A548F6C5D90458AE47E109FA1677D9DED75D5C
                                                                                                                                                                                                    SHA-512:DD4B7B2CF02A15B1338BE1EAE1153D32AFFB0BB2EEDFDF75A6BFE262EF1CAB5745E9656172BDE7821C8D6F381FC0D88F185E9234739358F87CD80C1271642013
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK.........I................META-INF/....PK.........Iu/u*e...e.......META-INF/MANIFEST.MFManifest-Version: 1.0..Ant-Version: Apache Ant 1.7.1..Created-By: 25.121-b13 (Oracle Corporation)....PK.........I................com/PK.........I................com/oracle/PK.........I................com/oracle/deploy/PK.........I................com/oracle/deploy/update/PK.........I................com/sun/PK.........I................com/sun/applet2/PK.........I................com/sun/applet2/preloader/PK.........I............ ...com/sun/applet2/preloader/event/PK.........I................com/sun/deploy/PK.........I................com/sun/deploy/appcontext/PK.........I................com/sun/deploy/association/PK.........I............#...com/sun/deploy/association/utility/PK.........I................com/sun/deploy/cache/PK.........I................com/sun/deploy/config/PK.........I................com/sun/deploy/jardiff/PK.........I................com/sun/deploy/mo

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\is-JV0L4.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):10568
                                                                                                                                                                                                    Entropy (8bit):5.183430724132545
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:192:y+e6a1nsNi8bTeOiO/Ywca9nB2RwhCdvBMGuo6wj:ylnHIR9B2Rwhivj
                                                                                                                                                                                                    MD5:A15D4F6635BFB05282B88458D33C1309
                                                                                                                                                                                                    SHA1:A3D930002D0C8BF2FD263CB21EC089D233FFF106
                                                                                                                                                                                                    SHA-256:115B2049DE908E5D9BAD5BDE2ED035E85A7ADE35BF323BFD3D491A8C218146F1
                                                                                                                                                                                                    SHA-512:9B089BD2723F11BDEFA2CE1BE5804C595811BECD8F1ED922E0CFB43DC4C8CEE637E5AE2594A8F3B2B50B750174C9EDB7E30BF7451D6EFA5ECA8741EE86D8205C
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:#.# .# Copyright (c) 2003, 2011, Oracle and/or its affiliates. All rights reserved..# ORACLE PROPRIETARY/CONFIDENTIAL. Use is subject to license terms..#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#..# Version..version=1..# Component Font Mappings..allfonts.chinese-ms936=SimSun.allfonts.chinese-ms936-extb=SimSun-ExtB.allfonts.chinese-gb18030=SimSun-18030.allfonts.chinese-gb18030-extb=SimSun-ExtB.allfonts.chinese-hkscs=MingLiU_HKSCS.allfonts.chinese-ms950-extb=MingLiU-ExtB.allfonts.devanagari=Mangal.allfonts.dingbats=Wingdings.allfonts.lucida=Lucida Sans Regular.allfonts.symbol=Symbol.allfonts.symbols=Segoe UI Symbol.allfonts.thai=Lucida Sans Regular.allfonts.georgian=Sylfaen..serif.plain.alphabetic=Times New Roman.serif.plain.chinese-ms950=MingLiU.serif.plain.chinese-ms950-extb=MingLiU-ExtB.serif.plain.hebrew=David.serif.plain.japanese=MS Mincho.serif.plain.korean=Batang..serif.bold.alphabetic=Times New Roman Bold.serif.bold.chinese-ms950=PMingLiU.serif.bold.chinese-ms950-extb=PMingLiU-ExtB

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\is-K17T1.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Java archive data (JAR)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):3492568
                                                                                                                                                                                                    Entropy (8bit):6.066315438699595
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:49152:zrEXWnxF7W1U+fZoJxQwvNqE6SVI7ypp53uGxKfEVtWbuMzTN+no5YSezryX191F:he
                                                                                                                                                                                                    MD5:535EDF7BA4312849B20CA01BCE0DF36A
                                                                                                                                                                                                    SHA1:0D4A4C7602F83E06A04953E257169C7832A2F953
                                                                                                                                                                                                    SHA-256:6BA3F5EDF305FA52AB249AA92617219FD83AF7AB6C3D97A096BDA662610D806A
                                                                                                                                                                                                    SHA-512:E9F33926AD62A6226C913494B7D4C84D99A2095AB808BDF988A23293D7E40DA3A7F6CD40D5CFDDFA4EAF9618D7F97967880D4A97CB521FA7E13DA8F9B9939F51
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK........N..I................META-INF/....PK........N..I.@"T>...>.......META-INF/MANIFEST.MFManifest-Version: 1.0..Implementation-Vendor: Oracle Corporation..Implementation-Title: Java Runtime Environment..Implementation-Version: 1.8.0_121..Specification-Vendor: Oracle Corporation..Created-By: 1.7.0_07 (Oracle Corporation)..Specification-Title: Java Platform API Specification..Specification-Version: 1.8....PK........R..I....$...$.......META-INF/mailcap.default#.# This is a very simple 'mailcap' file.#.image/gif;;..x-java-view=com.sun.activation.viewers.ImageViewer.image/jpeg;;..x-java-view=com.sun.activation.viewers.ImageViewer.text/*;;..x-java-view=com.sun.activation.viewers.TextViewer.text/*;;..x-java-edit=com.sun.activation.viewers.TextEditor.PK........R..I..{~2...2.......META-INF/mimetypes.default#.# A simple, old format, mime.types file.#.text/html..html htm HTML HTM.text/plain..txt text TXT TEXT.image/gif..gif GIF.image/ief..ief.image/jpeg..jpeg jpg jpe JPG.image/tiff..tiff tif.

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\is-K784J.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):104311
                                                                                                                                                                                                    Entropy (8bit):7.115241198657748
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:1536:5cUFmdKPGLn+hkpoVSdTMB0q/////tj7aqH3RX9rUDRuqmotqegJ+ZNRn:5Ar+iaVgbqH3RNrMRuqlQeg0ZNRn
                                                                                                                                                                                                    MD5:C74BC13CB02B49BCD1E026B70BBE37B6
                                                                                                                                                                                                    SHA1:F14B2A4609B59C588BD3044546B1E3B5CFBC69A4
                                                                                                                                                                                                    SHA-256:05D8C8645CA07EDEB988BC94A9D8444D12F33AB4CF3AB1C131916A0A0C6516D4
                                                                                                                                                                                                    SHA-512:6F8109ED2A3C0841DD92F60F944E8DC73AB9925782F3BF13E0E39DB4B5C225CBFC7559B544B75DA68BB5664753D9F4B4E7FD0F942ACD8D148781544B7B1A92C7
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:...TZDB....2016i.U..Africa/Abidjan..Africa/Accra..Africa/Addis_Ababa..Africa/Algiers..Africa/Asmara..Africa/Asmera..Africa/Bamako..Africa/Bangui..Africa/Banjul..Africa/Bissau..Africa/Blantyre..Africa/Brazzaville..Africa/Bujumbura..Africa/Cairo..Africa/Casablanca..Africa/Ceuta..Africa/Conakry..Africa/Dakar..Africa/Dar_es_Salaam..Africa/Djibouti..Africa/Douala..Africa/El_Aaiun..Africa/Freetown..Africa/Gaborone..Africa/Harare..Africa/Johannesburg..Africa/Juba..Africa/Kampala..Africa/Khartoum..Africa/Kigali..Africa/Kinshasa..Africa/Lagos..Africa/Libreville..Africa/Lome..Africa/Luanda..Africa/Lubumbashi..Africa/Lusaka..Africa/Malabo..Africa/Maputo..Africa/Maseru..Africa/Mbabane..Africa/Mogadishu..Africa/Monrovia..Africa/Nairobi..Africa/Ndjamena..Africa/Niamey..Africa/Nouakchott..Africa/Ouagadougou..Africa/Porto-Novo..Africa/Sao_Tome..Africa/Timbuktu..Africa/Tripoli..Africa/Tunis..Africa/Windhoek..America/Adak..America/Anchorage..America/Anguilla..America/Antigua..America/Araguaina..America/

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\is-L96EM.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):2126
                                                                                                                                                                                                    Entropy (8bit):4.970874214349507
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:48:EE796OfeCiuG2M5tP5iMmC5KOAY2HQii+r4IzteKk:EnEiuGJbP5lmC5KOA3HQii+EIz8Kk
                                                                                                                                                                                                    MD5:91AA6EA7320140F30379F758D626E59D
                                                                                                                                                                                                    SHA1:3BE2FEBE28723B1033CCDAA110EAF59BBD6D1F96
                                                                                                                                                                                                    SHA-256:4AF21954CDF398D1EAE795B6886CA2581DAC9F2F1D41C98C6ED9B5DBC3E3C1D4
                                                                                                                                                                                                    SHA-512:03428803F1D644D89EB4C0DCBDEA93ACAAC366D35FC1356CCABF83473F4FEF7924EDB771E44C721103CEC22D94A179F092D1BFD1C0A62130F076EB82A826D7CB
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:% VERSION 2..% WARNING: this file is auto-generated; do not edit..% UNSUPPORTED: this file and its format may change and/or..% may be removed in a future release..# charsets.jar..sun/nio..sun/awt..# jce.jar..javax/crypto..sun/security..META-INF/ORACLE_J.RSA..META-INF/ORACLE_J.SF..# jfr.jar..oracle/jrockit/..jdk/jfr..com/oracle/jrockit/..! jsse.jar..sun/security..com/sun/net/..! management-agent.jar..@ resources.jar..com/sun/java/util/jar/pack/..META-INF/services/sun.util.spi.XmlPropertiesProvider..META-INF/services/javax.print.PrintServiceLookup..com/sun/corba/..META-INF/services/javax.sound.midi.spi.SoundbankReader..sun/print..META-INF/services/javax.sound.midi.spi.MidiFileReader..META-INF/services/sun.java2d.cmm.CMMServiceProvider..javax/swing..META-INF/services/javax.sound.sampled.spi.AudioFileReader..META-INF/services/javax.sound.midi.spi.MidiDeviceProvider..sun/net..META-INF/services/javax.sound.sampled.spi.AudioFileWriter..com/sun/imageio/..META-INF/services/sun.java2d.pipe.Ren

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\is-LBNQ4.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):1378
                                                                                                                                                                                                    Entropy (8bit):5.180680535922269
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:24:QVDBgkwOVul8DbeQd3s5MCmCkcJF+DK+Obv:KwOVu2HXy5MCmCkcJFvRL
                                                                                                                                                                                                    MD5:40A6F317D17705B4D0241F4EBB45962D
                                                                                                                                                                                                    SHA1:42EBB0988124433B8F2A6E5D9A74ED41240BCFC6
                                                                                                                                                                                                    SHA-256:D93FB6D3451D1B82256B0E31AAE7850152FA5DF76F116A9D669AA4ACE6BB68B4
                                                                                                                                                                                                    SHA-512:E4C95F8F1354833F440672C0761CE1B4895DAA52E7F143A110533F978CC6C094847AEB66636EFA6DE74B0E900FBBE79A3CC21280C4063627CE8D259068084A3A
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:# Copyright (c) 2005, 2013, Oracle and/or its affiliates. All rights reserved..# ORACLE PROPRIETARY/CONFIDENTIAL. Use is subject to license terms..#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#..#.# Japanese imperial calendar.#.# Meiji since 1868-01-01 00:00:00 local time (Gregorian).# Taisho since 1912-07-30 00:00:00 local time (Gregorian).# Showa since 1926-12-25 00:00:00 local time (Gregorian).# Heisei since 1989-01-08 00:00:00 local time (Gregorian).calendar.japanese.type: LocalGregorianCalendar.calendar.japanese.eras: \..name=Meiji,abbr=M,since=-3218832000000; \..name=Taisho,abbr=T,since=-1812153600000; \..name=Showa,abbr=S,since=-1357603200000; \..name=Heisei,abbr=H,since=600220800000..#.# Taiwanese calendar.# Minguo since 1911-01-01 00:00:00 local time (Gregorian).calendar.taiwanese.type: LocalGregorianCalendar.calendar.taiwanese.eras: \..name=MinGuo,since=-1830384000000..#.# Thai Buddhist calendar.# Buddhist Era since -542-01-01 00:00:00 local time (Gregorian).calend

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\is-NC1K0.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Java archive data (JAR)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):381
                                                                                                                                                                                                    Entropy (8bit):4.93032180867977
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:6:5jqsKB4r/Rjqs2zbdy/oocj+sqX2K5YZ5/CUMQxxqsUm4xqs5gxmzbdGh/4:5j6GJj2q1cCvXPA/CUMQx6Yx2K/4
                                                                                                                                                                                                    MD5:728678963AC79F6B88BDD037DF2FD320
                                                                                                                                                                                                    SHA1:9A88662DED0D8A1B675FF33104CD82674B33488F
                                                                                                                                                                                                    SHA-256:4A404F9306E2C8AC89CA265FA8097A7A448B96E4D068AC04ADB94A8033700065
                                                                                                                                                                                                    SHA-512:A959B33A978C6E660A24501BA15B407C383A5DEC50C8F8AC84C365F2F7E17D07C8940E7D1F6E60BE593ED8A775098ECF3BA82A4C76ADC7B8153DBA1CD67BC76E
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK........F..I................META-INF/......PK..............PK........F..I................META-INF/MANIFEST.MF.M..LK-...K-*...R0.3..r.JM,IM.u.........+h..%&.*8.....%...k.r9....:.$..[).....&.%....E..r.\.E....y...r..PK.....k.......PK..........F..I..............................META-INF/....PK..........F..I...k.....................=...META-INF/MANIFEST.MFPK..........}.........

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\is-NI6PE.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Algol 68 source, ASCII text
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):4226
                                                                                                                                                                                                    Entropy (8bit):4.708892688554676
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:96:CYrYJDrYJ+RvJ3z3d9uGG7hPxTRnhTbraYfwE5DyK:CYrsDrsgvJ3z3buGG7LvSmhDz
                                                                                                                                                                                                    MD5:C677FF69E70DC36A67C72A3D7EF84D28
                                                                                                                                                                                                    SHA1:FBD61D52534CDD0C15DF332114D469C65D001E33
                                                                                                                                                                                                    SHA-256:B055BF25B07E5AC70E99B897FB8152F288769065B5B84387362BB9CC2E6C9D38
                                                                                                                                                                                                    SHA-512:32D82DAEDBCA1988282A3BF67012970D0EE29B16A7E52C1242234D88E0F3ED8AF9FC9D6699924D19D066FD89A2100E4E8898AAC67675D4CD9831B19B975ED568
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:Copyright (c) 2003, 2005, Oracle and/or its affiliates. All rights reserved...Redistribution and use in source and binary forms, with or without.modification, are permitted provided that the following conditions.are met:.. - Redistributions of source code must retain the above copyright. notice, this list of conditions and the following disclaimer... - Redistributions in binary form must reproduce the above copyright. notice, this list of conditions and the following disclaimer in the. documentation and/or other materials provided with the distribution... - Neither the name of Oracle nor the names of its. contributors may be used to endorse or promote products derived. from this software without specific prior written permission...THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS.IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,.THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR.PURPOSE ARE DISCLAIMED.

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\is-O8D3D.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Java archive data (JAR)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):1922800
                                                                                                                                                                                                    Entropy (8bit):6.073928479159945
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:12288:TXBgNkIq4CVJNVjWH5ISi1niQkxaUPoM9wD0:TRgNQ4gJ7WHKL10PotD0
                                                                                                                                                                                                    MD5:1943CC8BDF0710D934D132BC218594E3
                                                                                                                                                                                                    SHA1:125E28AC3C51D41D5368899D54D6AA35AFF3E504
                                                                                                                                                                                                    SHA-256:AA05772EC9568ED6874209D6C4E74ED85CA3771954D4952BA14E592D1DE534EB
                                                                                                                                                                                                    SHA-512:39D4C6E029A4D2B0D6DE78F10ECD9716CBC313E705B1E5F59E5312870BAA69D689360F45D451D22396B9154A3E971DB017367B8652BCDB61252CA16A772C444E
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK........)..I................META-INF/....PK........(..Iu/u*e...e.......META-INF/MANIFEST.MFManifest-Version: 1.0..Ant-Version: Apache Ant 1.7.1..Created-By: 25.121-b13 (Oracle Corporation)....PK........(..I................com/PK........(..I................com/sun/PK........(..I................com/sun/deploy/PK........(..I................com/sun/deploy/uitoolkit/PK........(..I................com/sun/deploy/uitoolkit/impl/PK........)..I............"...com/sun/deploy/uitoolkit/impl/awt/PK........(..I............#...com/sun/deploy/uitoolkit/impl/text/PK........(..I................com/sun/deploy/uitoolkit/ui/PK........(..I................com/sun/java/PK........(..I................com/sun/java/browser/PK........(..I................com/sun/java/browser/plugin2/PK........(..I............)...com/sun/java/browser/plugin2/liveconnect/PK........(..I............,...com/sun/java/browser/plugin2/liveconnect/v1/PK........(..I................netscape/PK........(..I................netscape/javascript/

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\is-PJ6AA.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):2455
                                                                                                                                                                                                    Entropy (8bit):4.47026133037931
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:48:EmdS5PQQL8pRNYHjVsnkYXxtOGh1xdvjMgxH:G9NL3HjVLG1XrM8H
                                                                                                                                                                                                    MD5:809C50033F825EFF7FC70419AAF30317
                                                                                                                                                                                                    SHA1:89DA8094484891F9EC1FA40C6C8B61F94C5869D0
                                                                                                                                                                                                    SHA-256:CE1688FE641099954572EA856953035B5188E2CA228705001368250337B9B232
                                                                                                                                                                                                    SHA-512:C5AA71AD9E1D17472644EB43146EDF87CAA7BCCF0A39E102E31E6C081CD017E01B39645F55EE87F4EA3556376F7CAD3953CE3F3301B4B3AF265B7B4357B67A5C
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:############################################################.# .Default Logging Configuration File.#.# You can use a different file by specifying a filename.# with the java.util.logging.config.file system property. .# For example java -Djava.util.logging.config.file=myfile.############################################################..############################################################.# .Global properties.############################################################..# "handlers" specifies a comma separated list of log Handler .# classes. These handlers will be installed during VM startup..# Note that these classes must be on the system classpath..# By default we only configure a ConsoleHandler, which will only.# show messages at the INFO and above levels..handlers= java.util.logging.ConsoleHandler..# To also add the FileHandler, use the following line instead..#handlers= java.util.logging.FileHandler, java.util.logging.ConsoleHandler..# Default global logging level..# This

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\is-QE3O1.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):10393
                                                                                                                                                                                                    Entropy (8bit):4.970762688893053
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:192:hPwn+Cyub3Ee4OECKDIcYOhAgZ50OKDQLT2IcpRuWRbHr9NRXUh/QTv9Ho39zPxq:5xzubEFOEscAW5VKsCfHz8RPxGt
                                                                                                                                                                                                    MD5:F8734590A1AEC97F6B22F08D1AD1B4BB
                                                                                                                                                                                                    SHA1:AA327A22A49967F4D74AFEEE6726F505F209692F
                                                                                                                                                                                                    SHA-256:7D51936FA3FD5812AE51F9F5657E0E70487DCA810B985607B6C5D6603F5E6C98
                                                                                                                                                                                                    SHA-512:72E62DC63DAA2591B48B2B774E2479B8861D159061B92FD3A0A06256295DA4D8B20DAFA77983FDBF6179F666F9FF6B3275F7A5BCF9555E638595230B9A42B177
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:#.#.# Copyright (c) 1999, Oracle and/or its affiliates. All rights reserved..# ORACLE PROPRIETARY/CONFIDENTIAL. Use is subject to license terms..#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#..#.#.PostScript printer property file for Java 2D printing..#.# WARNING: This is an internal implementation file, not a public file..# Any customisation or reliance on the existence of this file and its.# contents or syntax is discouraged and unsupported..# It may be incompatibly changed or removed without any notice..#.#.font.num=35.#.# Legacy logical font family names and logical font aliases should all.# map to the primary logical font names..#.serif=serif.times=serif.timesroman=serif.sansserif=sansserif.helvetica=sansserif.dialog=sansserif.dialoginput=monospaced.monospaced=monospaced.courier=monospaced.#.# Next, physical fonts which can be safely mapped to standard postscript fonts.# These keys generally map to a value which is the same as the key, so.# the key/value is just a way to say the font has

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\is-RK61R.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Java archive data (JAR)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):3036922
                                                                                                                                                                                                    Entropy (8bit):6.608043156167759
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:49152:Hci3hz1nV3t3pPEH8AFMQ0rVDnvvJ1lbI6/Xw:HciRzNHRUipn3vlbIR
                                                                                                                                                                                                    MD5:9E399D57C6042B4357090F6643AAAE19
                                                                                                                                                                                                    SHA1:DA2CCC9C4774035F09001947351F3D8EBC87FA48
                                                                                                                                                                                                    SHA-256:61176279D85EE7BF67910A47D58A04D178EF11BF3CC6A89077D65EA952E4CD27
                                                                                                                                                                                                    SHA-512:C701EB337C62862AA5075D1BBD39BF5CABC539BBC7407F8096020265970F8C695509A2AC798FE1AB29274C88F650E9D3804D7ADD11EB758D56CED1C01C65CA58
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK........F..I................META-INF/....PK........F..I<:S1D...D.......META-INF/MANIFEST.MFManifest-Version: 1.0..Created-By: 1.7.0_07 (Oracle Corporation)....PK...........I./..............sun/nio/cs/ext/Big5.class.......4....]..c..d............................................................................................................................................................................................................................................................................................................... !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~...........................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\is-U1LGF.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):2796
                                                                                                                                                                                                    Entropy (8bit):5.182793663606788
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:48:R8s89HoIbTUjbyuJdI2FylXLr96cpcnnI0adbEk+IqdouZ:y56CiPFylXLrMGyJU+B
                                                                                                                                                                                                    MD5:7C5514B805B4A954BC55D67B44330C69
                                                                                                                                                                                                    SHA1:56ED1C661EEEDE17B4FAE8C9DE7B5EDBAD387ABC
                                                                                                                                                                                                    SHA-256:0C790DE696536165913685785EA8CBE1AC64ACF09E2C8D92D802083A6DA09393
                                                                                                                                                                                                    SHA-512:CCD4CB61C95DEFDCBA6A6A3F898C29A64CD5831A8AB50E0AFAC32ADB6A9E0C4A4BA37EB6DEE147830DA33AE0B2067473132C0B91A21D546A6528F42267A2C40E
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:#.#.# Copyright (c) 1996, 2000, Oracle and/or its affiliates. All rights reserved..# ORACLE PROPRIETARY/CONFIDENTIAL. Use is subject to license terms..#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#..#.#.Japanese PostScript printer property file.#.font.num=16.#.serif=serif.timesroman=serif.sansserif=sansserif.helvetica=sansserif.monospaced=monospaced.courier=monospaced.dialog=sansserif.dialoginput=monospaced.#.serif.latin1.plain=Times-Roman.serif.latin1.italic=Times-Italic.serif.latin1.bolditalic=Times-BoldItalic.serif.latin1.bold=Times-Bold.#.sansserif.latin1.plain=Helvetica.sansserif.latin1.italic=Helvetica-Oblique.sansserif.latin1.bolditalic=Helvetica-BoldOblique.sansserif.latin1.bold=Helvetica-Bold.#.monospaced.latin1.plain=Courier.monospaced.latin1.italic=Courier-Oblique.monospaced.latin1.bolditalic=Courier-BoldOblique.monospaced.latin1.bold=Courier-Bold.#.serif.x11jis0208.plain=Ryumin-Light-H.serif.x11jis0208.italic=Ryumin-Light-H.serif.x11jis0208.bolditalic=Ryumin-Light-H.serif.x11jis

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\is-UGLIC.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Java archive data (JAR)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):54502207
                                                                                                                                                                                                    Entropy (8bit):6.044705261592451
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:196608:GSyg1BSlKOJe3CpWXRaBrMimgm1emr5D9/J06QKx6Pb/E+Z9vLojk:GW1BSl3eyYb1emr5D9/J06QKx6Pb/NL
                                                                                                                                                                                                    MD5:9D2CC16B7B6EE2B7F8491C0EE1091A53
                                                                                                                                                                                                    SHA1:F5004FF798FDF1B9F8A30C4406D8F125FD5FAE8D
                                                                                                                                                                                                    SHA-256:B6E20407C6DC19700E0442ABBF7698E38F476381518314592C108C524BD0C1C0
                                                                                                                                                                                                    SHA-512:26E708372A431B21BA0FF27DE0210D70AA6A9ED0DA671B7077ABA60D19C9F153924EE43581A9C544F241462B81ADCE47005F5726147BF6A165B6CB453D9E21D8
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK........N..I................META-INF/....PK........N..In].W%...%.......META-INF/MANIFEST.MFManifest-Version: 1.0..Implementation-Vendor: Oracle Corporation..Implementation-Title: Java Runtime Environment..Implementation-Version: 1.8.0_121..Specification-Vendor: Oracle Corporation..Created-By: 1.7.0_07 (Oracle Corporation)..Specification-Title: Java Platform API Specification..Specification-Version: 1.8....Name: javax/swing/JCheckBoxMenuItem.class..Java-Bean: True....Name: javax/swing/JDialog.class..Java-Bean: True....Name: javax/swing/JSlider.class..Java-Bean: True....Name: javax/swing/JTextField.class..Java-Bean: True....Name: javax/swing/JTextPane.class..Java-Bean: True....Name: javax/swing/JTextArea.class..Java-Bean: True....Name: javax/swing/JList.class..Java-Bean: True....Name: javax/swing/JFormattedTextField.class..Java-Bean: True....Name: javax/swing/JApplet.class..Java-Bean: True....Name: javax/swing/JSpinner.class..Java-Bean: True....Name: javax/swing/JLabel.class..Java-Bean

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\is-USBCE.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):56
                                                                                                                                                                                                    Entropy (8bit):4.449513850319965
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:CEBqRM9LTAGQdLVv8TEBqRM9LHQIuHPv:CEAsnAbL2TrszQdv
                                                                                                                                                                                                    MD5:84EC66A3163A4E004D3CBB33ABC66A7F
                                                                                                                                                                                                    SHA1:5E44120C90E96834AF6975ECD96AF7FB79650043
                                                                                                                                                                                                    SHA-256:58775D98044963C6875FAF7B5DDE64372699352E39EE9A23D8995C595E613005
                                                                                                                                                                                                    SHA-512:217DB29C11C05EF37E9475704D74E8E8B4CEF7EA0DF0D225D71655999A3E265EC9576E46F81DDFFF004CB201A6269D0E1F60E5AEAEF9437D394DF0C3C61A8126
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:javafx.runtime.version=8.0.121.javafx.runtime.build=b13.

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\is-VGJ33.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):5548
                                                                                                                                                                                                    Entropy (8bit):5.037985807321917
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:96:r45Vf4fq7MBzO4pYEZ2MQ6KXr3NO0slzMX+W1CuHvvABbiAQ+xaW/ioLHTU+Wsch:r4KJO4mEZ2MQ6Cr3NO0slzMX+WIuHvvv
                                                                                                                                                                                                    MD5:F507712B379FDC5A8D539811FAF51D02
                                                                                                                                                                                                    SHA1:82BB25303CF6835AC4B076575F27E8486DAB9511
                                                                                                                                                                                                    SHA-256:46F47B3883C7244A819AE1161113FE9D2375F881B75C9B3012D7A6B3497E030A
                                                                                                                                                                                                    SHA-512:CB3C99883336D04C42CEA9C2401E81140ECBB7FC5B8EF3301B13268A45C1AC93FD62176AB8270B91528AC8E938C7C90CC9663D8598E224794354546139965DFE
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:#sun.net.www MIME content-types table.#.# Property fields:.#.# <description> ::= 'description' '=' <descriptive string>.# <extensions> ::= 'file_extensions' '=' <comma-delimited list, include '.'>.# <image> ::= 'icon' '=' <filename of icon image>.# <action> ::= 'browser' | 'application' | 'save' | 'unknown'.# <application> ::= 'application' '=' <command line template>.#..#.# The "we don't know anything about this data" type(s)..# Used internally to mark unrecognized types..#.content/unknown: description=Unknown Content.unknown/unknown: description=Unknown Data Type..#.# The template we should use for temporary files when launching an application.# to view a document of given type..#.temp.file.template: c:\\temp\\%s..#.# The "real" types..#.application/octet-stream: \..description=Generic Binary Stream;\..file_extensions=.saveme,.dump,.hqx,.arc,.obj,.lib,.bin,.exe,.zip,.gz..application/oda: \..description=ODA Document;\..file_extensions=.oda..application/pdf: \..de

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\javafx.properties (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):56
                                                                                                                                                                                                    Entropy (8bit):4.449513850319965
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:CEBqRM9LTAGQdLVv8TEBqRM9LHQIuHPv:CEAsnAbL2TrszQdv
                                                                                                                                                                                                    MD5:84EC66A3163A4E004D3CBB33ABC66A7F
                                                                                                                                                                                                    SHA1:5E44120C90E96834AF6975ECD96AF7FB79650043
                                                                                                                                                                                                    SHA-256:58775D98044963C6875FAF7B5DDE64372699352E39EE9A23D8995C595E613005
                                                                                                                                                                                                    SHA-512:217DB29C11C05EF37E9475704D74E8E8B4CEF7EA0DF0D225D71655999A3E265EC9576E46F81DDFFF004CB201A6269D0E1F60E5AEAEF9437D394DF0C3C61A8126
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:javafx.runtime.version=8.0.121.javafx.runtime.build=b13.

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\javaws.jar (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Java archive data (JAR)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):940401
                                                                                                                                                                                                    Entropy (8bit):5.941429591733856
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:6144:FsOC+XLhcw5j2roNPyA/E0EileuX6cm50e727858oSsSHO0ThdTfJDJhEv0IrtZU:3XLTzNPyH7iUvk8XIvfH
                                                                                                                                                                                                    MD5:26DE149A64BC2B19399F971EC93CD360
                                                                                                                                                                                                    SHA1:31FE4E00F8868DE92BD8B4F102A8E290B294723B
                                                                                                                                                                                                    SHA-256:37F5964DE0BCF37C5E1E3A4B8BB3F494F314D96BC2C5DE071CB69749D77D45F5
                                                                                                                                                                                                    SHA-512:798705C731773D49B8F8C151CE1551D1B53995F9606C353F16CBE0D7777DF276FC44F6CDE6D8BB6D89E8F09479CC4F355E34752824766CF40B8DA3E7CE275247
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK.........I................META-INF/....PK.........Iu/u*e...e.......META-INF/MANIFEST.MFManifest-Version: 1.0..Ant-Version: Apache Ant 1.7.1..Created-By: 25.121-b13 (Oracle Corporation)....PK.........I................com/PK.........I................com/sun/PK.........I................com/sun/javaws/PK.........I................com/sun/javaws/exceptions/PK.........I................com/sun/javaws/jnl/PK.........I................com/sun/javaws/net/PK.........I................com/sun/javaws/net/protocol/PK.........I............ ...com/sun/javaws/net/protocol/jar/PK.........I................com/sun/javaws/progress/PK.........I................com/sun/javaws/security/PK.........I................com/sun/javaws/ui/PK.........I................com/sun/javaws/util/PK.........I................com/sun/jnlp/PK.........I................javax/PK.........I................javax/jnlp/PK.........I.T..........#...com/sun/javaws/BrowserSupport.class.......1.&...()V...()Z..

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\jce.jar (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v2.0 to extract, compression method=deflate
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):116446
                                                                                                                                                                                                    Entropy (8bit):7.914039236098481
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:v47Ovr7VDo5Zd5UVokTTNeMAgGHuyCTCK:A0DqZdWBo7DH7CX
                                                                                                                                                                                                    MD5:70EB04D21D1639B5D92165CD9D3940BA
                                                                                                                                                                                                    SHA1:D958ADAC5F1EDEFA22045A1409CCDEFF154779C1
                                                                                                                                                                                                    SHA-256:15C40DB7AB18423A7B653B64033D4639A8BA5F201C20232C6F5DCE0102887231
                                                                                                                                                                                                    SHA-512:2124AD54B1B10CBAF9E06BCC63CF8B2B8479B9787BE5CA94F425B0A506C3722A11C68A073718B9F57B6AC9B84CA87BA2838E843C0536FB0769BA64F2A2BD4B58
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK.........D.I................META-INF/MANIFEST.MF.Y..X..Y.C,j...B.Tfo.$1...6m..Y........L..o%...q.....Kr.$.M...u..../..._.{..;(Z.]>.f$m..x...}..M...).....~z..a.....;.....~.&..'....xQj....U.UY.}...^...........+.y.{...m....*....}..-(^..&.......w............9..-vo...........]...~.......S....Z'.b..&......m...%....7:..k...m......L%..gZU.G...;.P.k.Fz......+.:ps.(^..v.F.b..,s./t.*...(G..D.\.{D.....u....9...K?..0....@.a..b@..=.....xD..Y_....]e.71.R.5L..s*.bP..`.?Y..h...qC...l.r...9tH.PM...1k ..Z.?.n...??..=i^s.).zZ3....wl.udl...w..L.._.x..'..K.....j.....[4...eL.<_l. f".y.xh.... .....'..B....,..i.n.t....+...(.nu.m.6..@)W..q..w....6.2..kT.]...^%k.Y....).QS..q.{.1..A..d.pN.nPZ.]?.O}..3(>.U.1..u..N...p.....>H...t.S....m ..............j.zZ....j....|.M*.o...E..~W'..%..A....3.F..Oy.h.V..2.....&.42.d.A]....).8..U..h..^-q.K.+WI'....QS.u.n.......N..&...)......Z.5......A.O..~y.5.....-.=...B.w.b.yo...... ...!..5.y...Z........')s.d"t~=.o(E..`.N.h...

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\jfr.jar (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Java archive data (JAR)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):560581
                                                                                                                                                                                                    Entropy (8bit):5.782377075193269
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:12288:I5l+qU67FYWg+YWgYWeoXqgYSq8eh2f/m5NwaHkSIJHvWQ6Q7ooMcgH5lY7TQ5c5:I5l+qU67FYWg+YWgYWeoXqgYSq8eh2fV
                                                                                                                                                                                                    MD5:82B8130E364676524FDCA151D851F1BF
                                                                                                                                                                                                    SHA1:637F477B6E1A531127230BAD5B4DC7E2A971F467
                                                                                                                                                                                                    SHA-256:673753ED33C51CCFC6234A36526C5C52AD1A9DF7D873604E6250AAA88C909261
                                                                                                                                                                                                    SHA-512:F27E5F28D51D97CE86FF3A053633DFF69E1CD2D9E7F989B388777C566DA34E0C708E259DD654F4147A8C14660FD82178545A9EDC4C481094F417E848CBBC7E9B
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK........F..I................META-INF/....PK........F..I.@"T>...>.......META-INF/MANIFEST.MFManifest-Version: 1.0..Implementation-Vendor: Oracle Corporation..Implementation-Title: Java Runtime Environment..Implementation-Version: 1.8.0_121..Specification-Vendor: Oracle Corporation..Created-By: 1.7.0_07 (Oracle Corporation)..Specification-Title: Java Platform API Specification..Specification-Version: 1.8....PK...........IB.<>^...^...8...com/oracle/jrockit/jfr/client/EventSettingsBuilder.class.......4....5.f..g....f..4.h..4.i..j....f..4.k..l....m..4.n..o....f..4.p..q..r....f....s....t....u....v..w..x..y....z..{....|....}....~.................................#.........................)...................................................eventDefaultSets...Ljava/util/ArrayList;...Signature..DLjava/util/ArrayList<Loracle/jrockit/jfr/settings/EventDefaultSet;>;...settings..ALjava/util/ArrayList<Loracle/jrockit/jfr/settings/EventSetting;>;...eventDescriptorType..2Loracle/jrockit/jfr/openmbean/

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\jfr\default.jfc (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:XML 1.0 document, ASCII text
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):20109
                                                                                                                                                                                                    Entropy (8bit):4.571267855712911
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:192:/JA1ySPBhRt0ng3Ca66LAsmztuxqCbCdCsCNG2ixzTi5OAdzAMzVdWVqGKxtOym+:/J4yS5zaaedc2FMhV
                                                                                                                                                                                                    MD5:41D5CD8DB1F75101304308A9EE3612FF
                                                                                                                                                                                                    SHA1:1A64B68D0E7D43F8149FABA94440BE54F4F24527
                                                                                                                                                                                                    SHA-256:0C8CD372C548E4DDCBB0FA8CD6FCA09D65EC312D784F495BE19BAF1BF06C57F3
                                                                                                                                                                                                    SHA-512:77D752A9C8ADC5C5D4F2AFAA158B0D105A172426CDD0F2D17EACDA5F6572CE4FD76CA6B142588BF8FCF69BB41FC1141F3808ECB40FD54F0F45944691D8CC2E2E
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:<?xml version="1.0" encoding="UTF-8"?>.. . Recommended way to edit .jfc files is to use Java Mission Control,. see Window -> Flight Recorder Template Manager..-->..<configuration version="1.0" name="Continuous" description="Low overhead configuration safe for continuous use in production environments, typically less than 1 % overhead." provider="Oracle">.. <producer uri="http://www.oracle.com/hotspot/jvm/" label="Oracle JDK">.. <control>.. . Contents of the control element is not read by the JVM, it's used. by Java Mission Control to change settings that carry the control attribute.. -->.. <selection name="gc-level" default="detailed" label="Garbage Collector">. <option label="Off" name="off">off</option>. <option label="Normal" name="detailed">normal</option>. <option label="All" name="all">all</option>. </selection>.. <condition name="gc-enabled-normal" true="true" false="false">. <or>.

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\jfr\is-2LI2M.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:XML 1.0 document, ASCII text
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):20109
                                                                                                                                                                                                    Entropy (8bit):4.571267855712911
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:192:/JA1ySPBhRt0ng3Ca66LAsmztuxqCbCdCsCNG2ixzTi5OAdzAMzVdWVqGKxtOym+:/J4yS5zaaedc2FMhV
                                                                                                                                                                                                    MD5:41D5CD8DB1F75101304308A9EE3612FF
                                                                                                                                                                                                    SHA1:1A64B68D0E7D43F8149FABA94440BE54F4F24527
                                                                                                                                                                                                    SHA-256:0C8CD372C548E4DDCBB0FA8CD6FCA09D65EC312D784F495BE19BAF1BF06C57F3
                                                                                                                                                                                                    SHA-512:77D752A9C8ADC5C5D4F2AFAA158B0D105A172426CDD0F2D17EACDA5F6572CE4FD76CA6B142588BF8FCF69BB41FC1141F3808ECB40FD54F0F45944691D8CC2E2E
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:<?xml version="1.0" encoding="UTF-8"?>.. . Recommended way to edit .jfc files is to use Java Mission Control,. see Window -> Flight Recorder Template Manager..-->..<configuration version="1.0" name="Continuous" description="Low overhead configuration safe for continuous use in production environments, typically less than 1 % overhead." provider="Oracle">.. <producer uri="http://www.oracle.com/hotspot/jvm/" label="Oracle JDK">.. <control>.. . Contents of the control element is not read by the JVM, it's used. by Java Mission Control to change settings that carry the control attribute.. -->.. <selection name="gc-level" default="detailed" label="Garbage Collector">. <option label="Off" name="off">off</option>. <option label="Normal" name="detailed">normal</option>. <option label="All" name="all">all</option>. </selection>.. <condition name="gc-enabled-normal" true="true" false="false">. <or>.

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\jfr\is-EJNTQ.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:XML 1.0 document, ASCII text
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):20065
                                                                                                                                                                                                    Entropy (8bit):4.570942254721535
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:192:/fA1ypPOdhJt0ng3Ca66L0smztuxqHbHdHsHNG2iYzT95OAdzAMzVdWVqGKxtOyh:/f4ypy3aamd79Mbhh
                                                                                                                                                                                                    MD5:8B5C309810D64A8C62E7CDC6436F97A9
                                                                                                                                                                                                    SHA1:5D7D08A595F76322C51AE43EA966FBBA6B69EEBE
                                                                                                                                                                                                    SHA-256:F70E4C858A96603DE6C042EA796300C232953AAB17579FF4E7A47FE9FFE17C26
                                                                                                                                                                                                    SHA-512:D28DF53CD060853E2BC8EE7FC1384D2E2FA5B9C38D1C4AF19B9E13FE89E130262231C76CE656D4A7FBBBE4B893F3DCEC1D2BE56562A5BA65C4306673FBC49F0F
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:<?xml version="1.0" encoding="UTF-8"?>.. . Recommended way to edit .jfc files is to use Java Mission Control,. see Window -> Flight Recorder Template Manager..-->..<configuration version="1.0" name="Profiling" description="Low overhead configuration for profiling, typically around 2 % overhead." provider="Oracle">.. <producer uri="http://www.oracle.com/hotspot/jvm/" label="Oracle JDK">.. <control>.. . Contents of the control element is not read by the JVM, it's used. by Java Mission Control to change settings that carry the control attribute.. -->.. <selection name="gc-level" default="detailed" label="Garbage Collector">. <option label="Off" name="off">off</option>. <option label="Normal" name="detailed">normal</option>. <option label="All" name="all">all</option>. </selection>.. <condition name="gc-enabled-normal" true="true" false="false">. <or>. <test name="gc-level" operator="equal"

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\jfr\profile.jfc (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:XML 1.0 document, ASCII text
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):20065
                                                                                                                                                                                                    Entropy (8bit):4.570942254721535
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:192:/fA1ypPOdhJt0ng3Ca66L0smztuxqHbHdHsHNG2iYzT95OAdzAMzVdWVqGKxtOyh:/f4ypy3aamd79Mbhh
                                                                                                                                                                                                    MD5:8B5C309810D64A8C62E7CDC6436F97A9
                                                                                                                                                                                                    SHA1:5D7D08A595F76322C51AE43EA966FBBA6B69EEBE
                                                                                                                                                                                                    SHA-256:F70E4C858A96603DE6C042EA796300C232953AAB17579FF4E7A47FE9FFE17C26
                                                                                                                                                                                                    SHA-512:D28DF53CD060853E2BC8EE7FC1384D2E2FA5B9C38D1C4AF19B9E13FE89E130262231C76CE656D4A7FBBBE4B893F3DCEC1D2BE56562A5BA65C4306673FBC49F0F
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:<?xml version="1.0" encoding="UTF-8"?>.. . Recommended way to edit .jfc files is to use Java Mission Control,. see Window -> Flight Recorder Template Manager..-->..<configuration version="1.0" name="Profiling" description="Low overhead configuration for profiling, typically around 2 % overhead." provider="Oracle">.. <producer uri="http://www.oracle.com/hotspot/jvm/" label="Oracle JDK">.. <control>.. . Contents of the control element is not read by the JVM, it's used. by Java Mission Control to change settings that carry the control attribute.. -->.. <selection name="gc-level" default="detailed" label="Garbage Collector">. <option label="Off" name="off">off</option>. <option label="Normal" name="detailed">normal</option>. <option label="All" name="all">all</option>. </selection>.. <condition name="gc-enabled-normal" true="true" false="false">. <or>. <test name="gc-level" operator="equal"

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\jfxswt.jar (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Java archive data (JAR)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):33932
                                                                                                                                                                                                    Entropy (8bit):7.931081673680949
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:768:SYqnDGqkm6VqjSe/SARvN9kqizgYoojhxQYuWnQ:SYcDhkK/ntNIzB5jhxYmQ
                                                                                                                                                                                                    MD5:43D259C81E99F7376A55FF91A30E1B23
                                                                                                                                                                                                    SHA1:764F248A819635778826E3CE6316F1E8FEA14885
                                                                                                                                                                                                    SHA-256:C6918F1BBFC05A05F2D4C9ECD328D4DABBE0D44930A721679DB7A65482684991
                                                                                                                                                                                                    SHA-512:41B5FCB46915BDE35517B11FB74E83E4525600E0BCB3FE1C4BD122FF5C240514CCBDE3882136E7DB1F692DEFE23B715D3EB45E1031E7E2927BDDF7F2267EB496
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK........w_.I................META-INF/....PK........v_.I.E..Z...g.......META-INF/MANIFEST.MF.M..LK-...K-*...R0.3..r.C.q,HL.HU...%-..x...R.KRSt.*A.-...M.t....4....sR......K..5y.x..PK........,Z.I................javafx/PK........,Z.I................javafx/embed/PK........,Z.I................javafx/embed/swt/PK........+Z.Ij...........%...javafx/embed/swt/CustomTransfer.class.T[S.F.=.MX(..!............8..`h.d....." yd..........4....%..k.N..ka.83..[.....|+...........#.OD..1...1.1.S1....*>..I..TL.....Y..*.S.q.-KAja..6.M.Y7V|.v...e............+...u...Z.....Z......k...O.v.....x..f...M.v...~I....j.N.(.R.... ..n.%).l:.N..,J...-.%.os:.v.K..V.._p.u.l..e...S5...^.....3+.Yy.h.RtGR..y.)..~...g..R.;5K...{.G.*..X.JP....D....8..[3.g...'d.e#Z.|c.j.t..F.w..t.W.j.,K[q.^..E.=M.a..6d.Z..yV.....=..........:.WG.............RA.<......qT...,*.=.....t\......(aI.2.....!..Jp.,..<.x..n.S....N.K.e.W....N.-..`....hmQ.E.fGE..$..n...4I{.......l_.)......?.Z>...t

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\jsse.jar (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Java archive data (JAR)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):583111
                                                                                                                                                                                                    Entropy (8bit):6.068399869771197
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:6144:HAkbJvIQLuITUuIUcV1dfYv96YBv6HZYvs1CEtrM4:gyhUTVr++H3E4
                                                                                                                                                                                                    MD5:D33FBBA48EBC1582FC2D837204BBF4E5
                                                                                                                                                                                                    SHA1:BFFA5634E34890A3B59F785EFE839FB32E28ADB3
                                                                                                                                                                                                    SHA-256:EBCEC97EAFC3DE1DF287B12D44718DC9E17F204869B2E3F47372D773348049CC
                                                                                                                                                                                                    SHA-512:D174E15908751FBF692635B5B35AC5616A7857E6649E15F72B79EEE992136E040364AF8E5DC7BE11E787622FE5AFFF57FBE12EC7B7ECC22A9ADA2560AB430C4D
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK........G..I................META-INF/....PK........G..I.@"T>...>.......META-INF/MANIFEST.MFManifest-Version: 1.0..Implementation-Vendor: Oracle Corporation..Implementation-Title: Java Runtime Environment..Implementation-Version: 1.8.0_121..Specification-Vendor: Oracle Corporation..Created-By: 1.7.0_07 (Oracle Corporation)..Specification-Title: Java Platform API Specification..Specification-Version: 1.8....PK...........I`..b........+...com/sun/net/ssl/internal/ssl/Provider.class.......4.....()V...()Z...<init>...J..%com/sun/net/ssl/internal/ssl/Provider...install...isFIPS...serialVersionUID...sun/security/ssl/SunJSSE.,..c".J-.........(Ljava/lang/String;)V...(Ljava/security/Provider;)V...........................................Code...ConstantValue.1................................................*..............................*+..............................*+.........).............................)...........................PK...........I3.2........;...com/sun/net/ssl/internal/ssl/X50

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\jvm.hprof.txt (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Algol 68 source, ASCII text
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):4226
                                                                                                                                                                                                    Entropy (8bit):4.708892688554676
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:96:CYrYJDrYJ+RvJ3z3d9uGG7hPxTRnhTbraYfwE5DyK:CYrsDrsgvJ3z3buGG7LvSmhDz
                                                                                                                                                                                                    MD5:C677FF69E70DC36A67C72A3D7EF84D28
                                                                                                                                                                                                    SHA1:FBD61D52534CDD0C15DF332114D469C65D001E33
                                                                                                                                                                                                    SHA-256:B055BF25B07E5AC70E99B897FB8152F288769065B5B84387362BB9CC2E6C9D38
                                                                                                                                                                                                    SHA-512:32D82DAEDBCA1988282A3BF67012970D0EE29B16A7E52C1242234D88E0F3ED8AF9FC9D6699924D19D066FD89A2100E4E8898AAC67675D4CD9831B19B975ED568
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:Copyright (c) 2003, 2005, Oracle and/or its affiliates. All rights reserved...Redistribution and use in source and binary forms, with or without.modification, are permitted provided that the following conditions.are met:.. - Redistributions of source code must retain the above copyright. notice, this list of conditions and the following disclaimer... - Redistributions in binary form must reproduce the above copyright. notice, this list of conditions and the following disclaimer in the. documentation and/or other materials provided with the distribution... - Neither the name of Oracle nor the names of its. contributors may be used to endorse or promote products derived. from this software without specific prior written permission...THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS.IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,.THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR.PURPOSE ARE DISCLAIMED.

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\logging.properties (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):2455
                                                                                                                                                                                                    Entropy (8bit):4.47026133037931
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:48:EmdS5PQQL8pRNYHjVsnkYXxtOGh1xdvjMgxH:G9NL3HjVLG1XrM8H
                                                                                                                                                                                                    MD5:809C50033F825EFF7FC70419AAF30317
                                                                                                                                                                                                    SHA1:89DA8094484891F9EC1FA40C6C8B61F94C5869D0
                                                                                                                                                                                                    SHA-256:CE1688FE641099954572EA856953035B5188E2CA228705001368250337B9B232
                                                                                                                                                                                                    SHA-512:C5AA71AD9E1D17472644EB43146EDF87CAA7BCCF0A39E102E31E6C081CD017E01B39645F55EE87F4EA3556376F7CAD3953CE3F3301B4B3AF265B7B4357B67A5C
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:############################################################.# .Default Logging Configuration File.#.# You can use a different file by specifying a filename.# with the java.util.logging.config.file system property. .# For example java -Djava.util.logging.config.file=myfile.############################################################..############################################################.# .Global properties.############################################################..# "handlers" specifies a comma separated list of log Handler .# classes. These handlers will be installed during VM startup..# Note that these classes must be on the system classpath..# By default we only configure a ConsoleHandler, which will only.# show messages at the INFO and above levels..handlers= java.util.logging.ConsoleHandler..# To also add the FileHandler, use the following line instead..#handlers= java.util.logging.FileHandler, java.util.logging.ConsoleHandler..# Default global logging level..# This

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\management-agent.jar (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Java archive data (JAR)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):381
                                                                                                                                                                                                    Entropy (8bit):4.93032180867977
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:6:5jqsKB4r/Rjqs2zbdy/oocj+sqX2K5YZ5/CUMQxxqsUm4xqs5gxmzbdGh/4:5j6GJj2q1cCvXPA/CUMQx6Yx2K/4
                                                                                                                                                                                                    MD5:728678963AC79F6B88BDD037DF2FD320
                                                                                                                                                                                                    SHA1:9A88662DED0D8A1B675FF33104CD82674B33488F
                                                                                                                                                                                                    SHA-256:4A404F9306E2C8AC89CA265FA8097A7A448B96E4D068AC04ADB94A8033700065
                                                                                                                                                                                                    SHA-512:A959B33A978C6E660A24501BA15B407C383A5DEC50C8F8AC84C365F2F7E17D07C8940E7D1F6E60BE593ED8A775098ECF3BA82A4C76ADC7B8153DBA1CD67BC76E
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK........F..I................META-INF/......PK..............PK........F..I................META-INF/MANIFEST.MF.M..LK-...K-*...R0.3..r.JM,IM.u.........+h..%&.*8.....%...k.r9....:.$..[).....&.%....E..r.\.E....y...r..PK.....k.......PK..........F..I..............................META-INF/....PK..........F..I...k.....................=...META-INF/MANIFEST.MFPK..........}.........

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\management\is-1J0SC.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):2856
                                                                                                                                                                                                    Entropy (8bit):4.492265087792545
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:48:MGS+Hpamow7YNkjP9YZAuFovuAnNpG1GMV/BWEUHXYE9nN6k5:Mdm7RT9tvuAnujaE0rN6g
                                                                                                                                                                                                    MD5:7B46C291E7073C31D3CE0ADAE2F7554F
                                                                                                                                                                                                    SHA1:C1E0F01408BF20FBBB8B4810520C725F70050DB5
                                                                                                                                                                                                    SHA-256:3D83E336C9A24D09A16063EA1355885E07F7A176A37543463596B5DB8D82F8FA
                                                                                                                                                                                                    SHA-512:D91EEBC8F30EDCE1A7E16085EB1B18CFDDF0566EFAB174BBCA53DE453EE36DFECB747D401E787A4D15CC9798E090E19A8A0CF3FC8246116CE507D6B464068CDB
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:# ----------------------------------------------------------------------.# Template for jmxremote.password.#.# o Copy this template to jmxremote.password.# o Set the user/password entries in jmxremote.password.# o Change the permission of jmxremote.password to read-only.# by the owner..#.# See below for the location of jmxremote.password file..# ----------------------------------------------------------------------..##############################################################.# Password File for Remote JMX Monitoring.##############################################################.#.# Password file for Remote JMX API access to monitoring. This.# file defines the different roles and their passwords. The access.# control file (jmxremote.access by default) defines the allowed.# access for each role. To be functional, a role must have an entry.# in both the password and the access files..#.# Default location of this file is $JRE/lib/management/jmxremote.password.# You

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\management\is-3PPS0.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):14630
                                                                                                                                                                                                    Entropy (8bit):4.568210341404396
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:Fqsmpsj42wbZTHV+Dq3xtP3xPqaNC/R1a:wsmpsjL0ZTHV++3xtpi68Xa
                                                                                                                                                                                                    MD5:5EDB0D3275263013F0981FF0DF96F87E
                                                                                                                                                                                                    SHA1:E0451D8D7D9E84D7B1C39EC7D00993307A5CBBF1
                                                                                                                                                                                                    SHA-256:3A923735D9C2062064CD8FD30FF8CCA84D0BC0AB5A8FAB80FDAD3155C0E3A380
                                                                                                                                                                                                    SHA-512:F31A3802665F9BB1A00A0F838B94AE4D9F1B9D6284FAF626EBE4F96819E24494771A1B8BFE655FD2DA202C5463D47BAE3B2391764E6F4C5867C0337AA21C87C1
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:#####################################################################.#.Default Configuration File for Java Platform Management.#####################################################################.#.# The Management Configuration file (in java.util.Properties format).# will be read if one of the following system properties is set:.# -Dcom.sun.management.jmxremote.port=<port-number>.# or -Dcom.sun.management.snmp.port=<port-number>.# or -Dcom.sun.management.config.file=<this-file>.#.# The default Management Configuration file is:.#.# $JRE/lib/management/management.properties.#.# Another location for the Management Configuration File can be specified.# by the following property on the Java command line:.#.# -Dcom.sun.management.config.file=<this-file>.#.# If -Dcom.sun.management.config.file=<this-file> is set, the port.# number for the management agent can be specified in the config file.# using the following lines:.#.# ################ Management Agent Port ################

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\management\is-6AVFM.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):3998
                                                                                                                                                                                                    Entropy (8bit):4.420205717459709
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:96:OWi7j79eK8MCN/xK4ijnv+wtosJj/D9mQyZWZuQgQX+dv:OWiv7b8rNXE+wusxr9m5WZuVDv
                                                                                                                                                                                                    MD5:F63BEA1F4A31317F6F061D83215594DF
                                                                                                                                                                                                    SHA1:21200EAAD898BA4A2A8834A032EFB6616FABB930
                                                                                                                                                                                                    SHA-256:439158EB513525FEDA19E0E4153CCF36A08FE6A39C0C6CEEB9FCEE86899DD33C
                                                                                                                                                                                                    SHA-512:DE49913B8FA2593DC71FF8DAC85214A86DE891BEDEE0E4C5A70FCDD34E605F8C5C8483E2F1BDB06E1001F7A8CF3C86CAD9FA575DE1A4DC466E0C8FF5891A2773
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:######################################################################.# Default Access Control File for Remote JMX(TM) Monitoring.######################################################################.#.# Access control file for Remote JMX API access to monitoring..# This file defines the allowed access for different roles. The.# password file (jmxremote.password by default) defines the roles and their.# passwords. To be functional, a role must have an entry in.# both the password and the access files..#.# The default location of this file is $JRE/lib/management/jmxremote.access.# You can specify an alternate location by specifying a property in .# the management config file $JRE/lib/management/management.properties.# (See that file for details).#.# The file format for password and access files is syntactically the same.# as the Properties file format. The syntax is described in the Javadoc.# for java.util.Properties.load..# A typical access file has multiple lines, where each

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\management\is-6SORG.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):3376
                                                                                                                                                                                                    Entropy (8bit):4.371600962667748
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:48:MkX7W6+IX6XXZAHAvuAn97+onkFOqRCjEhd//SVBteM8hq/unuxsIsxuEAJw2n:MU6bpjvuAnEokSIU/uuxJn
                                                                                                                                                                                                    MD5:71A7DE7DBE2977F6ECE75C904D430B62
                                                                                                                                                                                                    SHA1:2E9F9AC287274532EB1F0D1AFCEFD7F3E97CC794
                                                                                                                                                                                                    SHA-256:F1DC97DA5A5D220ED5D5B71110CE8200B16CAC50622B33790BB03E329C751CED
                                                                                                                                                                                                    SHA-512:3A46E2A4E8A78B190260AFE4EEB54E7D631DB50E6776F625861759C0E0BC9F113E8CD8D734A52327C28608715F6EB999A3684ABD83EE2970274CE04E56CA1527
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:# ----------------------------------------------------------------------.# Template for SNMP Access Control List File.#.# o Copy this template to snmp.acl.# o Set access control for SNMP support.# o Change the permission of snmp.acl to be read-only.# by the owner..#.# See below for the location of snmp.acl file..# ----------------------------------------------------------------------..############################################################.# SNMP Access Control List File .############################################################.#.# Default location of this file is $JRE/lib/management/snmp.acl..# You can specify an alternate location by specifying a property in .# the management config file $JRE/lib/management/management.properties.# or by specifying a system property (See that file for details)..#...##############################################################.# File permissions of the snmp.acl file.##############################################

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\management\jmxremote.access (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):3998
                                                                                                                                                                                                    Entropy (8bit):4.420205717459709
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:96:OWi7j79eK8MCN/xK4ijnv+wtosJj/D9mQyZWZuQgQX+dv:OWiv7b8rNXE+wusxr9m5WZuVDv
                                                                                                                                                                                                    MD5:F63BEA1F4A31317F6F061D83215594DF
                                                                                                                                                                                                    SHA1:21200EAAD898BA4A2A8834A032EFB6616FABB930
                                                                                                                                                                                                    SHA-256:439158EB513525FEDA19E0E4153CCF36A08FE6A39C0C6CEEB9FCEE86899DD33C
                                                                                                                                                                                                    SHA-512:DE49913B8FA2593DC71FF8DAC85214A86DE891BEDEE0E4C5A70FCDD34E605F8C5C8483E2F1BDB06E1001F7A8CF3C86CAD9FA575DE1A4DC466E0C8FF5891A2773
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:######################################################################.# Default Access Control File for Remote JMX(TM) Monitoring.######################################################################.#.# Access control file for Remote JMX API access to monitoring..# This file defines the allowed access for different roles. The.# password file (jmxremote.password by default) defines the roles and their.# passwords. To be functional, a role must have an entry in.# both the password and the access files..#.# The default location of this file is $JRE/lib/management/jmxremote.access.# You can specify an alternate location by specifying a property in .# the management config file $JRE/lib/management/management.properties.# (See that file for details).#.# The file format for password and access files is syntactically the same.# as the Properties file format. The syntax is described in the Javadoc.# for java.util.Properties.load..# A typical access file has multiple lines, where each

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\management\jmxremote.password.template (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):2856
                                                                                                                                                                                                    Entropy (8bit):4.492265087792545
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:48:MGS+Hpamow7YNkjP9YZAuFovuAnNpG1GMV/BWEUHXYE9nN6k5:Mdm7RT9tvuAnujaE0rN6g
                                                                                                                                                                                                    MD5:7B46C291E7073C31D3CE0ADAE2F7554F
                                                                                                                                                                                                    SHA1:C1E0F01408BF20FBBB8B4810520C725F70050DB5
                                                                                                                                                                                                    SHA-256:3D83E336C9A24D09A16063EA1355885E07F7A176A37543463596B5DB8D82F8FA
                                                                                                                                                                                                    SHA-512:D91EEBC8F30EDCE1A7E16085EB1B18CFDDF0566EFAB174BBCA53DE453EE36DFECB747D401E787A4D15CC9798E090E19A8A0CF3FC8246116CE507D6B464068CDB
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:# ----------------------------------------------------------------------.# Template for jmxremote.password.#.# o Copy this template to jmxremote.password.# o Set the user/password entries in jmxremote.password.# o Change the permission of jmxremote.password to read-only.# by the owner..#.# See below for the location of jmxremote.password file..# ----------------------------------------------------------------------..##############################################################.# Password File for Remote JMX Monitoring.##############################################################.#.# Password file for Remote JMX API access to monitoring. This.# file defines the different roles and their passwords. The access.# control file (jmxremote.access by default) defines the allowed.# access for each role. To be functional, a role must have an entry.# in both the password and the access files..#.# Default location of this file is $JRE/lib/management/jmxremote.password.# You

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\management\management.properties (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):14630
                                                                                                                                                                                                    Entropy (8bit):4.568210341404396
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:Fqsmpsj42wbZTHV+Dq3xtP3xPqaNC/R1a:wsmpsjL0ZTHV++3xtpi68Xa
                                                                                                                                                                                                    MD5:5EDB0D3275263013F0981FF0DF96F87E
                                                                                                                                                                                                    SHA1:E0451D8D7D9E84D7B1C39EC7D00993307A5CBBF1
                                                                                                                                                                                                    SHA-256:3A923735D9C2062064CD8FD30FF8CCA84D0BC0AB5A8FAB80FDAD3155C0E3A380
                                                                                                                                                                                                    SHA-512:F31A3802665F9BB1A00A0F838B94AE4D9F1B9D6284FAF626EBE4F96819E24494771A1B8BFE655FD2DA202C5463D47BAE3B2391764E6F4C5867C0337AA21C87C1
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:#####################################################################.#.Default Configuration File for Java Platform Management.#####################################################################.#.# The Management Configuration file (in java.util.Properties format).# will be read if one of the following system properties is set:.# -Dcom.sun.management.jmxremote.port=<port-number>.# or -Dcom.sun.management.snmp.port=<port-number>.# or -Dcom.sun.management.config.file=<this-file>.#.# The default Management Configuration file is:.#.# $JRE/lib/management/management.properties.#.# Another location for the Management Configuration File can be specified.# by the following property on the Java command line:.#.# -Dcom.sun.management.config.file=<this-file>.#.# If -Dcom.sun.management.config.file=<this-file> is set, the port.# number for the management agent can be specified in the config file.# using the following lines:.#.# ################ Management Agent Port ################

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\management\snmp.acl.template (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):3376
                                                                                                                                                                                                    Entropy (8bit):4.371600962667748
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:48:MkX7W6+IX6XXZAHAvuAn97+onkFOqRCjEhd//SVBteM8hq/unuxsIsxuEAJw2n:MU6bpjvuAnEokSIU/uuxJn
                                                                                                                                                                                                    MD5:71A7DE7DBE2977F6ECE75C904D430B62
                                                                                                                                                                                                    SHA1:2E9F9AC287274532EB1F0D1AFCEFD7F3E97CC794
                                                                                                                                                                                                    SHA-256:F1DC97DA5A5D220ED5D5B71110CE8200B16CAC50622B33790BB03E329C751CED
                                                                                                                                                                                                    SHA-512:3A46E2A4E8A78B190260AFE4EEB54E7D631DB50E6776F625861759C0E0BC9F113E8CD8D734A52327C28608715F6EB999A3684ABD83EE2970274CE04E56CA1527
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:# ----------------------------------------------------------------------.# Template for SNMP Access Control List File.#.# o Copy this template to snmp.acl.# o Set access control for SNMP support.# o Change the permission of snmp.acl to be read-only.# by the owner..#.# See below for the location of snmp.acl file..# ----------------------------------------------------------------------..############################################################.# SNMP Access Control List File .############################################################.#.# Default location of this file is $JRE/lib/management/snmp.acl..# You can specify an alternate location by specifying a property in .# the management config file $JRE/lib/management/management.properties.# or by specifying a system property (See that file for details)..#...##############################################################.# File permissions of the snmp.acl file.##############################################

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\meta-index (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):2126
                                                                                                                                                                                                    Entropy (8bit):4.970874214349507
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:48:EE796OfeCiuG2M5tP5iMmC5KOAY2HQii+r4IzteKk:EnEiuGJbP5lmC5KOA3HQii+EIz8Kk
                                                                                                                                                                                                    MD5:91AA6EA7320140F30379F758D626E59D
                                                                                                                                                                                                    SHA1:3BE2FEBE28723B1033CCDAA110EAF59BBD6D1F96
                                                                                                                                                                                                    SHA-256:4AF21954CDF398D1EAE795B6886CA2581DAC9F2F1D41C98C6ED9B5DBC3E3C1D4
                                                                                                                                                                                                    SHA-512:03428803F1D644D89EB4C0DCBDEA93ACAAC366D35FC1356CCABF83473F4FEF7924EDB771E44C721103CEC22D94A179F092D1BFD1C0A62130F076EB82A826D7CB
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:% VERSION 2..% WARNING: this file is auto-generated; do not edit..% UNSUPPORTED: this file and its format may change and/or..% may be removed in a future release..# charsets.jar..sun/nio..sun/awt..# jce.jar..javax/crypto..sun/security..META-INF/ORACLE_J.RSA..META-INF/ORACLE_J.SF..# jfr.jar..oracle/jrockit/..jdk/jfr..com/oracle/jrockit/..! jsse.jar..sun/security..com/sun/net/..! management-agent.jar..@ resources.jar..com/sun/java/util/jar/pack/..META-INF/services/sun.util.spi.XmlPropertiesProvider..META-INF/services/javax.print.PrintServiceLookup..com/sun/corba/..META-INF/services/javax.sound.midi.spi.SoundbankReader..sun/print..META-INF/services/javax.sound.midi.spi.MidiFileReader..META-INF/services/sun.java2d.cmm.CMMServiceProvider..javax/swing..META-INF/services/javax.sound.sampled.spi.AudioFileReader..META-INF/services/javax.sound.midi.spi.MidiDeviceProvider..sun/net..META-INF/services/javax.sound.sampled.spi.AudioFileWriter..com/sun/imageio/..META-INF/services/sun.java2d.pipe.Ren

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\net.properties (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):4464
                                                                                                                                                                                                    Entropy (8bit):4.834345958771967
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:96:VAcEvEtGObfObz3Obm0ObPOn23CO0V+r/aJ7SFs:PEGG4f4z34m04PeBm27Si
                                                                                                                                                                                                    MD5:2FE77CD007D99DDE926A22094E333E0E
                                                                                                                                                                                                    SHA1:6587F43B93527DD17ABCD5699EB9682B6F08C09B
                                                                                                                                                                                                    SHA-256:16C93910B2785E7CBDDA90D5479AA9687148C2141AC0ADBD0277FDE284F6BBB3
                                                                                                                                                                                                    SHA-512:33D32B1C50BAFC4BCEE1D97D81176E3C9FF6B316536A7A88F76DB92781B4ACB716CC9FF75A97AB32F4469838B370A8DF54B2E2F5FE97F0873B8A44CD2B848FAA
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:############################################################.# .Default Networking Configuration File.#.# This file may contain default values for the networking system properties..# These values are only used when the system properties are not specified.# on the command line or set programatically..# For now, only the various proxy settings can be configured here..############################################################..# Whether or not the DefaultProxySelector will default to System Proxy.# settings when they do exist..# Set it to 'true' to enable this feature and check for platform.# specific proxy settings.# Note that the system properties that do explicitely set proxies.# (like http.proxyHost) do take precedence over the system settings.# even if java.net.useSystemProxies is set to true.. .java.net.useSystemProxies=false..#------------------------------------------------------------------------.# Proxy configuration for the various protocol handlers..# DO NOT uncomment these

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\plugin.jar (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Java archive data (JAR)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):1922800
                                                                                                                                                                                                    Entropy (8bit):6.073928479159945
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:12288:TXBgNkIq4CVJNVjWH5ISi1niQkxaUPoM9wD0:TRgNQ4gJ7WHKL10PotD0
                                                                                                                                                                                                    MD5:1943CC8BDF0710D934D132BC218594E3
                                                                                                                                                                                                    SHA1:125E28AC3C51D41D5368899D54D6AA35AFF3E504
                                                                                                                                                                                                    SHA-256:AA05772EC9568ED6874209D6C4E74ED85CA3771954D4952BA14E592D1DE534EB
                                                                                                                                                                                                    SHA-512:39D4C6E029A4D2B0D6DE78F10ECD9716CBC313E705B1E5F59E5312870BAA69D689360F45D451D22396B9154A3E971DB017367B8652BCDB61252CA16A772C444E
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK........)..I................META-INF/....PK........(..Iu/u*e...e.......META-INF/MANIFEST.MFManifest-Version: 1.0..Ant-Version: Apache Ant 1.7.1..Created-By: 25.121-b13 (Oracle Corporation)....PK........(..I................com/PK........(..I................com/sun/PK........(..I................com/sun/deploy/PK........(..I................com/sun/deploy/uitoolkit/PK........(..I................com/sun/deploy/uitoolkit/impl/PK........)..I............"...com/sun/deploy/uitoolkit/impl/awt/PK........(..I............#...com/sun/deploy/uitoolkit/impl/text/PK........(..I................com/sun/deploy/uitoolkit/ui/PK........(..I................com/sun/java/PK........(..I................com/sun/java/browser/PK........(..I................com/sun/java/browser/plugin2/PK........(..I............)...com/sun/java/browser/plugin2/liveconnect/PK........(..I............,...com/sun/java/browser/plugin2/liveconnect/v1/PK........(..I................netscape/PK........(..I................netscape/javascript/

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\psfont.properties.ja (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):2796
                                                                                                                                                                                                    Entropy (8bit):5.182793663606788
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:48:R8s89HoIbTUjbyuJdI2FylXLr96cpcnnI0adbEk+IqdouZ:y56CiPFylXLrMGyJU+B
                                                                                                                                                                                                    MD5:7C5514B805B4A954BC55D67B44330C69
                                                                                                                                                                                                    SHA1:56ED1C661EEEDE17B4FAE8C9DE7B5EDBAD387ABC
                                                                                                                                                                                                    SHA-256:0C790DE696536165913685785EA8CBE1AC64ACF09E2C8D92D802083A6DA09393
                                                                                                                                                                                                    SHA-512:CCD4CB61C95DEFDCBA6A6A3F898C29A64CD5831A8AB50E0AFAC32ADB6A9E0C4A4BA37EB6DEE147830DA33AE0B2067473132C0B91A21D546A6528F42267A2C40E
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:#.#.# Copyright (c) 1996, 2000, Oracle and/or its affiliates. All rights reserved..# ORACLE PROPRIETARY/CONFIDENTIAL. Use is subject to license terms..#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#..#.#.Japanese PostScript printer property file.#.font.num=16.#.serif=serif.timesroman=serif.sansserif=sansserif.helvetica=sansserif.monospaced=monospaced.courier=monospaced.dialog=sansserif.dialoginput=monospaced.#.serif.latin1.plain=Times-Roman.serif.latin1.italic=Times-Italic.serif.latin1.bolditalic=Times-BoldItalic.serif.latin1.bold=Times-Bold.#.sansserif.latin1.plain=Helvetica.sansserif.latin1.italic=Helvetica-Oblique.sansserif.latin1.bolditalic=Helvetica-BoldOblique.sansserif.latin1.bold=Helvetica-Bold.#.monospaced.latin1.plain=Courier.monospaced.latin1.italic=Courier-Oblique.monospaced.latin1.bolditalic=Courier-BoldOblique.monospaced.latin1.bold=Courier-Bold.#.serif.x11jis0208.plain=Ryumin-Light-H.serif.x11jis0208.italic=Ryumin-Light-H.serif.x11jis0208.bolditalic=Ryumin-Light-H.serif.x11jis

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\psfontj2d.properties (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):10393
                                                                                                                                                                                                    Entropy (8bit):4.970762688893053
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:192:hPwn+Cyub3Ee4OECKDIcYOhAgZ50OKDQLT2IcpRuWRbHr9NRXUh/QTv9Ho39zPxq:5xzubEFOEscAW5VKsCfHz8RPxGt
                                                                                                                                                                                                    MD5:F8734590A1AEC97F6B22F08D1AD1B4BB
                                                                                                                                                                                                    SHA1:AA327A22A49967F4D74AFEEE6726F505F209692F
                                                                                                                                                                                                    SHA-256:7D51936FA3FD5812AE51F9F5657E0E70487DCA810B985607B6C5D6603F5E6C98
                                                                                                                                                                                                    SHA-512:72E62DC63DAA2591B48B2B774E2479B8861D159061B92FD3A0A06256295DA4D8B20DAFA77983FDBF6179F666F9FF6B3275F7A5BCF9555E638595230B9A42B177
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:#.#.# Copyright (c) 1999, Oracle and/or its affiliates. All rights reserved..# ORACLE PROPRIETARY/CONFIDENTIAL. Use is subject to license terms..#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#..#.#.PostScript printer property file for Java 2D printing..#.# WARNING: This is an internal implementation file, not a public file..# Any customisation or reliance on the existence of this file and its.# contents or syntax is discouraged and unsupported..# It may be incompatibly changed or removed without any notice..#.#.font.num=35.#.# Legacy logical font family names and logical font aliases should all.# map to the primary logical font names..#.serif=serif.times=serif.timesroman=serif.sansserif=sansserif.helvetica=sansserif.dialog=sansserif.dialoginput=monospaced.monospaced=monospaced.courier=monospaced.#.# Next, physical fonts which can be safely mapped to standard postscript fonts.# These keys generally map to a value which is the same as the key, so.# the key/value is just a way to say the font has

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\resources.jar (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Java archive data (JAR)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):3492568
                                                                                                                                                                                                    Entropy (8bit):6.066315438699595
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:49152:zrEXWnxF7W1U+fZoJxQwvNqE6SVI7ypp53uGxKfEVtWbuMzTN+no5YSezryX191F:he
                                                                                                                                                                                                    MD5:535EDF7BA4312849B20CA01BCE0DF36A
                                                                                                                                                                                                    SHA1:0D4A4C7602F83E06A04953E257169C7832A2F953
                                                                                                                                                                                                    SHA-256:6BA3F5EDF305FA52AB249AA92617219FD83AF7AB6C3D97A096BDA662610D806A
                                                                                                                                                                                                    SHA-512:E9F33926AD62A6226C913494B7D4C84D99A2095AB808BDF988A23293D7E40DA3A7F6CD40D5CFDDFA4EAF9618D7F97967880D4A97CB521FA7E13DA8F9B9939F51
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK........N..I................META-INF/....PK........N..I.@"T>...>.......META-INF/MANIFEST.MFManifest-Version: 1.0..Implementation-Vendor: Oracle Corporation..Implementation-Title: Java Runtime Environment..Implementation-Version: 1.8.0_121..Specification-Vendor: Oracle Corporation..Created-By: 1.7.0_07 (Oracle Corporation)..Specification-Title: Java Platform API Specification..Specification-Version: 1.8....PK........R..I....$...$.......META-INF/mailcap.default#.# This is a very simple 'mailcap' file.#.image/gif;;..x-java-view=com.sun.activation.viewers.ImageViewer.image/jpeg;;..x-java-view=com.sun.activation.viewers.ImageViewer.text/*;;..x-java-view=com.sun.activation.viewers.TextViewer.text/*;;..x-java-edit=com.sun.activation.viewers.TextEditor.PK........R..I..{~2...2.......META-INF/mimetypes.default#.# A simple, old format, mime.types file.#.text/html..html htm HTML HTM.text/plain..txt text TXT TEXT.image/gif..gif GIF.image/ief..ief.image/jpeg..jpeg jpg jpe JPG.image/tiff..tiff tif.

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\rt.jar (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Java archive data (JAR)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):54502207
                                                                                                                                                                                                    Entropy (8bit):6.044705261592451
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:196608:GSyg1BSlKOJe3CpWXRaBrMimgm1emr5D9/J06QKx6Pb/E+Z9vLojk:GW1BSl3eyYb1emr5D9/J06QKx6Pb/NL
                                                                                                                                                                                                    MD5:9D2CC16B7B6EE2B7F8491C0EE1091A53
                                                                                                                                                                                                    SHA1:F5004FF798FDF1B9F8A30C4406D8F125FD5FAE8D
                                                                                                                                                                                                    SHA-256:B6E20407C6DC19700E0442ABBF7698E38F476381518314592C108C524BD0C1C0
                                                                                                                                                                                                    SHA-512:26E708372A431B21BA0FF27DE0210D70AA6A9ED0DA671B7077ABA60D19C9F153924EE43581A9C544F241462B81ADCE47005F5726147BF6A165B6CB453D9E21D8
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK........N..I................META-INF/....PK........N..In].W%...%.......META-INF/MANIFEST.MFManifest-Version: 1.0..Implementation-Vendor: Oracle Corporation..Implementation-Title: Java Runtime Environment..Implementation-Version: 1.8.0_121..Specification-Vendor: Oracle Corporation..Created-By: 1.7.0_07 (Oracle Corporation)..Specification-Title: Java Platform API Specification..Specification-Version: 1.8....Name: javax/swing/JCheckBoxMenuItem.class..Java-Bean: True....Name: javax/swing/JDialog.class..Java-Bean: True....Name: javax/swing/JSlider.class..Java-Bean: True....Name: javax/swing/JTextField.class..Java-Bean: True....Name: javax/swing/JTextPane.class..Java-Bean: True....Name: javax/swing/JTextArea.class..Java-Bean: True....Name: javax/swing/JList.class..Java-Bean: True....Name: javax/swing/JFormattedTextField.class..Java-Bean: True....Name: javax/swing/JApplet.class..Java-Bean: True....Name: javax/swing/JSpinner.class..Java-Bean: True....Name: javax/swing/JLabel.class..Java-Bean

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\security\US_export_policy.jar (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v2.0 to extract, compression method=deflate
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):3023
                                                                                                                                                                                                    Entropy (8bit):7.508070596860004
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:48:9Y6RQ8EDiceW0UZNgKCAldrou1YgH767KWajaHb9YtOH9idZ8EcIEHe:qR7DVe6ZNg9Iou1YgHqK3W7yEHkBc1He
                                                                                                                                                                                                    MD5:EF6E8EAE7D1876D7F05D765D2C2E0529
                                                                                                                                                                                                    SHA1:F6FB2AF1E87FC622CDA194A7D6B5F5F069653FF1
                                                                                                                                                                                                    SHA-256:FADF649815E8DD4295980EC4C81A76E25FEA3CECC8067DE333A075BBCDAF8FB9
                                                                                                                                                                                                    SHA-512:26C46FED68540C1F0567CCA482C20FF399C7F6521621DC865F845A38FDB8EB26D05C05AB642AFE14078529A4504758ACEE6D9910BDE5EF0CF53D77162AA369B9
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK.........V.C................META-INF/MANIFEST.MFe.AO.0...;..G=.q..I<...RE...3.....}z....^.^~oE9.Ai..TL..];.m...i.......P.[.g..s.t..~8.}..].].%-[@3!;!...K....!@J...\.N...B<...9.....Ch...;.{:J.W..9...W......{....YAM.V..$.3^j..-+..~.?..w...").'..9&d..&......h!._..PK.....o........PK.........V.C................META-INF/ORACLE_J.SFu.Oo.0...;...-..T.H< .).D.?..T(X-..eQ>..vX.e.w....\.P..)..8.....*K..Q...x.D\(..q..p.8B0|h..6(5o..5.....^.....t.|?...1..)._...3.W...W.o.]...6.S.F..9t....eUp..x#....!(P.L..... ...f.....2(n..eI.BX!.p....n...6.V..J:...qC..8.X.....aV..j^.[.......Q.["..d...J.k(......t`.+1{L.].G.DX...4.<.......(..]...PK..+1`D2.......PK.........V.C................META-INF/ORACLE_J.RSA3hb...........iA....&.+L......l..m....,L...........2.....q..f&F&&&fK..v..s.,.@.....8.CY..B.a..a&gGC!....].3 1'_.1.$.P.@.$.%,.\.....\._\Y\..[....l.l.......J,KT..O+)O,JUp.OIU..L...K7.1..)b...rvE.Rpv4...5440.b3....( ...5.r.....i.I.......s@.E..E.%..y...A...GF`.27.......aK....ol.

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\security\blacklist (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):4054
                                                                                                                                                                                                    Entropy (8bit):5.791238368311065
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:96:uudVZoOZ3mFcFtqZB0q6jV//H2cB/iye6S04UioQeXbZFf6HULUBnSQXHvLnOTSW:uudVZoOZ3mFcXqZB0q6B//H2cB/Ze6SG
                                                                                                                                                                                                    MD5:B2C6EAE6382150192EA3912393747180
                                                                                                                                                                                                    SHA1:D4FFB3857EAB403955CE9D156E46D056061E6A5A
                                                                                                                                                                                                    SHA-256:6C73C877B36D4ABD086CB691959B180513AC5ABC0C87FE9070D2D5426D3DBF71
                                                                                                                                                                                                    SHA-512:898582C23F311F9F46825E7F8B6D36BED7255E5A4E2FA4B4452153B86EFBD88DB7E5B94DBD9CB9DB554F62B84D19F22AE9D81822B4896081C487FB50946A9A9A
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:# JNLPAppletLauncher applet-launcher.jar.SHA1-Digest-Manifest: 5Bo5/eg892hQ9mgbUW56iDmsp1k=..# 7066583.SHA1-Digest-Manifest: x17xGEFzBRXY2pLtXiIbp8J7U9M=.SHA1-Digest-Manifest: ya6YNTzMCFYUO4lwhmz9OWhhIz8=.SHA1-Digest-Manifest: YwuPyF/KMcxcQhgxilzNybFM2+8=..# 7066809.SHA1-Digest-Manifest: dBKbNW1PZSjJ0lGcCeewcCrYx5g=.SHA1-Digest-Manifest: lTYCkD1wm5uDcp2G2PNPcADG/ds=.SHA1-Digest-Manifest: GKwQJtblDEuSVf3LdC1ojpUJRGg=..# 7186931.SHA1-Digest-Manifest: 0CUppG7J6IL8xHqPCnA377Koahw=.SHA1-Digest-Manifest: 3aJU1qSK6IYmt5MSh2IIIj5G1XE=.SHA1-Digest-Manifest: 8F4F0TXA4ureZbfEXWIFm76QGg4=.SHA1-Digest-Manifest: B1NaDg834Bgg+VE9Ca+tDZOd2BI=.SHA1-Digest-Manifest: bOoQga+XxC3j0HiP552+fYCdswo=.SHA1-Digest-Manifest: C4mtepHAyIKiAjjqOm6xYMo8TkM=.SHA1-Digest-Manifest: cDXEH+bR01R8QVxL+KFKYqFgsR0=.SHA1-Digest-Manifest: cO2ccW2cckTvpR0HVgQa362PyHI=.SHA1-Digest-Manifest: D/TyRle6Sl+CDuBFmdOPy03ERaw=.SHA1-Digest-Manifest: eJfWm86yHp2Oz5U8WrMKbpv6GGA=.SHA1-Digest-Manifest: g3mA5HqcRBlKaUVQsapnKhOSEas=.SHA1-Dig

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\security\blacklisted.certs (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):1253
                                                                                                                                                                                                    Entropy (8bit):4.115037497545474
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:24:NdwGDQ9VW0F1Ejh7Z9uiej4mCCXlCEQpkvJBn4vRU4CYb:NdrDQ94Z1bej4gXlCEo2G/b
                                                                                                                                                                                                    MD5:B9C358F9D668E86FDA8048982E741ACC
                                                                                                                                                                                                    SHA1:8870BEF548310B648EF044DB40C5EC609F896F0B
                                                                                                                                                                                                    SHA-256:DDD297102146AC7F6607B35C0E0B565975739A7841DA5E5A6207B6F4EBB2D822
                                                                                                                                                                                                    SHA-512:91CED5411767FBA041B950AD46F71A19F5DD48AF3D2199DA835D6CB9062AB80076A961D1F91856D74DBB0E037B092729D065204A74E113C914B33CD9B2F714B7
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:Algorithm=SHA-256.14E6D2764A4B06701C6CBC376A253775F79C782FBCB6C0EE6F99DE4BA1024ADD.31C8FD37DB9B56E708B03D1F01848B068C6DA66F36FB5D82C008C6040FA3E133.3946901F46B0071E90D78279E82FABABCA177231A704BE72C5B0E8918566EA66.450F1B421BB05C8609854884559C323319619E8B06B001EA2DCBB74A23AA3BE2.4CBBF8256BC9888A8007B2F386940A2E394378B0D903CBB3863C5A6394B889CE.4FEE0163686ECBD65DB968E7494F55D84B25486D438E9DE558D629D28CD4D176.5E83124D68D24E8E177E306DF643D5EA99C5A94D6FC34B072F7544A1CABB7C7B.76A45A496031E4DD2D7ED23E8F6FF97DBDEA980BAAC8B0BA94D7EDB551348645.8A1BD21661C60015065212CC98B1ABB50DFD14C872A208E66BAE890F25C448AF.9ED8F9B0E8E42A1656B8E1DD18F42BA42DC06FE52686173BA2FC70E756F207DC.A686FEE577C88AB664D0787ECDFFF035F4806F3DE418DC9E4D516324FFF02083.B8686723E415534BC0DBD16326F9486F85B0B0799BF6639334E61DAAE67F36CD.D24566BF315F4E597D6E381C87119FB4198F5E9E2607F5F4AB362EF7E2E7672F.D3A936E1A7775A45217C8296A1F22AC5631DCDEC45594099E78EEEBBEDCBA967.DF21016B00FC54F9FE3BC8B039911BB216E9162FAD2FD14D990AB96E951B49BE.EC30C9C

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\security\cacerts (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Java KeyStore
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):113484
                                                                                                                                                                                                    Entropy (8bit):7.585497317834031
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:1536:n1kP9UXlkT1ze0WuQHoeCHtVjnIhEObD4lyCpcJa7eUS:nKLI0WuybotVnINbclyCpE
                                                                                                                                                                                                    MD5:2ECFD7E5A8789C3F0E68AE85A26DEA23
                                                                                                                                                                                                    SHA1:8BCCDEBCD485EBA9A0AC324EFE458A087DD55C2A
                                                                                                                                                                                                    SHA-256:D020172012854BB4A9D461885C6816EB855498C63FF78BC60944F4FBA1E9091A
                                                                                                                                                                                                    SHA-512:9C350AA5BF3D975D64988F9F33AC3DD0533322F57B9A7A07DB479D0082693B5F74C4A90BE853DD1AF8F2749F003BD8633632732C7AD6BB1ABBB894B343AE10DB
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:...........h......verisignclass2g2ca [jdk]...V.I...X.509....0...0..l..../`...zF..[pl..0...*.H........0..1.0...U....US1.0...U....VeriSign, Inc.1<0:..U...3Class 2 Public Primary Certification Authority - G21:08..U...1(c) 1998 VeriSign, Inc. - For authorized use only1.0...U....VeriSign Trust Network0...980518000000Z..280801235959Z0..1.0...U....US1.0...U....VeriSign, Inc.1<0:..U...3Class 2 Public Primary Certification Authority - G21:08..U...1(c) 1998 VeriSign, Inc. - For authorized use only1.0...U....VeriSign Trust Network0..0...*.H............0.........!t,.....<.!.........._R...,.V,..i,......y...9.{...,...,.i......B.#OJ.....1l..o.'....Lx.m.F.....T...F.Z..0..l.-.m..w.....0...*.H............r.....q....^Q.@..h.........f./.....+..$`.MD....-..xior.l...c.7..0..w.I5.......GsjT"4d-...Y[.QY:......g...2d^.Fr'..{.D........digicertassuredidg3 [jdk]...V.H.8..X.509...J0..F0...........Z....ID..$.l.0...*.H.=...0e1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1$0"..

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\security\is-40K04.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v2.0 to extract, compression method=deflate
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):3035
                                                                                                                                                                                                    Entropy (8bit):7.503555903928921
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:48:9OAowMcekBBC8b5DigVAldrou1YgH767KWajaHgSCKVYt2WhqFidZ8Ea1iF:hBeYJFjIou1YgHqK3WA9KqkWEcBvF
                                                                                                                                                                                                    MD5:DABFCB23D7BF9BF5A201C3F6EA9BFB2C
                                                                                                                                                                                                    SHA1:517368AB2CBAF6B42EA0B963F98EEEDD996E83E3
                                                                                                                                                                                                    SHA-256:4924CBE86A60D93351C8955B924B714FFDEEA776B2621D84E3BAD99749C56DF3
                                                                                                                                                                                                    SHA-512:16A6AC1BD13F9974118EBB444E4A10DB6D55696A1363BC865E9C0BCC3A285438944C167F1B2FCF549970C9075ED6290D6C1A4C1BA94E64B4E84697BF8D317B64
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK.........V.C................META-INF/MANIFEST.MFe.AO.@...;..a.....T...m..Rk.A=.ey.....(..K.x.6.L..)q....t+P.d...Cc..F...) ...,.......j..}..]...4....u......-.zeg.H.G.I.K.L:.J...J.%./.i(..A@.@K......^...V..n..."a..EX..z..3>..-v.CnD..'.S.....>k_y&>l...n...}......O>.....PK..U..g........PK.........V.C................META-INF/ORACLE_J.SFu..n.@...=.....A..E....`../..3.#.........&m.;./.Y..\P...e..b.tYZ....4.g.q-.5>~.\k..)>....d..2....+.7.E.v+.o.o'YR6n."....IG......6.....ap|..~8+z.n......T.q[...a..3.E..T{.~..-]C@y.R.K...6..~..(K....9J..@.|_...VCJ...{.e".H.vL...8.DP.....@(........m.......9n._2.z4..s8.....e..K.....P....A.'.m6a_..PK..+{. /.......PK.........V.C................META-INF/ORACLE_J.RSA3hb...........iA....&.+L......l..m....,L...........2.....q..f&F&&&fK..v..s.,.@.....8.CY..B.a..a&gGC!....].3 1'_.1.$.P.@.$.%,.\.....\._\Y\..[....l.l.......J,KT..O+)O,JUp.OIU..L...K7.1..)b...rvE.Rpv4...5440.b3....( ...5.r.....i.I.......s@.E..E.%..y...A...GF`.27.......aK....ol.."P...l

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\security\is-5Q5V8.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):4054
                                                                                                                                                                                                    Entropy (8bit):5.791238368311065
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:96:uudVZoOZ3mFcFtqZB0q6jV//H2cB/iye6S04UioQeXbZFf6HULUBnSQXHvLnOTSW:uudVZoOZ3mFcXqZB0q6B//H2cB/Ze6SG
                                                                                                                                                                                                    MD5:B2C6EAE6382150192EA3912393747180
                                                                                                                                                                                                    SHA1:D4FFB3857EAB403955CE9D156E46D056061E6A5A
                                                                                                                                                                                                    SHA-256:6C73C877B36D4ABD086CB691959B180513AC5ABC0C87FE9070D2D5426D3DBF71
                                                                                                                                                                                                    SHA-512:898582C23F311F9F46825E7F8B6D36BED7255E5A4E2FA4B4452153B86EFBD88DB7E5B94DBD9CB9DB554F62B84D19F22AE9D81822B4896081C487FB50946A9A9A
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:# JNLPAppletLauncher applet-launcher.jar.SHA1-Digest-Manifest: 5Bo5/eg892hQ9mgbUW56iDmsp1k=..# 7066583.SHA1-Digest-Manifest: x17xGEFzBRXY2pLtXiIbp8J7U9M=.SHA1-Digest-Manifest: ya6YNTzMCFYUO4lwhmz9OWhhIz8=.SHA1-Digest-Manifest: YwuPyF/KMcxcQhgxilzNybFM2+8=..# 7066809.SHA1-Digest-Manifest: dBKbNW1PZSjJ0lGcCeewcCrYx5g=.SHA1-Digest-Manifest: lTYCkD1wm5uDcp2G2PNPcADG/ds=.SHA1-Digest-Manifest: GKwQJtblDEuSVf3LdC1ojpUJRGg=..# 7186931.SHA1-Digest-Manifest: 0CUppG7J6IL8xHqPCnA377Koahw=.SHA1-Digest-Manifest: 3aJU1qSK6IYmt5MSh2IIIj5G1XE=.SHA1-Digest-Manifest: 8F4F0TXA4ureZbfEXWIFm76QGg4=.SHA1-Digest-Manifest: B1NaDg834Bgg+VE9Ca+tDZOd2BI=.SHA1-Digest-Manifest: bOoQga+XxC3j0HiP552+fYCdswo=.SHA1-Digest-Manifest: C4mtepHAyIKiAjjqOm6xYMo8TkM=.SHA1-Digest-Manifest: cDXEH+bR01R8QVxL+KFKYqFgsR0=.SHA1-Digest-Manifest: cO2ccW2cckTvpR0HVgQa362PyHI=.SHA1-Digest-Manifest: D/TyRle6Sl+CDuBFmdOPy03ERaw=.SHA1-Digest-Manifest: eJfWm86yHp2Oz5U8WrMKbpv6GGA=.SHA1-Digest-Manifest: g3mA5HqcRBlKaUVQsapnKhOSEas=.SHA1-Dig

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\security\is-6HO78.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Java KeyStore
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):113484
                                                                                                                                                                                                    Entropy (8bit):7.585497317834031
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:1536:n1kP9UXlkT1ze0WuQHoeCHtVjnIhEObD4lyCpcJa7eUS:nKLI0WuybotVnINbclyCpE
                                                                                                                                                                                                    MD5:2ECFD7E5A8789C3F0E68AE85A26DEA23
                                                                                                                                                                                                    SHA1:8BCCDEBCD485EBA9A0AC324EFE458A087DD55C2A
                                                                                                                                                                                                    SHA-256:D020172012854BB4A9D461885C6816EB855498C63FF78BC60944F4FBA1E9091A
                                                                                                                                                                                                    SHA-512:9C350AA5BF3D975D64988F9F33AC3DD0533322F57B9A7A07DB479D0082693B5F74C4A90BE853DD1AF8F2749F003BD8633632732C7AD6BB1ABBB894B343AE10DB
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:...........h......verisignclass2g2ca [jdk]...V.I...X.509....0...0..l..../`...zF..[pl..0...*.H........0..1.0...U....US1.0...U....VeriSign, Inc.1<0:..U...3Class 2 Public Primary Certification Authority - G21:08..U...1(c) 1998 VeriSign, Inc. - For authorized use only1.0...U....VeriSign Trust Network0...980518000000Z..280801235959Z0..1.0...U....US1.0...U....VeriSign, Inc.1<0:..U...3Class 2 Public Primary Certification Authority - G21:08..U...1(c) 1998 VeriSign, Inc. - For authorized use only1.0...U....VeriSign Trust Network0..0...*.H............0.........!t,.....<.!.........._R...,.V,..i,......y...9.{...,...,.i......B.#OJ.....1l..o.'....Lx.m.F.....T...F.Z..0..l.-.m..w.....0...*.H............r.....q....^Q.@..h.........f./.....+..$`.MD....-..xior.l...c.7..0..w.I5.......GsjT"4d-...Y[.QY:......g...2d^.Fr'..{.D........digicertassuredidg3 [jdk]...V.H.8..X.509...J0..F0...........Z....ID..$.l.0...*.H.=...0e1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1$0"..

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\security\is-A4AH7.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):1253
                                                                                                                                                                                                    Entropy (8bit):4.115037497545474
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:24:NdwGDQ9VW0F1Ejh7Z9uiej4mCCXlCEQpkvJBn4vRU4CYb:NdrDQ94Z1bej4gXlCEo2G/b
                                                                                                                                                                                                    MD5:B9C358F9D668E86FDA8048982E741ACC
                                                                                                                                                                                                    SHA1:8870BEF548310B648EF044DB40C5EC609F896F0B
                                                                                                                                                                                                    SHA-256:DDD297102146AC7F6607B35C0E0B565975739A7841DA5E5A6207B6F4EBB2D822
                                                                                                                                                                                                    SHA-512:91CED5411767FBA041B950AD46F71A19F5DD48AF3D2199DA835D6CB9062AB80076A961D1F91856D74DBB0E037B092729D065204A74E113C914B33CD9B2F714B7
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:Algorithm=SHA-256.14E6D2764A4B06701C6CBC376A253775F79C782FBCB6C0EE6F99DE4BA1024ADD.31C8FD37DB9B56E708B03D1F01848B068C6DA66F36FB5D82C008C6040FA3E133.3946901F46B0071E90D78279E82FABABCA177231A704BE72C5B0E8918566EA66.450F1B421BB05C8609854884559C323319619E8B06B001EA2DCBB74A23AA3BE2.4CBBF8256BC9888A8007B2F386940A2E394378B0D903CBB3863C5A6394B889CE.4FEE0163686ECBD65DB968E7494F55D84B25486D438E9DE558D629D28CD4D176.5E83124D68D24E8E177E306DF643D5EA99C5A94D6FC34B072F7544A1CABB7C7B.76A45A496031E4DD2D7ED23E8F6FF97DBDEA980BAAC8B0BA94D7EDB551348645.8A1BD21661C60015065212CC98B1ABB50DFD14C872A208E66BAE890F25C448AF.9ED8F9B0E8E42A1656B8E1DD18F42BA42DC06FE52686173BA2FC70E756F207DC.A686FEE577C88AB664D0787ECDFFF035F4806F3DE418DC9E4D516324FFF02083.B8686723E415534BC0DBD16326F9486F85B0B0799BF6639334E61DAAE67F36CD.D24566BF315F4E597D6E381C87119FB4198F5E9E2607F5F4AB362EF7E2E7672F.D3A936E1A7775A45217C8296A1F22AC5631DCDEC45594099E78EEEBBEDCBA967.DF21016B00FC54F9FE3BC8B039911BB216E9162FAD2FD14D990AB96E951B49BE.EC30C9C

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\security\is-D5TE3.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):34305
                                                                                                                                                                                                    Entropy (8bit):4.856404441548362
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:768:rmLHAEcqrlANbwbqL1AdLAHaPw28Z5oSTEBp+Z5IcbJNg:rWQaYPPoSTEBpm26J+
                                                                                                                                                                                                    MD5:6C15D08174953959F1AA42D398AAF8C0
                                                                                                                                                                                                    SHA1:FBAFC8A8BD3697D936E31B6FF27C15A8BCED5E41
                                                                                                                                                                                                    SHA-256:C59821D1975C15E9A466170C9F01F77204E95C8D36C0A5B00599C2CA5F85FC40
                                                                                                                                                                                                    SHA-512:B26F68E126E0F050D53CFE9DC844C13DE315C24A00E419D7C6056C535547B13DB5C7872ED8DEF9702394112907BEA5243295EEDAE70BE3857F0B2BF89F992F84
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:#..# This is the "master security properties file"...#..# An alternate java.security properties file may be specified..# from the command line via the system property..#..# -Djava.security.properties=<URL>..#..# This properties file appends to the master security properties file...# If both properties files specify values for the same key, the value..# from the command-line properties file is selected, as it is the last..# one loaded...#..# Also, if you specify..#..# -Djava.security.properties==<URL> (2 equals),..#..# then that properties file completely overrides the master security..# properties file...#..# To disable the ability to specify an additional properties file from..# the command line, set the key security.overridePropertiesFile..# to false in the master security properties file. It is set to true..# by default.....# In this file, various security properties are set for use by..# java.security classes. This is where users can statically register..# Cryptography Packag

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\security\is-DUN2M.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):2466
                                                                                                                                                                                                    Entropy (8bit):4.437992103838927
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:24:hjrUah3ontU2H+h/ic1mo8vwwQcNpIjLSkLuodAZdgh1ykt0wS5:R4fc17wVNwltJU
                                                                                                                                                                                                    MD5:11340CD598A8517A0FD315A319716A08
                                                                                                                                                                                                    SHA1:C0112209A567B3B523CFED7041709F9440227968
                                                                                                                                                                                                    SHA-256:B8582889B0DF36065093C642ED0F9FA2A94CC0DC6FDE366980CFD818EC957250
                                                                                                                                                                                                    SHA-512:2B6DADC555EEB28DC1C553AB429F0CB9E3AD9AA64DFA2B62910769A935A1E6030A7FF0DDE2689F29C58D1B0720416D6B99FFA19BD23E6686EFB1547AFB7DCCFD
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:.// Standard extensions get all permissions by default..grant codeBase "file:${{java.ext.dirs}}/*" {. permission java.security.AllPermission;.};..// default permissions granted to all domains..grant {. // Allows any thread to stop itself using the java.lang.Thread.stop(). // method that takes no argument.. // Note that this permission is granted by default only to remain. // backwards compatible.. // It is strongly recommended that you either remove this permission. // from this policy file or further restrict it to code sources. // that you specify, because Thread.stop() is potentially unsafe.. // See the API specification of java.lang.Thread.stop() for more. // information.. permission java.lang.RuntimePermission "stopThread";.. // allows anyone to listen on dynamic ports. permission java.net.SocketPermission "localhost:0", "listen";.. // "standard" properies that can be read by anyone..

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\security\is-Q41HU.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v2.0 to extract, compression method=deflate
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):3023
                                                                                                                                                                                                    Entropy (8bit):7.508070596860004
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:48:9Y6RQ8EDiceW0UZNgKCAldrou1YgH767KWajaHb9YtOH9idZ8EcIEHe:qR7DVe6ZNg9Iou1YgHqK3W7yEHkBc1He
                                                                                                                                                                                                    MD5:EF6E8EAE7D1876D7F05D765D2C2E0529
                                                                                                                                                                                                    SHA1:F6FB2AF1E87FC622CDA194A7D6B5F5F069653FF1
                                                                                                                                                                                                    SHA-256:FADF649815E8DD4295980EC4C81A76E25FEA3CECC8067DE333A075BBCDAF8FB9
                                                                                                                                                                                                    SHA-512:26C46FED68540C1F0567CCA482C20FF399C7F6521621DC865F845A38FDB8EB26D05C05AB642AFE14078529A4504758ACEE6D9910BDE5EF0CF53D77162AA369B9
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK.........V.C................META-INF/MANIFEST.MFe.AO.0...;..G=.q..I<...RE...3.....}z....^.^~oE9.Ai..TL..];.m...i.......P.[.g..s.t..~8.}..].].%-[@3!;!...K....!@J...\.N...B<...9.....Ch...;.{:J.W..9...W......{....YAM.V..$.3^j..-+..~.?..w...").'..9&d..&......h!._..PK.....o........PK.........V.C................META-INF/ORACLE_J.SFu.Oo.0...;...-..T.H< .).D.?..T(X-..eQ>..vX.e.w....\.P..)..8.....*K..Q...x.D\(..q..p.8B0|h..6(5o..5.....^.....t.|?...1..)._...3.W...W.o.]...6.S.F..9t....eUp..x#....!(P.L..... ...f.....2(n..eI.BX!.p....n...6.V..J:...qC..8.X.....aV..j^.[.......Q.["..d...J.k(......t`.+1{L.].G.DX...4.<.......(..]...PK..+1`D2.......PK.........V.C................META-INF/ORACLE_J.RSA3hb...........iA....&.+L......l..m....,L...........2.....q..f&F&&&fK..v..s.,.@.....8.CY..B.a..a&gGC!....].3 1'_.1.$.P.@.$.%,.\.....\._\Y\..[....l.l.......J,KT..O+)O,JUp.OIU..L...K7.1..)b...rvE.Rpv4...5440.b3....( ...5.r.....i.I.......s@.E..E.%..y...A...GF`.27.......aK....ol.

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\security\is-UK1IC.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):98
                                                                                                                                                                                                    Entropy (8bit):4.75309355004813
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:FGIWgjM0ePFUN1/6IGNDAPVn7n:8c2PFUqIrR7
                                                                                                                                                                                                    MD5:9107D028BD329DBFE4C1F19015ED6D80
                                                                                                                                                                                                    SHA1:4384CA5E4D32F7DD86D8BADDD1E690730D74E694
                                                                                                                                                                                                    SHA-256:B7A87D1F3F4B7BA1D19D0460FA4B63BD1093AFC514D67FE3C356247236326425
                                                                                                                                                                                                    SHA-512:81B14373B64CE14AF26B70D12D831E05158D5A4FA8CEC0508FEF8A6CA65B6F4EF73928F4B1E617C68DDEACFF9328A3D4433B041B7FB14DE248B1428C51DBC716
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:.grant codeBase "file:${jnlpx.home}/javaws.jar" {. permission java.security.AllPermission;.};..

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\security\java.policy (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):2466
                                                                                                                                                                                                    Entropy (8bit):4.437992103838927
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:24:hjrUah3ontU2H+h/ic1mo8vwwQcNpIjLSkLuodAZdgh1ykt0wS5:R4fc17wVNwltJU
                                                                                                                                                                                                    MD5:11340CD598A8517A0FD315A319716A08
                                                                                                                                                                                                    SHA1:C0112209A567B3B523CFED7041709F9440227968
                                                                                                                                                                                                    SHA-256:B8582889B0DF36065093C642ED0F9FA2A94CC0DC6FDE366980CFD818EC957250
                                                                                                                                                                                                    SHA-512:2B6DADC555EEB28DC1C553AB429F0CB9E3AD9AA64DFA2B62910769A935A1E6030A7FF0DDE2689F29C58D1B0720416D6B99FFA19BD23E6686EFB1547AFB7DCCFD
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:.// Standard extensions get all permissions by default..grant codeBase "file:${{java.ext.dirs}}/*" {. permission java.security.AllPermission;.};..// default permissions granted to all domains..grant {. // Allows any thread to stop itself using the java.lang.Thread.stop(). // method that takes no argument.. // Note that this permission is granted by default only to remain. // backwards compatible.. // It is strongly recommended that you either remove this permission. // from this policy file or further restrict it to code sources. // that you specify, because Thread.stop() is potentially unsafe.. // See the API specification of java.lang.Thread.stop() for more. // information.. permission java.lang.RuntimePermission "stopThread";.. // allows anyone to listen on dynamic ports. permission java.net.SocketPermission "localhost:0", "listen";.. // "standard" properies that can be read by anyone..

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\security\java.security (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):34305
                                                                                                                                                                                                    Entropy (8bit):4.856404441548362
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:768:rmLHAEcqrlANbwbqL1AdLAHaPw28Z5oSTEBp+Z5IcbJNg:rWQaYPPoSTEBpm26J+
                                                                                                                                                                                                    MD5:6C15D08174953959F1AA42D398AAF8C0
                                                                                                                                                                                                    SHA1:FBAFC8A8BD3697D936E31B6FF27C15A8BCED5E41
                                                                                                                                                                                                    SHA-256:C59821D1975C15E9A466170C9F01F77204E95C8D36C0A5B00599C2CA5F85FC40
                                                                                                                                                                                                    SHA-512:B26F68E126E0F050D53CFE9DC844C13DE315C24A00E419D7C6056C535547B13DB5C7872ED8DEF9702394112907BEA5243295EEDAE70BE3857F0B2BF89F992F84
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:#..# This is the "master security properties file"...#..# An alternate java.security properties file may be specified..# from the command line via the system property..#..# -Djava.security.properties=<URL>..#..# This properties file appends to the master security properties file...# If both properties files specify values for the same key, the value..# from the command-line properties file is selected, as it is the last..# one loaded...#..# Also, if you specify..#..# -Djava.security.properties==<URL> (2 equals),..#..# then that properties file completely overrides the master security..# properties file...#..# To disable the ability to specify an additional properties file from..# the command line, set the key security.overridePropertiesFile..# to false in the master security properties file. It is set to true..# by default.....# In this file, various security properties are set for use by..# java.security classes. This is where users can statically register..# Cryptography Packag

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\security\javaws.policy (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):98
                                                                                                                                                                                                    Entropy (8bit):4.75309355004813
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:FGIWgjM0ePFUN1/6IGNDAPVn7n:8c2PFUqIrR7
                                                                                                                                                                                                    MD5:9107D028BD329DBFE4C1F19015ED6D80
                                                                                                                                                                                                    SHA1:4384CA5E4D32F7DD86D8BADDD1E690730D74E694
                                                                                                                                                                                                    SHA-256:B7A87D1F3F4B7BA1D19D0460FA4B63BD1093AFC514D67FE3C356247236326425
                                                                                                                                                                                                    SHA-512:81B14373B64CE14AF26B70D12D831E05158D5A4FA8CEC0508FEF8A6CA65B6F4EF73928F4B1E617C68DDEACFF9328A3D4433B041B7FB14DE248B1428C51DBC716
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:.grant codeBase "file:${jnlpx.home}/javaws.jar" {. permission java.security.AllPermission;.};..

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\security\local_policy.jar (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v2.0 to extract, compression method=deflate
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):3035
                                                                                                                                                                                                    Entropy (8bit):7.503555903928921
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:48:9OAowMcekBBC8b5DigVAldrou1YgH767KWajaHgSCKVYt2WhqFidZ8Ea1iF:hBeYJFjIou1YgHqK3WA9KqkWEcBvF
                                                                                                                                                                                                    MD5:DABFCB23D7BF9BF5A201C3F6EA9BFB2C
                                                                                                                                                                                                    SHA1:517368AB2CBAF6B42EA0B963F98EEEDD996E83E3
                                                                                                                                                                                                    SHA-256:4924CBE86A60D93351C8955B924B714FFDEEA776B2621D84E3BAD99749C56DF3
                                                                                                                                                                                                    SHA-512:16A6AC1BD13F9974118EBB444E4A10DB6D55696A1363BC865E9C0BCC3A285438944C167F1B2FCF549970C9075ED6290D6C1A4C1BA94E64B4E84697BF8D317B64
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK.........V.C................META-INF/MANIFEST.MFe.AO.@...;..a.....T...m..Rk.A=.ey.....(..K.x.6.L..)q....t+P.d...Cc..F...) ...,.......j..}..]...4....u......-.zeg.H.G.I.K.L:.J...J.%./.i(..A@.@K......^...V..n..."a..EX..z..3>..-v.CnD..'.S.....>k_y&>l...n...}......O>.....PK..U..g........PK.........V.C................META-INF/ORACLE_J.SFu..n.@...=.....A..E....`../..3.#.........&m.;./.Y..\P...e..b.tYZ....4.g.q-.5>~.\k..)>....d..2....+.7.E.v+.o.o'YR6n."....IG......6.....ap|..~8+z.n......T.q[...a..3.E..T{.~..-]C@y.R.K...6..~..(K....9J..@.|_...VCJ...{.e".H.vL...8.DP.....@(........m.......9n._2.z4..s8.....e..K.....P....A.'.m6a_..PK..+{. /.......PK.........V.C................META-INF/ORACLE_J.RSA3hb...........iA....&.+L......l..m....,L...........2.....q..f&F&&&fK..v..s.,.@.....8.CY..B.a..a&gGC!....].3 1'_.1.$.P.@.$.%,.\.....\._\Y\..[....l.l.......J,KT..O+)O,JUp.OIU..L...K7.1..)b...rvE.Rpv4...5440.b3....( ...5.r.....i.I.......s@.E..E.%..y...A...GF`.27.......aK....ol.."P...l

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\sound.properties (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):1210
                                                                                                                                                                                                    Entropy (8bit):4.681309933800066
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:24:va19LezUlOGdZ14BilDEwG5u3nVDWc/Wy:iaLGr1OsS5KnVaIWy
                                                                                                                                                                                                    MD5:4F95242740BFB7B133B879597947A41E
                                                                                                                                                                                                    SHA1:9AFCEB218059D981D0FA9F07AAD3C5097CF41B0C
                                                                                                                                                                                                    SHA-256:299C2360B6155EB28990EC49CD21753F97E43442FE8FAB03E04F3E213DF43A66
                                                                                                                                                                                                    SHA-512:99FDD75B8CE71622F85F957AE52B85E6646763F7864B670E993DF0C2C77363EF9CFCE2727BADEE03503CDA41ABE6EB8A278142766BF66F00B4EB39D0D4FC4A87
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:############################################################.# Sound Configuration File.############################################################.#.# This properties file is used to specify default service.# providers for javax.sound.midi.MidiSystem and.# javax.sound.sampled.AudioSystem..#.# The following keys are recognized by MidiSystem methods:.#.# javax.sound.midi.Receiver.# javax.sound.midi.Sequencer.# javax.sound.midi.Synthesizer.# javax.sound.midi.Transmitter.#.# The following keys are recognized by AudioSystem methods:.#.# javax.sound.sampled.Clip.# javax.sound.sampled.Port.# javax.sound.sampled.SourceDataLine.# javax.sound.sampled.TargetDataLine.#.# The values specify the full class name of the service.# provider, or the device name..#.# See the class descriptions for details..#.# Example 1:.# Use MyDeviceProvider as default for SourceDataLines:.# javax.sound.sampled.SourceDataLine=com.xyz.MyDeviceProvider.#.# Example 2:.# Specify the default Synthesizer by it

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\tzdb.dat (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):104311
                                                                                                                                                                                                    Entropy (8bit):7.115241198657748
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:1536:5cUFmdKPGLn+hkpoVSdTMB0q/////tj7aqH3RX9rUDRuqmotqegJ+ZNRn:5Ar+iaVgbqH3RNrMRuqlQeg0ZNRn
                                                                                                                                                                                                    MD5:C74BC13CB02B49BCD1E026B70BBE37B6
                                                                                                                                                                                                    SHA1:F14B2A4609B59C588BD3044546B1E3B5CFBC69A4
                                                                                                                                                                                                    SHA-256:05D8C8645CA07EDEB988BC94A9D8444D12F33AB4CF3AB1C131916A0A0C6516D4
                                                                                                                                                                                                    SHA-512:6F8109ED2A3C0841DD92F60F944E8DC73AB9925782F3BF13E0E39DB4B5C225CBFC7559B544B75DA68BB5664753D9F4B4E7FD0F942ACD8D148781544B7B1A92C7
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:...TZDB....2016i.U..Africa/Abidjan..Africa/Accra..Africa/Addis_Ababa..Africa/Algiers..Africa/Asmara..Africa/Asmera..Africa/Bamako..Africa/Bangui..Africa/Banjul..Africa/Bissau..Africa/Blantyre..Africa/Brazzaville..Africa/Bujumbura..Africa/Cairo..Africa/Casablanca..Africa/Ceuta..Africa/Conakry..Africa/Dakar..Africa/Dar_es_Salaam..Africa/Djibouti..Africa/Douala..Africa/El_Aaiun..Africa/Freetown..Africa/Gaborone..Africa/Harare..Africa/Johannesburg..Africa/Juba..Africa/Kampala..Africa/Khartoum..Africa/Kigali..Africa/Kinshasa..Africa/Lagos..Africa/Libreville..Africa/Lome..Africa/Luanda..Africa/Lubumbashi..Africa/Lusaka..Africa/Malabo..Africa/Maputo..Africa/Maseru..Africa/Mbabane..Africa/Mogadishu..Africa/Monrovia..Africa/Nairobi..Africa/Ndjamena..Africa/Niamey..Africa/Nouakchott..Africa/Ouagadougou..Africa/Porto-Novo..Africa/Sao_Tome..Africa/Timbuktu..Africa/Tripoli..Africa/Tunis..Africa/Windhoek..America/Adak..America/Anchorage..America/Anguilla..America/Antigua..America/Araguaina..America/

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\lib\tzmappings (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):8400
                                                                                                                                                                                                    Entropy (8bit):5.164879464727495
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:192:qwfOC9OYOxUmHomjgDwlZ+TFXsq2H+aUHCHQj4mEo:qqgniTyq0iV
                                                                                                                                                                                                    MD5:7D4ABBCFB06D083F349E27D7E6972F3C
                                                                                                                                                                                                    SHA1:EB91253590526F7BE7415839CCBF702683639C8C
                                                                                                                                                                                                    SHA-256:D936EE24810B747C54192B4B5A279F21179FE3CEB42D113D025A368EBB7CB5A7
                                                                                                                                                                                                    SHA-512:E5C2FBBC07CD53BAF14F3CC239B56B42B73DE47F9B7904AABF7D97695D2AB8866D0C8179235CBF022245949B9B8E419985E328AA5ED333B14B8B4DE2C82B225E
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:#.# This file describes mapping information between Windows and Java.# time zones..# Format: Each line should include a colon separated fields of Windows.# time zone registry key, time zone mapID, locale (which is most.# likely used in the time zone), and Java time zone ID. Blank lines.# and lines that start with '#' are ignored. Data lines must be sorted.# by mapID (ASCII order)..#.# NOTE.# This table format is not a public interface of any Java.# platforms. No applications should depend on this file in any form..#.# This table has been generated by a program and should not be edited.# manually..#.Romance:-1,64::Europe/Paris:.Romance Standard Time:-1,64::Europe/Paris:.Warsaw:-1,65::Europe/Warsaw:.Central Europe:-1,66::Europe/Prague:.Central Europe Standard Time:-1,66::Europe/Prague:.Prague Bratislava:-1,66::Europe/Prague:.W. Central Africa Standard Time:-1,66:AO:Africa/Luanda:.FLE:-1,67:FI:Europe/Helsinki:.FLE Standard Time:-1,67:FI:Europe/Helsinki:.GFT:-1,6

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\jre\release (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:ASCII text, with very long lines (427)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):527
                                                                                                                                                                                                    Entropy (8bit):5.400635858865135
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:12:Gck18B8WJWJ2lsPhzVimiKEXgvQ9CDLnL3y9Ti8sBZxY2+y+E:Gcc8B8PQlsPhxREXN9CiarYfy+E
                                                                                                                                                                                                    MD5:5315D5C93B76ED601622A1E980D783E1
                                                                                                                                                                                                    SHA1:FC5642C67D55C7E5BE2435B6D294CBAE60067CAD
                                                                                                                                                                                                    SHA-256:14C8D16D378DC686BEAAC59470775BAFE38FA2659182D31EB31691F109864375
                                                                                                                                                                                                    SHA-512:86C6610202CD9A481BB219BD1C643FADED5E16028378987430C776EE838AD34A87649686FEC9DD61A3CF4F53FCB3962CC4601A6C00DEE24FB73C2B950D815365
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:JAVA_VERSION="1.8.0_121".OS_NAME="Windows".OS_VERSION="5.1".OS_ARCH="i586".SOURCE=" .:f2b5b6ab1f55 corba:386e9b79fcf5 deploy:7130ca3292fd hotspot:90f94521c351 hotspot/make/closed:bb6215e98e28 hotspot/src/closed:5c67a72be91c hotspot/test/closed:262c6cd71fd1 install:709a5016570e jaxp:b8d4e4724071 jaxws:5b8834cc3bb9 jdk:2974746e5619 jdk/make/closed:14736f778a50 jdk/src/closed:784a1cdcf90e jdk/test/closed:75844215d99a langtools:f634736433d9 nashorn:fd548ea7e156 pubs:6c3449393359 sponsors:d32775ed283a".BUILD_TYPE="commercial".

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\Java-WebSocket-1.3.0.jar (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v1.0 to extract, compression method=store
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):103165
                                                                                                                                                                                                    Entropy (8bit):7.91547566027566
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:1536:KZVgVWf2NftQJndvpyVn6P9Fh1jGJY6RSVTMj/YxHvKc5JmqZbn:fXzEGn6lFh1jGJZSYglvF5JLbn
                                                                                                                                                                                                    MD5:AA4C5E5448646AB936094EABBECCA98B
                                                                                                                                                                                                    SHA1:DB2658F013FB163DE4A99274C2EB9E17EFE535D2
                                                                                                                                                                                                    SHA-256:01FA37060692B85BB704567081B61EEE133B529540CE9143E258E267F5738A74
                                                                                                                                                                                                    SHA-512:608A28E1A812661EA38F2FE77F35EF7196F64A1CE93327B9B8D2BB5C9AE1D4BE9E40C0DE731206DAA23E7F644C68EDB4C19FF27F3D17EAF24903561C8F53E561
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK........@..B................META-INF/PK........=..B..!Of...|.......META-INF/MANIFEST.MF.M..LK-...K-*...R0.3..r,J..,K-B...V..+.$x...R.KRSt.*......3R.|..R.x..J3sJ..).e.)...]..l...z...\.\.PK........<..B................org/PK........=..B................org/java_websocket/PK........=..B................org/java_websocket/util/PK........=..B................org/java_websocket/server/PK........=..B................org/java_websocket/exceptions/PK........<..B................org/java_websocket/framing/PK........=..B................org/java_websocket/client/PK........<..B................org/java_websocket/drafts/PK........<..B................org/java_websocket/handshake/PK........=..B.O1............org/java_websocket/util/Charsetfunctions.class.U[w.U....I........&......mi1...[..8.N..L.L(....._..U.d-..'.....~gfH/L.>d.3..............~R."&".T.)..e\Q...f.taV.8.W..U.YP.....~3??P.!...0..nQ..%.i....+.a9.S.!...!..`.(..XB.n/.V~.qlgXwM.p<sC...,.N..S6...v.A.M.M.t.$..{.%4...1-c.R\4.Ym.@M

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\antlr-2.7.7.jar (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Java archive data (JAR)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):445288
                                                                                                                                                                                                    Entropy (8bit):7.945038655186032
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:12288:RibwIBDZs3iyr0FgTxf2sH/yZGUHf23XduYVc:R6BDDsTxf2gySdRc
                                                                                                                                                                                                    MD5:F8F1352C52A4C6A500B597596501FC64
                                                                                                                                                                                                    SHA1:83CD2CD674A217ADE95A4BB83A8A14F351F48BD0
                                                                                                                                                                                                    SHA-256:88FBDA4B912596B9F56E8E12E580CC954BACFB51776ECFDDD3E18FC1CF56DC4C
                                                                                                                                                                                                    SHA-512:311C3115F9F6651D1711C52D1739E25A70F25456CACB9A2CDDE7627498C30B13D721133CC75B39462AD18812A82472EF1B3B9D64FAB5ABB0377C12BF82043A74
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK.........Y&5................META-INF/......PK..............PK.........Y&5................META-INF/MANIFEST.MF.M..LK-...K-*...R0.3..r.JM,IM.u........X*h8...*8........(x.%.i.r.r..PK..R..WF...F...PK.........Y&5................antlr/PK.........Y&5................antlr/ActionElement.classmS.R.P...-M..-,bQA@I.R...,.V#.....p).i..Q..'..@.u.....M.j...9.=....~..0....0.D?t..d...hJ.+.M....j..p].....V..qG.]...'..y.32..8+.9....-.)..>.f.3..m:.\..,..gHZ....m...!1c9.?.0.....^n.3.U..G.[.N>..._t.9C.a9|.V..^..I"...=.'...K.u+.}z!.E1H`.rs.J.}7,GXdN+R).5o./[".6...d.*w.ia.b..*."-aA.".U....GXR......*...O%.*.aU..u<W..E.%...a.x......,#4....xE.!.T.a..7l..4..Hj..sL...M.v|.bN..F. ...nN 1.`..1....&I...*9$." ..b9.Y.:Z.A.`Y....Z,v.!.7.k.S-eQ.`....v:.]n..y.?~..nl.D...|sX'u...pz.S.)a..q..yJ?yJ'.+\m.#......8.BqqO.g..sD..k.,b...G`..!.Su....~....!.od.p.h....h.sQ....4z1.>....ap...MA.. y.%[G._.....RT..K...&. ......wt........[...T.Ot.9B..]G......3dM..v...u...6L.R0....PK..YT}........PK.........

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\aopalliance-1.0.jar (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v1.0 to extract, compression method=store
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):4467
                                                                                                                                                                                                    Entropy (8bit):6.818051358498124
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:96:sgAXUQVJuaS2cXIerWlBHv4wYDZIzy2z64uqVu:sggUQV0p24WQrDyNHFM
                                                                                                                                                                                                    MD5:04177054E180D09E3998808EFA0401C7
                                                                                                                                                                                                    SHA1:0235BA8B489512805AC13A8F9EA77A1CA5EBE3E8
                                                                                                                                                                                                    SHA-256:0ADDEC670FEDCD3F113C5C8091D783280D23F75E3ACB841B61A9CDB079376A08
                                                                                                                                                                                                    SHA-512:3F44A932D8C00CFEEE2EB057BCD7C301A2D029063E0A916E1E20B3AEC4877D19D67A2FD8AAF58FA2D5A00133D1602128A7F50912FFB6CABC7B0FDC7FBDA3F8A1
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK........"ws0................META-INF/PK........!ws0................META-INF/MANIFEST.MF.M..LK-...K-*...R0.3..r.C.q,HL.HU...%M.L.x...R.KRSt.*A.L....u....4.K..|3...+.KRs..<..4y.x..PK..Y``]_...k...PK........"ws0................org/PK........"ws0................org/aopalliance/PK........"ws0................org/aopalliance/aop/PK........"ws0................org/aopalliance/intercept/PK........"ws0............ ...org/aopalliance/aop/Advice.class;.o.>...}.vv.&F....t.........T.[.1.,39.....A +.,Q?'1/].?)+5....+8..(9.-3'.....V.............X.$....PK...3..e...q...PK........"ws0............)...org/aopalliance/aop/AspectException.classuSkS.@.=K.iC.P.<.)".....A..FP@G..>...h.t...R......Q.w.BK[....s.wo.......=.m....3L.h..ig...+.".z._...Y.-..a....4.3.m.*..{...K%3...;5..Zv.. .<3...5..`.C......|1.......r.`....P..sB..e.r...FA..(.n.......n.T-).E...t..s..q.....~./...3.R.C..M[..UX..6...,d....;..uy..<^P ..c..b...OBJj.G.P.$.%.g.m..aPmi@;..5r...].)....my/..j.o.^.\...BW0..9O...f.r\.O.

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\aopalliance-repackaged-2.2.0.jar (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v1.0 to extract, compression method=store
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):14867
                                                                                                                                                                                                    Entropy (8bit):7.303064978164189
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:192:Qq+T+P1Lq30PybEJmTROkz+MToaSA4/qvRvQGUwf0JbBUn2zoG4iCiNxx6MZv:kTEaRlMH1hBUn25AiNxxV
                                                                                                                                                                                                    MD5:5772DC62EF11F77CE60F26F9D325ED6D
                                                                                                                                                                                                    SHA1:038E954F6C768B3F097B169EC6C937327C179A4A
                                                                                                                                                                                                    SHA-256:0C699A71D20D6D4180B93B7443EAD7D37B057C92DAE8946738DF36BEB037953B
                                                                                                                                                                                                    SHA-512:87FDF1EBE7BA20EE54A687AB54C97CF0EFE8D546527F09A7649EC6DAB78ECDB074CAB114D3DB2CF392CFB1A43DE2BCB247B080B033B6D86EE063CE189B6CFF6F
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK........1l-D................META-INF/PK........0l-D........Z.......META-INF/MANIFEST.MF}RM..0..G...z..4e.n...-Z.%P..^+.~mL.;..~.{^....{..y3.f^.....X'.NIB.a..\..5.........TL).4.*...A.Y........;........|..w.B"....t..,...~U.y:..0X.R.hqI.Ovd..a.......QB..M&.Z...WVb 7..J.$G,T]f.0G.)....--0...x@H.$gG.c%kU..E^@.cS..2..Kc...Q.3+./..t...7....k..:i=...9..!w.........N.d...s......+......+...^1.v.....j.6....*...j..}\g.d...3....V..oE.A....mH..z...C..Xn1..T..h....9n*.sSVR.Lj%5....g...[.........aB.......h.lpi....[.7>.N.MPT........q...kG~..A...PK........0l-D................org/PK........0l-D................org/aopalliance/PK........0l-D................org/aopalliance/aop/PK........0l-D................org/aopalliance/intercept/PK........0l-D................org/aopalliance/instrument/PK........0l-D................org/aopalliance/reflect/PK........0l-D.c.wG.......)...org/aopalliance/aop/AspectException.class.T.R.P..N.M.RAn"*..Z.zAQ@......:...L..I'M...........|(..4...3..s.g.o..........

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\asm-5.1.jar (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Java archive data (JAR)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):53468
                                                                                                                                                                                                    Entropy (8bit):7.946464308228651
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:768:6rUAs5+v5mNz7jiKFCqX6ueeG+MXZWuNQM7KeLnq0hHtnZfn6hN1:u9knCqqus+8NQM26nqetiN1
                                                                                                                                                                                                    MD5:3770466405F163D6616B65C32E16A3CD
                                                                                                                                                                                                    SHA1:5EF31C4FE953B1FD00B8A88FA1D6820E8785BB45
                                                                                                                                                                                                    SHA-256:D2DA399A9967C69F0A21739256FA79D284222C223082CACADC17372244764B54
                                                                                                                                                                                                    SHA-512:A9246CFA56CCBB645C01FDBB77622DF351A9CC6FA4C4A61F0FD6D83AAAB951A7E625480FD759DCDA2423C53AA5CE9E31F254B1D23AB039C303E9AD0FEBBB0679
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK.........teH.2..*...........META-INF/MANIFEST.MF....}.AO.1.....h8.Ml.E.I...5.j...v.j..n..........2...9..O.....R..Q.H<..Ts.2./.U......2R..X.2.2......,.....0#.-.0..42.....`.v.7..|T... *.........z.3.....o...J.......Q.M.H...s..@.. l.F'..do..4......{.z-]...'...ni.....Q......x.,\.vsoZan...OJ.0.........Xj.......{_.Z..<B..N....GO.M....PK.........teH................org/..PK.........teH................org/objectweb/..PK.........teH................org/objectweb/asm/..PK.........teH............)...org/objectweb/asm/AnnotationVisitor.class..]O.`.....(+.....:']...`L..b...../.4M..R.~...&.%...~(.9m...3{..?...y....??....]..@E. .v.P.{b..w.'.....'.;......~....qt.^.i.....><.....}.&a..u..&l..{..u. ..........s'3..(L_.^.>.z...uU.<$(..9I.......'......'.........5E%Bu(+B=..@..$.>.f..AtJ.............H..=...7.f.>f.<.....<B..e....X..cId..E.D.E6D6EZ...%........H.v./..;...|G.9u,....y.....U..3.e.....\a.......c....A{...kH...Jp....w.b....1..W.....10.t.@w2.Y.K..i.....k..a..

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\asm-commons-5.1.jar (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Java archive data (JAR)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):47195
                                                                                                                                                                                                    Entropy (8bit):7.919628197363683
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:768:kvW0eN+uoWRYaX2NlWHD/ryAhCDZEJXw7hczLq+73EpZvnTDps7W0ug:kvWZN+u3RYcauD28QhjpZvnTMWq
                                                                                                                                                                                                    MD5:38839FB32C40F7F70986E9C282DE0018
                                                                                                                                                                                                    SHA1:25D8A575034DD9CFCB375A39B5334F0BA9C8474E
                                                                                                                                                                                                    SHA-256:97B3786E1F55E74BDDF8AD102BF50E33BBCBC1F6B7FD7B36F0BBBB25CD4981BE
                                                                                                                                                                                                    SHA-512:FDED045C23C97C0D4FF3D2166290CEADD8D6B97147611BCF10FB3AD42D2E22A97664AD7DCE92F491C18E7FBC437B6F333E53DD4D98E98F340E1B9257D7E6F22C
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK.........teH...9f...........META-INF/MANIFEST.MF.......O.0...K.?4;.M...e....0.05.\...=...v..........k?....).l....P.I.Q......? .2c3..=......q.4..."...$}..0z5f..u..@N..O..R.+0...4..{..F..Q..RhD9..tE..`....haly_,..".a0.k..~.\V.h.O%gt..Z.9...1.?..I.."........Yo..i.A.:]..@.w.e\. D...P..+.B*R:^.N.e...H.;..Ri.v].......u.*..j..4..b..^k..m{..s..|..Lkc...E..=.......<....-....;.....%e<GP..F1..cT..(.....PK.........teH................org/..PK.........teH................org/objectweb/..PK.........teH................org/objectweb/asm/..PK.........teH................org/objectweb/asm/commons/..PK.........teH.z.........-...org/objectweb/asm/commons/AdviceAdapter.class.XktT...n.q....C....&."....6..@(..@+.L..y9.`....'.][.. TF)* ...(.b+}S..ju...G..V.../..9wf.....e'k.}.~.}....s...^...o.....j..).U..c.>....p.}g.~.Xm.{..k.nP.&.O...i3.*...X.}.T8`....P}..k.W.)(a..5m...,.J...~S.Op#.6^}......4Y.W..H.D.z..@".[}C..5y.&_2...{..ws.&.op(_M.X.L.{8j.z]>.|. .g..7..;. .g..V=..4...G.M&..

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\asm-tree-5.1.jar (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Java archive data (JAR)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):29130
                                                                                                                                                                                                    Entropy (8bit):7.8024696790865535
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:768:R3P140mJQ1IVyzJHAAe/+MUQeLulefnt7:Rf147qIVyzRDe/bUQ0DnR
                                                                                                                                                                                                    MD5:45C1EF0811855157025215F92D55CBCE
                                                                                                                                                                                                    SHA1:87B38C12A0EA645791EAD9D3E74AE5268D1D6C34
                                                                                                                                                                                                    SHA-256:C0DE2BBC4CB8297419659813ECD4ED1D077ED1DD5C1F5544CC5143E493E84C10
                                                                                                                                                                                                    SHA-512:44B1F06FC040AC026F203243ABC859295858CCBF7DBA7C811F359F04B75C82F432FACC05AF888BB0D04E620411B04506DAA2AEA18D16109ADBFAD76425C24569
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK.........teHo.7.J...o.......META-INF/MANIFEST.MF....}..O.0...K.?4;.M..E,. 8..S....P..V......\.D.=....}....s06..6\I..(...d...+....{.I7..v..J2.....Fo..q.EL...;P...H.E..;.F...H..]OrTh.D.1....V....g.5.l....C&W\+Y....'Y.D..>.3%8..vF.l.&.Sj.)H.4F..H....T.h|r...l.Q.{C......z\.(F...P.h..RiR.<.l..6|".,.........Ao...=...r.{w.R@..G#,..G...>........:../..;..l.....$J.z...PK.........teH................org/..PK.........teH................org/objectweb/..PK.........teH................org/objectweb/asm/..PK.........teH................org/objectweb/asm/tree/..PK.........teHf.3.........-...org/objectweb/asm/tree/AbstractInsnNode.class.V]W.W......A>4.*.TC....+.m.PF&..$...C2..8I...~>...../}.D....].O....m.L....C....s......g..\.On.`..\.n...........ehd.1H.M...g...}..P.O..W...5-c...j.^.,jZ8.\2.j.....g.!kOZ@G@.S...5.S..p..J.".....\C2.U.Usu.s.,....o.;.ZuG.#o...7.zI7.E..r..Zk..Q+qA..=.n....!........,T.e-g{7.8......'......|....V..)4u...'...^.-.....dc4!.qB.*.Kr|6..nb&..

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\aspectjweaver-1.5.4.jar (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v1.0 to extract, compression method=store
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):1894165
                                                                                                                                                                                                    Entropy (8bit):7.937531525369528
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:49152:ayr92D9km2aFiIX/mB/05HiY5oMLwK7tzSz9fZULYf74pFEh:ayrh2X/mMHxzHCxm8f3
                                                                                                                                                                                                    MD5:9C4A8D4D468DCC2B299E3AFF39C0C5B0
                                                                                                                                                                                                    SHA1:39A53E53C38689B59EC1245F807CA4AF83D18DB4
                                                                                                                                                                                                    SHA-256:A2F2B2F9BD274AD8174C9D4F2E3934FF1235A287DDE737EA45DD8D707497F0ED
                                                                                                                                                                                                    SHA-512:1CAAE0C97680D4D0BA8A1CD0155D58726D19282CDD694D9E4575E26092FCE470AB2FA26993C77C04597D1A413B51F74A4188B497C329B8F46266751B976BB55C
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK.........m.7................META-INF/PK.........m.7................org/PK.........m.7................org/aspectj/PK.........m.7................org/aspectj/weaver/PK.........m.7................org/aspectj/weaver/loadtime/PK.........m.7.Q.....Q.......META-INF/MANIFEST.MFm.A..0.E.9E..TA7....Q...N.H2)I...j.m].....0....`....^.=84....c.n.....|RK5...3%..r...:@...#...%X..,...#G..j.q.E..~\9...=j.ND.tn:.t@......zh.9.e..D....`K.j|....(^PK.........m.7B."o.......'...org/aspectj/weaver/loadtime/Agent.class.TmO.A.~.-\)....U.Z.=L|.BL...R..$!~ K..#.....Y.....7M.Q..mCQ.br....g........0.A/.=....c...C..iLf...b.i..L9(1..m?TZ6.".\.Q.0Q.....xX.:/.........<T.#....ty.R..z..b..L...~.....Bq.!.....@...fcG.....%W..<...7..1.w}.0V.d..*.U...../..D........OHN,E....|.\..Z.a}.j...(6gej...J..d.....B.xU....MRf=j.04..vV6Y...P.Y.e....Y..0..x..f.GR..j,....CU........=...#.*..{..]..{M.3&.7..M.]....t.a.oS.._.bMFU.T$m.5.k.4..N.a......y2._.B.~^.m...r.?...}.)n".....D>.2...)03..9.y.....C.p.d.5^.0.l.

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\commands-3.5.0.jar (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Java archive data (JAR)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):105796
                                                                                                                                                                                                    Entropy (8bit):7.800513595088744
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:1536:anpyTWz5OlgiblUv3f/I4xRjhFzDLxMjkR5OGLBRIcuJ5ZaqEB:aeWYg3/fw4xRjhFPukR5/kjdo
                                                                                                                                                                                                    MD5:C8A1A8D216008D8136C7071CDC5274F0
                                                                                                                                                                                                    SHA1:7E3CCA18022216F309859120B50BE44AFF367C4E
                                                                                                                                                                                                    SHA-256:B0D371E8481C5D9562C08E41743FF818160CEE06F59EAAA4A22F29B16C83B371
                                                                                                                                                                                                    SHA-512:201BDD11D10A9C4866A3BC64E40C0E3C27A117B6AC5ED55AC81DD708D58064B233DBC2D813768FAC97D51A00AC24F5921B06DC6DDD82FBDA2CBA80AE09832307
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK..........:................META-INF/MANIFEST.MF.....Y.r.Z.}.........T.M ...Ah.$..@........%l.k;.)......{.......F..NY.P......w.....N...A.FY.......C.I......";..S.F..d....Q=.......{.T..cS.c...Tz..,M..... ..=..........k.IT...Y..].m........zY...c.A^:OVV\.$....?n....K...y^...6_L._...?..~..]!O@......cn...f.[.....A...C.S.....3....m._w...=.u[....T..dy.......c...:.....?......w..u..?..v~c........7..D}s2..o...zz.?........).}}..k.:..d].......?......^or.V....$G.f.T..['.9..B...H-.V..1..y..5u..7.&qA....D4. .L1;.e#R_...t...,....yv.o...Tm...e."..@.....XIq.).H..i:.c.Mu..jf.Q...<..MPVN....9...U..-.F`.*..g.0`.kh7.>..b-..Os.........:.W.0.....(@!.X..=)ZN~7N...ZIE.In.r.w.q.:K$..Q8;..W...t.}.. PA...6....yk..I...B..q@.%..1.v..9.x.R.....f....].[E....'UFU..p3I.m.V..Vc.B.(.-s.E.(..z..xM.S...z..2.J.l...J..l......^UE`.3|..[...8..d..4....n....]Z..KrV....a-.3...f..p_K._:.0..f.[.v..w..Nc...1.O.q%.]../..;.=.+xK&S....Jc...R/...k.|."...YV.aU....>3P...d!p$R.x6.+eg.L..#.u..

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\common-3.5.0.jar (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Java archive data (JAR)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):99430
                                                                                                                                                                                                    Entropy (8bit):7.879651872042793
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:1536:fVuMQH0l5o7AqfthPtSGjVGzgCt0MUMNxqZ5Wb1cLDS27sxKGSMkaILxZHY4wAY:dK0FstAgfnZw1ca2IwrMkzxZHY4BY
                                                                                                                                                                                                    MD5:2382BFA4BC9166A253357E690B8AB2DB
                                                                                                                                                                                                    SHA1:16016DED351D74151131E7525BD7731F10D66082
                                                                                                                                                                                                    SHA-256:3B155B06D1CA933907B30FA3A9AB282C5ACA775A96074D3B47E4B7B8690AEBA1
                                                                                                                                                                                                    SHA-512:F0D1692D2865504CD7220D2E3ED0C9714E7FDF7803D9DEC4AC621ED03D6E2CD6A3196BA9665BA89557A99C2B9AA3230E2BAA51D5E44D680486FDC9A546C9E564
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK........t|.:................META-INF/MANIFEST.MF.....Y[w...}...?.f}..".-..A.(.7.....A..4(.....I.:.;O&.rWw..]U...:.H.......J.F|..OC..ORdh.s...J..^.e.O..L........Q...=W..yj..u>../..?ER.....E..=..c....A.....P+...X3. .._...m. .......7.l.$i.\A..^....=.9.."... .9!.0...LC...v1..8..i...f.{_...:>Y....<...........$J........#.8F..;(.`...................I..~.Z.........xc.g@#.!By.~V>..t..\-..T... ....[@`;..9^.8..Q.<T...\.Z...<A ....3....K.........P5.F......B.K&Q.f..e$At.&I<5:.qMNl8+.?W|L.w .Y..?1.2......9Y.sN....7./.i.4l.\.GhW..!.....T4X.....p,...+.......J.....v.D...,..u..W.#......1^....Xi...2.V@O......6N.}L...|1..........c}9.5..."".....8.<..5..2.......48..]....zA..[.....|......4..0X3|-.DV.........2^.....N}?.Hy...?q)......$..3..X.q.:..>.&.NXr".U....z....q.Q..q...Fi<{.{....(_...9Bk.....SQ........k....K..rW.6G......L.1...sh5~.U/.|@..j...Ag..3M.....;?.b.....X....5..(Q.N..d...9..w.|a.0]..C..d.....Eb.0..o.&......n.tf....gU.....JI.G.......-.......y..z.

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\common-image-3.4.1.jar (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v1.0 to extract, compression method=store
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):86066
                                                                                                                                                                                                    Entropy (8bit):7.902460080040838
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:1536:CvEKwxhuIxcyvc0GfUGQiGQBL1LmwlgzHyzZLQwJ9x9GjnBGRc2HeX78IfjRu6ym:CvEKwx4IbvcXUGQiGGBLmwlqWZLXBGjJ
                                                                                                                                                                                                    MD5:A9B7A43A507277DB0544EE8C8A1AE521
                                                                                                                                                                                                    SHA1:48A6483960ECEDEC05CCCEFB17B95FACEF98C1DA
                                                                                                                                                                                                    SHA-256:E3717DA5E934D08CD11990217E25AF32948100E2346167AE7AE831DBD897EACF
                                                                                                                                                                                                    SHA-512:B8F14C1EC1C1AC7F4D00BA9F478C2E552F9AEFC99E5ABB56A7E9270F7C46D2876799044F4F59F9D14112E42499C913A79536984993D0A36E0BEBDE8DB1A80BD1
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK.........'M................META-INF/PK.........'M................META-INF/MANIFEST.MFm..j.!........-..%=.t....b.i.Uw..M...f[..A...........+...l.R-8.!B...iH...b...q.............Bi.d.'z......*.S.j..f....l...F...y...>.Vj."...EpWz=..h......T._.(.q.F.C@?.+r.sQ..|M..tq&~..K......9.i..{..g.PK...P).....T...PK.........'M................com/PK.........'M................com/twelvemonkeys/PK.........'M................com/twelvemonkeys/image/PK.........'M............(...com/twelvemonkeys/image/GrayFilter.classmSMO.Q.=.3.).`..".E...jh.G.#j..*D..a.P.(L.f(.4"n....51nL$$.\....._a=oZ%1.$..w....2..../..!.F.Nu .~....j...f4.4yJ.i.g......%...e.qA 8Vq+..L..<.P.Ef..*.=.Q]..Yk.!.....@.L.*.MZO|..2U*.T.R...t.6e.F.+<S...v."E.E.....FW.M...D.....#..tJ..0T.U....l...fo.g+Uk...K.$.H.j..9....O..l......[..S.&i..9......_v.#..U....M......#..z.@F9..1..~$/.#.@#^c.E.^a}.]..J..W(|...(...o.E.S.Wo....C$eH..O...R..5.I..}Y.N-....s.|..g...PD?...]..$.`.....x....M......c2s....,Rtt........I...g..'...k.

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\common-io-3.4.1.jar (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v1.0 to extract, compression method=store
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):90843
                                                                                                                                                                                                    Entropy (8bit):7.881156211227141
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:1536:r8V3wG0h1ETxJU3cGxK+nd7z4q/ZLPM3LcUpuquDYV/YgMmzwvBKGgcP5fparl66:r8VZlJcJd7LNsIUptv1FzwYGH+
                                                                                                                                                                                                    MD5:331071330075F62D047CB9F119FE4F1E
                                                                                                                                                                                                    SHA1:21F183828EF9431E007A67957CAB3AD4EA1561CE
                                                                                                                                                                                                    SHA-256:CB734241B1C11F7AEDE68E49D1AE8E71CE7E307ABEBFC4FE99535A2B3DDECDE5
                                                                                                                                                                                                    SHA-512:B1C6021F515B7E9793BC79D1539B4A782559519975151FD43DBFFD33E4DAE75ACE5B95C8E7A7E105438E519A628DEEED2A574896313179CDAFEE32E4C92CC979
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK.........'M................META-INF/PK.........'M................META-INF/MANIFEST.MFm..j.!.F.....P.R.x......$.-v.VYW...$o.i.?../........;T./Pj...Zp....zHh...L..#.G..49up.7.>`.#...3$...S..O.W.J.%g.1D........F_....T[........]..`[....$.sSux~.T...?...M....:.._zV..3.#.)...._.]..X...3..PK....B.....N...PK.........'M................com/PK.........'M................com/twelvemonkeys/PK.........'M................com/twelvemonkeys/net/PK.........'M................com/twelvemonkeys/io/PK.........'M................com/twelvemonkeys/io/ole2/PK.........'M................com/twelvemonkeys/io/enc/PK.........'M................com/twelvemonkeys/xml/PK.........'M............$...com/twelvemonkeys/net/HTTPUtil.class.V.S.g.~.....1.(*F..i...x".D.<.G.pI.\..d..K{.mm..v.3....V..L.....u...?h.)}..!.d....~..>....../.P.../:..@.....k).]x.<..2..T.Xu)X....!.=,....Q!.q....8..$N..qZA.|vh.....4.`....+.....!.`....#\....A.g.........\@.....JX.....>..aC....}...>..<g.....MW.....V....fn

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\common-lang-3.4.1.jar (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v1.0 to extract, compression method=store
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):121090
                                                                                                                                                                                                    Entropy (8bit):7.843174503783093
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:UAc9ivlkvwRxlXyoP+GBuEuf0Dq5O5ie1v3X:UAuiNkv6j2sWs+5O5dv3X
                                                                                                                                                                                                    MD5:A1898977D7A567EFDEDCE5AB2D157A74
                                                                                                                                                                                                    SHA1:294A093960AA1169A849544F83EE4A4686BFD408
                                                                                                                                                                                                    SHA-256:8AEF005944E1F3F0FCAE297B3868F7EFFE5AC4583369B51FC9F599B7CBB8D453
                                                                                                                                                                                                    SHA-512:D4DFBF886B4C5B33DBDDF6E9168070084C70D04DE211F6E06829AEEE44D4AD0850AE9A7FE4AB1490D9385CC4872C402EB37379C29363DBB08B1729D124C61A27
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK........s.'M................META-INF/PK........s.'M................META-INF/MANIFEST.MFm..j.!...........%=.t!...b..*..n...4.........V6.w((_ ..'#.j..."t..".i.\..8}@...S..rC..F0./P7C..;z.hSs'..s..j..n....l...F....y..k..6j.!.!.Ep.z;.........T=..(.q(F.&.......W?.4].....\.0A..?D....]p...PK..P.|.....R...PK........q.'M................com/PK........q.'M................com/twelvemonkeys/PK........q.'M................com/twelvemonkeys/util/PK........q.'M................com/twelvemonkeys/util/regex/PK........q.'M................com/twelvemonkeys/util/service/PK........q.'M................com/twelvemonkeys/util/convert/PK........q.'M................com/twelvemonkeys/lang/PK........q.'M............*...com/twelvemonkeys/util/TimeFormatter.class}..J.@...ibbc4U_..H.A<V...B.C..M.......... ......g.....f..........%.#.H..0.q...,U..@3n..Q....G....^JB.)#o[..f!..n....aV.:.O..H].G..N[..t..........L.Q....y.6..*GJ.o...7F...;......W.l....w.J..?..}~.8....`V.\.q.f...4...{........{...~.8.

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\commons-collections-3.2.1.jar (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v1.0 to extract, compression method=store
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):575389
                                                                                                                                                                                                    Entropy (8bit):7.869228657414263
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:12288:qUcq8DW8VFxPcJdP9YtFtpoBZJmsbgp+TJprWIkPT:ncq8DWiPcJl9u/oBfmXntPT
                                                                                                                                                                                                    MD5:13BC641AFD7FD95E09B260F69C1E4C91
                                                                                                                                                                                                    SHA1:761EA405B9B37CED573D2DF0D1E3A4E0F9EDC668
                                                                                                                                                                                                    SHA-256:87363A4C94EAABEEFD8B930CB059F66B64C9F7D632862F23DE3012DA7660047B
                                                                                                                                                                                                    SHA-512:8D0AA0E4E328C2E391D4D972F361A19FF085F508CB0478F5967280953ABD3520EE92CC1D19B21CB4E29E4A7BC557487DDBAEE9807B751824241269367B9E92CB
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK.........|.8................META-INF/PK.........|.8....~...........META-INF/MANIFEST.MF.VKo.0......z..q.mm]..'.6..%+v.T.N..!.y....N.'.!P@....)zD...6..(.e......b........d..)l.N.5.:.......y...4K.3%.V..5.$..j[......s*..@....T..S.|.A...!1.{g.....8...S.`.F.2}.$.* .....2<.22k..<.,.....3.."....UU.s.w..5M...Q.[...#j.._.].\.3..b.<.?.E...Us05.-.|..$..].....z...v..=Q.uo8.{.O....\.1EI.2..%.C.\.+3.s.......Y.....H..}..&.g..T(....,."P.+...|....yZ..*j.j*..4..,aG.{...5(7p.m.O.Y.vEE.]..k.. OK.....|...|Da.'.3..d...8.}..........<l..tShyL-Z.d...t.a....mf..D..jn1.9...#O.{?.h.<.&.....H;..:2..z.|.?.J|..)..B5...YPC`cp.....y..P.....".Q...R-....%....d.~.wK.-..b.%...F.g.....`.UY.O....U.z.>lk&..H.<x....K...PK.........|.8................org/PK.........|.8................org/apache/PK.........|.8................org/apache/commons/PK.........|.8................org/apache/commons/collections/PK.........|.8............#...org/apache/commons/collections/bag/PK.........|.8.........

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\commons-io-2.4.jar (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v1.0 to extract, compression method=store
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):185140
                                                                                                                                                                                                    Entropy (8bit):7.9216858474735306
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:pF6mb9NczTyPXoTt75AQ6oBoEfDmwFHb/1Vd23l/ODoxb7DcKK:pYmb9iz2W75JLKEfDmwTVdilnxb7DTK
                                                                                                                                                                                                    MD5:7F97854DC04C119D461FED14F5D8BB96
                                                                                                                                                                                                    SHA1:B1B6EA3B7E4AA4F492509A4952029CD8E48019AD
                                                                                                                                                                                                    SHA-256:CC6A41DC3EAACC9E440A6BD0D2890B20D36B4EE408FE2D67122F328BB6E01581
                                                                                                                                                                                                    SHA-512:957A438894A196E534AF9AE1E61FB21E16F273952B55A81ABB8FAF0B139FC031EA940CF477F81704DB417D1CE6FF2D9DDD4A2CBF316903B0E2DC1AEAEF24F292
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK........v..@................META-INF/PK........u..@z../............META-INF/MANIFEST.MF.Tao.@..N........4&.Z..S.T..o..2.K......Th.k.`....73o.2).....:.J..s\....J...... JG.K._..U.(.9B].V....t.>~.Z...Ev..2.._............Lss..y.3TnNP..1O....)!.jn.1.....x.e.............5N........01.cX=...m.:G..z..(..)....Rq@.eH=..-..)...P.,V@.J9d..f.4.[......q.t.m.S.b).?4.0.:..d.g+c..^..f`.v\.g..x8..G.w\..=..I...f,9.#....S.+]0...w7..-...f.....E|.A[e..f.C..@X.f.`.^A..A..<..)w.r.!w...RD...;....Q.Z...ef.B..p.^..?.....\.y.....n .Z.......I,.5.....Z`,7"...1.p.-.....(!..P..IR-..^l.`;...f2[.;...Z'g2$I.W$Q..Z...'{..L.p.P....m..aQ......S{.n...$.....Q.'.E...R..~jzm,y..@.!+....hqE........[{..~..j/.yw..J...~.C.oyFv..e[.PK........M..@................org/PK........M..@................org/apache/PK........M..@................org/apache/commons/PK........N..@................org/apache/commons/io/PK........N..@............!...org/apache/commons/io/comparator/PK........N..@............!..

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\commons-lang-2.6.jar (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v1.0 to extract, compression method=store
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):284220
                                                                                                                                                                                                    Entropy (8bit):7.94847674828362
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:6144:0QyyUK6j4lplvLt3UnSXGn1N5YzKrRFOo0mf2KjCciWZMPh:0zol3vLxqSX4vYsI6lCc0h
                                                                                                                                                                                                    MD5:4D5C1693079575B362EDF41500630BBD
                                                                                                                                                                                                    SHA1:0CE1EDB914C94EBC388F086C6827E8BDEEC71AC2
                                                                                                                                                                                                    SHA-256:50F11B09F877C294D56F24463F47D28F929CF5044F648661C0F0CFBAE9A2F49C
                                                                                                                                                                                                    SHA-512:4A5A3DBE4941C645E2CCA068CCA5C1882CFE988B02E7CD981D1E51784900767D1DEAB0E0E0566F559C9FCABB4A180E436D5BB948902D4F4106F37360466AFB42
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK.........->................META-INF/PK.........->.^.VH...........META-INF/MANIFEST.MF.TKo.@..[.....V...M".z..J...B..e=.M.]kw...wl....pA.|.....*FG.3Z....U...;+.j....).u.`W.EA...M.....[M.8.5....m.a.`.e.....J..f..Po.D.0z=.}o.f...I...SE.v.g..h.#..o0.#c;0] .eB........uT.N.A..c.(..@U....d(U.....C..oV..W...J0...J......>.KSa.H.R...K....b...C...&.8D.._.[.o.lxqY....A...#.8_.%.u..H.xF.u.Q...b\..$fIe.:.....i.N...'(..va.-.P.9.>....1I..:..a3l]_.wIG..."}..U....W....Gc.."_..V.K...n.o....19........[.e.Fc.Z.z......A..8..-n.....V..~..%..[.&..X..I%.6 ..X..bq,.7].v.Z..b.J..S..p.Ph.?u.K.9%@...X.-F@.f.........@....;R..p.....X?.w5.3.o.....f`......w......=...PK.........->................org/PK.........->................org/apache/PK.........->................org/apache/commons/PK.........->................org/apache/commons/lang/PK.........->............ ...org/apache/commons/lang/builder/PK.........->................org/apache/commons/lang/enum/PK.........->..............

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\commons-logging-1.1.3.jar (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v1.0 to extract, compression method=store
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):62050
                                                                                                                                                                                                    Entropy (8bit):7.921403317877874
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:768:Oirgim03eHcOSlWmuvjpNToHSQfWZy2VDfEXsHtprlPox2u+nA5q5ddrSxw3qKrg:Xtmjc+TbT4SKQ5VD7Zi2u+niSddrtvrg
                                                                                                                                                                                                    MD5:92EB5AABC1B47287DE53D45C086A435C
                                                                                                                                                                                                    SHA1:F6F66E966C70A83FFBDB6F17A0919EAF7C8ACA7F
                                                                                                                                                                                                    SHA-256:70903F6FC82E9908C8DA9F20443F61D90F0870A312642991FE8462A0B9391784
                                                                                                                                                                                                    SHA-512:E5D1FC8EC4544E1FA0F7C4AAE8DBCCA466C4987BC92FBBC430B054B10D646B745ADD4A754B1BE9D50EDD64330C798C53173A97289DB57A966312E16F934E9D1F
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK...........B................META-INF/PK...........BY+.R............META-INF/MANIFEST.MF.T.o.0...)...o...h.T..RV.....&US.&&..;r.B..].@.. ..w~..^.L...,~.&.Z....u..T...X4c...6.a)...Dz>.*#R'.P..b.<?....QKu.t.M.<......).se..s<.V.....WX.....5DV..Xk..K.cJ.^.....W.6!.O9.........~.\.U..`...e..(...#.*...E.U..Sk..,.b.....p...:..}....[..u..!k...v.u~c......I..7W?.!....N..~(..Z.\.{#.c8.<.f..2`......d..u.#...oX...>.G.....~B.'..j.+.w..2;.1..0`........o.koq..)....+.EF..:>..D...S...Yj.ALJ]..H..Hrp.a..g#..c5.v.M....R...B....5.|........o7k....J.N..D.R.Z.=W...[........L.Rv.+..f.G.z.5..g.x_...u.Vdb`+.mf.zr.~I.s..*'.(....JB.....B...C..x.... ..(....?*.y..=....;......v.V-=z.{ll.k.Wq.S...g.;y`.j.....x9.^_...O....}..nh.4h..3.{4.^..c..a9.V._=....M...]v'.2..&.:...PK...........B................org/PK...........B................org/apache/PK...........B................org/apache/commons/PK...........B................org/apache/commons/logging/PK...........B............ ...org/apache/common

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\commons-net-3.2.jar (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v1.0 to extract, compression method=store
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):275501
                                                                                                                                                                                                    Entropy (8bit):7.911690321268742
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:6144:LB9LxX3zUbllVwh9Zgo4jkHtLnS9IyGI1vzPxTxvDVUMcoVlQjM:LBdq5DwPZZTNLfyZx1jQQ
                                                                                                                                                                                                    MD5:9B31EA48800BB3209976244AE0313066
                                                                                                                                                                                                    SHA1:F76FF64F941E71395A0E07CAD82EE44310EEA842
                                                                                                                                                                                                    SHA-256:A42C7D7DC78324877A2BCAE9367A8E675ED4B90A813336B1D7CB8ED9F1EE5D58
                                                                                                                                                                                                    SHA-512:FC3031B0CACC123BA3D4062F772061D9B533951E7E3AA91EE078045AD51FE071EAC0CC49B4BA24AECB784B7942E6F5D01B253866944D056B9B875B589C9CC8A1
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK..........zA................META-INF/PK..........zAN...............META-INF/MANIFEST.MF.UQs.6.~g.....vjd0..&3Mr.L.....k.2..m5Bb$....+ ....`.o?vW..D..36....J&(..Mv..6...B.,AJ.1)..0LU.+i.d...\3........A..=t..9)>..!....<?.K..x2n(.Y?...3.....c...w^..~......Ks...s......#n.........O.......S.....v....K7D.]^........|s....'I..\.WbY.lG.B0.s...`.Jim.3.Z.R.]...ZN7..k.:..=.w.%.b.Rn..tW.f...m..n..2l...T)..[......dyG..L.....n....Z.-...Rf.....!.&.[.....?.Pf....2i`scm.........o(.m3||.....`.Clw..b./..f$.p:..?.....O.|l...n.^....p....[.&.:....4..e.4.S..$.].\.k....T.).......,...8..8|....6W....Gb.Te.4.#.........E|.....Uu.....2C5/l......|...#......|....@..d...J. ...r. ..B+.......(.wE..b..pIE...L......w:...z....<.e...-...H..F..Prs..M....J}.XG..7..ute.K^..S./..t.l@^......#... xb..A....&x..u........}Oa...t....G.,Y..l.>......]D.x4..Fa4..(.}F.8..$...-.0.O...<7.n8..vy..4.m..|.?PK........f.zA................org/PK........f.zA................org/apache/PK........f.zA........

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\cron4j-2.2.5.jar (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Java archive data (JAR)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):36227
                                                                                                                                                                                                    Entropy (8bit):7.810477260501331
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:vYFvW/gSOv69kRuCUcGgBcTVZIXARuBsnHqMLGYrsmP8T9KcAYCefMwQz89+uPrW:AZJv69cuScJZZRuGnKYIRCefWA90nkK3
                                                                                                                                                                                                    MD5:27E8255EDB875A3ABA695D1F9432244F
                                                                                                                                                                                                    SHA1:DA0DD0EDEE48B570CD1E23895E0AC80E09EB272B
                                                                                                                                                                                                    SHA-256:51339030FE1A20B428F4A21A9EB8A901F401020B27893D6014FB10D197D83731
                                                                                                                                                                                                    SHA-512:8492870BD073F73E5856170309E9B457FF66396625CDCE419DCC7835068C51D05132C4E6D73C55EBAF92370A677E5A32D436A3DEE07B63AA9CCFDE778027506E
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK........]..?................META-INF/....PK........\..?x.-S^...j.......META-INF/MANIFEST.MF.M..LK-...K-*...R0.3..r.C.q,HL.HU...%-.x...R.KRSt.*A......t....4.K..|3...+.KRs..<..4y.x..PK........]..?................it/PK........]..?................it/sauronsoftware/PK........]..?................it/sauronsoftware/cron4j/PK........]..?W...........5...it/sauronsoftware/cron4j/AlwaysTrueValueMatcher.classuN;..P..ML.7..l...5."....H..g|jBL yQ....`..<.........av...?...Va....A.GA..1...<Bi.l..:H..vg.U..l....d.&q.l.I.J.L...D'y.i.<..j^xUJh..(E$.X.C.kB.._+.08'....7.`...b.b...(.PF.+....(]>..PK........]..?s.|.........)...it/sauronsoftware/cron4j/CronParser.class.W.W.g.~&;.......2...,..6....4.J..&.B.-..............Z/.J....Z...............s<.....;{a.%.9|.|....{...}..[.....Q.n...u......x\B....."2..dX.9(aH.....*...".\.0. .Q.q<......xx....#HJp...q....2.M....O*......1...c...C<|X.S2>.....1...>.P0.2>!.2....o.J.e|F....,.9.>/......E...t._..e...+<|....0%.*;>.Q_S.u|C.u..0-.d_,.s.......

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\databinding-1.2.0.jar (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Java archive data (JAR)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):197084
                                                                                                                                                                                                    Entropy (8bit):7.829422071552972
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:wAvUxJUhimFEPRAL80RgAM9OekB1PPkBd/oJCKtgWE/XCuFK/HDGVK9eEcDi4pKA:nsxyipinRzMMnRPkBd/WZz/LyKVS0E
                                                                                                                                                                                                    MD5:0FF923B9946F02547B127152D8CD7211
                                                                                                                                                                                                    SHA1:5766C2788BBF64AE8A2C14D938F9966832CF415B
                                                                                                                                                                                                    SHA-256:1D4106385611B2DEC486C43424E55485B81D83965E22559035EE2B47E27E4F70
                                                                                                                                                                                                    SHA-512:12B5083236D1AC47A7CF6CD8BF02A8C273F8592036C2F78F837638A6B4D5BA774D9144315480732487D68BE8A869255AF4DCF28703A16D9E39DD674D8B620CDE
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK...........:................META-INF/MANIFEST.MF.....[..X......:.......(...< .; ..}..*.*.._..Z..AK.z.:,...'...6b.u...d.....O.........2B.5..4,w~..Pp...9..v...I\.Y.GN\|.B..W............8..@..Md&.o.F.|..d.'...4w..$s..W..m?...........Q...[Q.......U.....>...?.'....@..?o.zJ...*....R...g:O...*?.M?......i....Y.:Y..wtz.....2.$.Q...N...;.o/....,.W..c.......y.k%...__9...5.........}/...{..|'.....s....q....wt^..nm/l~.w..y*:../YuL::wm...2.....f...{......h.!_.?:..G.{.......|."...G?.....o....s.(.o_.~...'.r....h..yb.d....m';y...g...s.y~.^.o_:.}...U>E..2'O.sd..w..>...._.N}....&...r...1.......N.4O.wt.$.g.S.uB9.;*...T......}'.S....>..Ms...........p..l x28...........<....9.u.b\.......:m..3..J..../.-..=....!.0...Ydd...... .....Rt...k..^F..J4./..F{..I&...tce.o1.].w?..22.LJ...v,.[qd...y.b.$%.&.....w.....#.3Q..l.]...eX./zO..V.........p..7.+m.3.....w...GJD..3...n.zHG".L5..X......<.W.....<.|:.Mt..#7L...........Gy..[e.h.s.?.JF.s..%...x..?0.....%..e".Mw

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\databinding-1.3.0.jar (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Java archive data (JAR)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):258327
                                                                                                                                                                                                    Entropy (8bit):7.75912785597194
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:6144:1MOH6CEukczSNUGP0e7UN/jnoH0LZ/+sH7DU94ynSum:taCcvvYN/sH0LgG7DJyST
                                                                                                                                                                                                    MD5:C8B2DBB2CED354D3E7832D5896ECDC12
                                                                                                                                                                                                    SHA1:A29211EBC4A6495A71AF3B5823EB7EF164D200BF
                                                                                                                                                                                                    SHA-256:5F33E8C265AE5483DC915CD5464704D499880E9844CFD795358B24697B0C324E
                                                                                                                                                                                                    SHA-512:4E4E15996FF023B702B18EA1F9292ECDAA2BF680DCC808D5150E06FEE726750DA4FA1BBA3EEE28F6915BAA1D7400080CFA01C8666C8909495E6CD0C8A2A18761
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK..........:................META-INF/MANIFEST.MF.....]Y...~..........:..B...$...(.C.3.(....N.h....Ga.=..[.^.0..u../.. M........J.......X.....?^>..N....,O..v..;/..eD..(......./e.X..c.cU.'...4......."..L.=.0.......~...r.w!.0....)6.(...Hs.cEAV8?..a9?.Q.3H. .~..i2.=....).m>.Y?n.....G?.n:.....?..........|....$m.Xi....q...oV.#5.'...2..i..#!...j..e7..;.<..s..W...z..+.. ..#._:^..,..V....g.....(....n...N.$....7.v.....8......V..PM'....P7..t...E.\.........1(....=?.w7....[.C^..y.n.n..C=m...n.....p.gc\..k.w.$z.1O/w.........s.X/......i'.?...gU?J.-_.}.r_.......{QY..\..B..d.W..n..m`{N...1.*gu...j......M..._T.u...."...J.......r92.I.?.&..p.jPF..;.......K...M.=a......@...3Y.N~..|..$|u.,.D..t........5Ce.K...";.\P.....n..m..{-v....Gr.7.|5S.....6..i@.....Re.RNd..[z... ..C9..5.4.......*Z...!..........9.?.k...r..mN.4.e..l..R.-..w.~.F../.O..F%.3...t.=z.....)V..|....83..jt.@...;..$.....z'q...Bf......O6g(G(.n..U^ ...p....q. L.m.[P.|*c.@l6.x.C..

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\dom4j-1.6.1.jar (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v1.0 to extract, compression method=store
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):313898
                                                                                                                                                                                                    Entropy (8bit):7.924530998596858
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:6144:A/iLiO9MdO+3sBy0uxWi84FLOUDvryzEDT:AJO9MdJ3GuxWihyU/T
                                                                                                                                                                                                    MD5:4D8F51D3FE3900EFC6E395BE48030D6D
                                                                                                                                                                                                    SHA1:5D3CCC056B6F056DBF0DDDFDF43894B9065A8F94
                                                                                                                                                                                                    SHA-256:593552FFEA3C5823C6602478B5002A7C525FD904A3C44F1ABE4065C22EDFAC73
                                                                                                                                                                                                    SHA-512:E3737EF4A1551E46410916FCDA298A629B2681D7469CEAAFFFD668E6055D9C0E795BC9D12EA3300D218981D5AA5B2F38BB2E641211997C962E6086068F62AD67
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK........gr.2................META-INF/PK........fr.2................META-INF/MANIFEST.MF...n.0.........k.....D.JT..Z...&.#.Px{...8q..vf..:kh....z.B_.....2n0..D-..j.RL.!.N&..........g..[.....J..Bi_....N.l.Gj.....:F..L.....]6.[cs....\.=Ha.-.....P....x...9.C.D.K.....J.Y.TT.........3?U_.).PK.....'....h...PK........4r.2................org/PK........5r.2................org/dom4j/PK........5r.2................org/dom4j/bean/PK........5r.2................org/dom4j/datatype/PK........5r.2................org/dom4j/dom/PK........5r.2................org/dom4j/dtd/PK........5r.2................org/dom4j/io/PK........5r.2................org/dom4j/jaxb/PK........5r.2................org/dom4j/rule/PK........5r.2................org/dom4j/rule/pattern/PK........5r.2................org/dom4j/swing/PK........5r.2................org/dom4j/tree/PK........5r.2................org/dom4j/util/PK........5r.2................org/dom4j/xpath/PK........5r.2................org/dom4j/xpp/PK........4r.2.......

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\hibernate-commons-annotations-4.0.1.Final.jar (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v1.0 to extract, compression method=store
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):81271
                                                                                                                                                                                                    Entropy (8bit):7.791419794562344
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:1536:o4Ug0Pg+ZHcUCSU8rAud2yXGaL/FTlg+cBL:vUg03HpCSUY9rFT6lBL
                                                                                                                                                                                                    MD5:2F183E60AD3D10E654BC3C276445033A
                                                                                                                                                                                                    SHA1:78BCF608D997D0529BE2F4F781FDC89E801C9E88
                                                                                                                                                                                                    SHA-256:CEA2405CF0F5427E226CD4957973E8B3D83091DEA2F6383A7168192C790ECD06
                                                                                                                                                                                                    SHA-512:C2D5CC7FC72F5DA115294806294D65CE2B57A74C6E136CE3C8F78202A0FE00134B8322DE1DC96C9C9DB445AC2CD37BDA007391EB60B0D0FFBB5E1C3D363A8B21
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK........).}?................META-INF/PK........(.}?................META-INF/MANIFEST.MF..OK.1...|.|.L."....b....U....&.%......a.=.q....t.nG..-.."...F.U....4..<}MY..).DX....Q....T.{b)......q...~...@.vu+E..u.1g.b....S...........!D.S.)6a.....~q.Q..[...Zs..8z}~4j(e4..Z;\.[b.S..A...<....X.c.RH..PK........'.}?................org/PK........'.}?................org/hibernate/PK........'.}?................org/hibernate/annotations/PK........'.}?............!...org/hibernate/annotations/common/PK........'.}?............3...org/hibernate/annotations/common/annotationfactory/PK........'.}?............,...org/hibernate/annotations/common/reflection/PK........'.}?............1...org/hibernate/annotations/common/reflection/java/PK........'.}?............:...org/hibernate/annotations/common/reflection/java/generics/PK........'.}?............&...org/hibernate/annotations/common/util/PK........'.}?............+...org/hibernate/annotations/common/util/impl/PK........'.}?=,..........M...org/hiber

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\hibernate-core-4.0.1.Final.jar (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v1.0 to extract, compression method=deflate
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):4253629
                                                                                                                                                                                                    Entropy (8bit):7.917126032620326
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:98304:KbTD8wJg8tSVUEZ2Udh6hoIbgip/HK0m3ZlkV9:KHD5i8GU4X6DgiJKhlO9
                                                                                                                                                                                                    MD5:4918FAA8958A502FD25EB4DBA99803F9
                                                                                                                                                                                                    SHA1:9E1B7E06D8148394632BCAEB7A5F68748C69DCE4
                                                                                                                                                                                                    SHA-256:A7AFC1A62AB04D47DA05216A80E954EE50BAD694CE9F5E8DC77932157E06683E
                                                                                                                                                                                                    SHA-512:F34AD11C08C442DE600C2FB18676CE9E073ECF23FA0DC931E120CA68BA156F45889DBC13FC2A4B497B25E4D25D4ECAF356273C99B8882778C063E3ADC72BEDAC
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK.........e+@................META-INF/..PK.........e+@..}............META-INF/MANIFEST.MF.....0.@.@.!?.k.NY..CG.Or...\..o...{.7..J.W..Y....f...H....Y3.[...bm..h.n.u.]...T..d...=|...8.`.!I..v..zY~..5....Y.1a)...{k.y.PK........6..>................org/..PK.........e+@................org/hibernate/..PK.........e+@g}..q.......%...org/hibernate/ScrollableResults.classm..n.1...%.Pz.-.Z.)..r&@!..."......8.V.u.:.y5.x...1.u..n.h....3.............<4.dBv&.\....>.yl$}.Fyh.(..;..8"..<.....me..4.l...[vY.....p.o...'.....i-.G..z......g...q.R'.a...0O..o...y.:..0~C9..;..e"..9..G.h,...J.g.@%...z.........Q/...p.....1.y.....V...UDW...Y[K....pa...1..VA..Qo....T.^K.f....TL.!h;n.o.QaW.?>.8..].K3G.#p..r.....*g....8...<.H.v....T...R}.5........K?p..5t.G.}...FOYm...w...]SA...!;.!.|SAw...2...||$m.Q...|,<|G..J7~s.......v...6....X4....t...h..s....mg.>..<.3..!.[..E..,O.".`....dE-Z......Y1.*Tp...5CY.........7...[.........r.....T.R...y.....v..XQ..Av.A..s.....y.......y....>}G..9...PK.

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\hibernate-entitymanager-4.0.1.Final.jar (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v1.0 to extract, compression method=deflate
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):475305
                                                                                                                                                                                                    Entropy (8bit):7.908749745010502
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:12288:ZruOUCEkXuls0n0nWdMj9NEMDXaEQXxDza:Z6qrXumjvJrpF
                                                                                                                                                                                                    MD5:CE43F7933316AD89EF6F3ECBBD91F777
                                                                                                                                                                                                    SHA1:C582284B9FAAA35F92462181541C5F2D4CA9EB38
                                                                                                                                                                                                    SHA-256:34BBAE3B6564FF2AECF4A37AA1DA6A7896B5336CB2092FDC5FFDDBCBCC2127B0
                                                                                                                                                                                                    SHA-512:8AE0A55E62283C754C6129BE265AB6AF3DA034977C5CD40E93BF0980AF947310D9804999857CD13C79E4309D87BEF4BC88D5AB6B99421C42B9AC57E5FA343896
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK.........i+@................META-INF/..PK.........i+@.q$.x...........META-INF/MANIFEST.MF..1..0...=R...m%&....v..6R.D....K....._I.w.w.=W.0..].......{7o...bd.....Y.aX.U...._.8>.....P..$.^.....8'.}...woPK.........i+@................META-INF/services/..PK........6..>f..."...'...;...META-INF/services/javax.persistence.spi.PersistenceProvider./J...LJ-.K,I.K.J....R..3.KR.S..PK........6..>................org/..PK........6..>................org/hibernate/..PK.........i+@................org/hibernate/ejb/..PK.........h+@.A.J....L...6...org/hibernate/ejb/Ejb3ConfigurationObjectFactory.class.U[O.Q..No[.*r...K..rY./..B+H..D....m{hO..6.-i.U...$.g....8gK.p%..n...}.=....7.sx...s..Ux.D.S<S.U.\E...^..")...EI..fI.....V......2.7..f.e."g....o6kyn}..U....^..-!.O.>.,..s9.*ieA.ns.W..Z%?.1.=QjZ.-L.].....^.M..b./q.#...[7.....U.}]..FI.(S....zM.pS...".b....EU...e[.........{..N..7...&.Kn.E*3v.a...^n...4j...]+cP...Y..x....&0.m.g..H.E.Z.$.....F.io...k...d5zj...Y.oa..0~.lR..s...]..n./&....V..e.

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\hibernate-jpa-2.0-api-1.0.1.Final.jar (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v1.0 to extract, compression method=store
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):102661
                                                                                                                                                                                                    Entropy (8bit):7.636894622695592
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:1536:xUpEfEg1YniPpkzKX4yfx4FtplORMZVCzDbNWCWNPvZ8rEGyfoD8eYQKJ74n8K:xUs16iP+zK4O4jplOvRaPB8I1wD8pJu
                                                                                                                                                                                                    MD5:D7E7D8F60FC44A127BA702D43E71ABEC
                                                                                                                                                                                                    SHA1:3306A165AFA81938FC3D8A0948E891DE9F6B192B
                                                                                                                                                                                                    SHA-256:BACFB6460317D421AA2906D9E63C293B69DC1A5DAC480D0F6416DF50796A4BB3
                                                                                                                                                                                                    SHA-512:6B5CADCC300D565985428963B85411F34F56158610A4439D3B6B21B40E95B19E10C9534337096674B5DDA59F4A417B1B437E9D74C983C79912BE0C2BC90E61A5
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK.........U.>................META-INF/PK.........U.>G*WA....x.......META-INF/MANIFEST.MF.P..0.......6X...UA.P((^%...L.%I....?..{..gr.tB..=:O.'.....3...~.....&.X9...hyK m...r.#K......as5=.'....x......b..t.......l..."....e....}...X[).-.:..,..b...lpl..+.f.3>}...!'.......@.F}..Z"..PK.........U.>................javax/PK.........U.>................javax/persistence/PK.........U.>................javax/persistence/criteria/PK.........U.>................javax/persistence/metamodel/PK.........U.>................javax/persistence/spi/PK.........U.>.m..............javax/persistence/Access.class.PMO.@.}..*....=...D/6.=.X".....xZ6..d.vK.y.....S4r.x..........;.k......@.2.&'...eo"..5.Q...U....,..3...=$y........B#p....)=.L....M.t:.....70.....b......~hhJ......a(P.......t....zqD...X...2L.V.&...}.....!.X..F.RN.t....-....2__x..T..P]F.....m2.{A.PC..[E..NQ'...PK.........U.>..........."...javax/persistence/AccessType.class.S.O.`.~^Zh)......M..7.%~.......$!.T.;VS.i......\.l....e..21

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\hk2-api-2.2.0.jar (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v1.0 to extract, compression method=store
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):142439
                                                                                                                                                                                                    Entropy (8bit):7.850962744291261
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:QrUUUtHYtZ3Q+uQEojLOAMgDQUOscwTzzdaTmvzzqcq:PUKHaZMbAMCnc8Mgpq
                                                                                                                                                                                                    MD5:FBC8593BC4B52F63D92699A916596256
                                                                                                                                                                                                    SHA1:62948CC26572EE26A3F2343FDCB9F9025F278CE6
                                                                                                                                                                                                    SHA-256:B64474A690E840EDEA7C78F4B593CE5380B956437A12BB430A2F7AD3553A5161
                                                                                                                                                                                                    SHA-512:8953D14418B669CC1E5E3DC41AAC7B189DEC9F586FEDEAC75BCE562D6D7D50D945436BD4F53B8CE625E7396F51213AFF199111F72588B53C366E98BC2D6EFA5F
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK........Jl-D................META-INF/PK........Il-D}y..>...........META-INF/MANIFEST.MF.T..1.....`q...2!a.q`..I AY..2....n.n`.>.Kh....U...z.0%.`]....Z..I.....i.jS.7l...fI..Y..vEW..e....l.$..N...Ji..bY.#.5...j..U.L.#&.`..>;0..,r. vB.'.V5.\...@%.+.]F.Wi..mTJ..d.....Ho......n...S....#...S.zS.[.....\.P...O&L.V.....H+Pw7.8'S.....".q*.7..t..k@..f.|..2 .....N....%..-^.o-.>...c..C..A.b.#.W@&l..dUd*.PG..P.6..a...P.4CJ0#.....(.ic.x:..-..O...u......K.;O..w:.v..x....,..XnD......x.8.....z..D0.:.VlW....>....>O..IW(....=o.-.6......G....;.D...(S..4[''........9m.{=T.I..Syz:...3<....\J...8W....z..5*.]_...j...8[..j..S..Y.......v*.i*..[.?.{...PK........Gl-D................org/PK........Gl-D................org/jvnet/PK........Gl-D................org/jvnet/hk2/PK........Hl-D................org/jvnet/hk2/annotations/PK........Gl-D................org/glassfish/PK........Gl-D................org/glassfish/hk2/PK........Hl-D................org/glassfish/hk2/api/PK........Gl-D.....

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\hk2-bom-2.2.0.pom (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:XML 1.0 document, ASCII text
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):17716
                                                                                                                                                                                                    Entropy (8bit):4.2329642854000795
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:byS8wnfNsQsEs6sqsls5sisws4sTsRshfgs+sDfCszsZf1s0sOsSsCs3sksFswsu:b+AfNsQsEs6sqsls5sisws4sTsRshfgd
                                                                                                                                                                                                    MD5:473C9107ED5E43BD984680ED5B49DE0B
                                                                                                                                                                                                    SHA1:32427AFF464390A8A1FAC69B06A7E13FDAFDCF0D
                                                                                                                                                                                                    SHA-256:4F52DE806796AE88653AEDF38DC9B51C986C25D4BD7BC17D128052B88D35F0D8
                                                                                                                                                                                                    SHA-512:6F1379CFFD44BFFB45D624A29D75E97EEEEB5992C71610E9A58AFDEA345987201A02B1CD9D6A1AE2F307DBDD4A7EA0D286CA710CB341223CBC038AE59C7F72A3
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:<?xml version="1.0" encoding="UTF-8"?>. .. DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS HEADER... Copyright (c) 2013 Oracle and/or its affiliates. All rights reserved... The contents of this file are subject to the terms of either the GNU. General Public License Version 2 only ("GPL") or the Common Development. and Distribution License("CDDL") (collectively, the "License"). You. may not use this file except in compliance with the License. You can. obtain a copy of the License at. https://glassfish.dev.java.net/public/CDDL+GPL_1_1.html. or packager/legal/LICENSE.txt. See the License for the specific. language governing permissions and limitations under the License... When distributing the software, include this License Header Notice in each. file and include the License file at packager/legal/LICENSE.txt... GPL Classpath Exception:. Oracle designates this particular file as subject to the "Classpath". exception as provided by Oracle

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\hk2-locator-2.2.0.jar (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v1.0 to extract, compression method=store
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):171588
                                                                                                                                                                                                    Entropy (8bit):7.9341974275058975
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:D/lT96OmfA5wMLgXaYgFWBQwVhDWI48eKKRx+dWehTkkOWlV/4:D/lmfIw26ldGyhDj48eKKRYdfgkJ/4
                                                                                                                                                                                                    MD5:5E2019A1B747202CB93F63164339C802
                                                                                                                                                                                                    SHA1:58242E53D1FDE189E2957E7BD107FECD42FB875A
                                                                                                                                                                                                    SHA-256:F13448A2FBB10AB0D6E4189195CE357DB5F2C9E0A03D8FA2CF1BAE296E1CE74B
                                                                                                                                                                                                    SHA-512:8CE5307ACB2D8A90929B01B80F06FBF13FA6652600380E53611F04B9907701B060C1D306088D8905BE67C6E08ECD71FD83363167446E054C4BBB87BE0C912ECF
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK........`l-D................META-INF/PK........]l-De..A...........META-INF/MANIFEST.MF.SMs.0..{....S,0I.0.!@.i.Z.is.....Y.H.1..+...ms......J>.c...+...i...2S....t.q.....,.-...-. ....U...0q..p.A..s.$....../..[...`.+Z.p..f.Wuh.k.b.g.."-..^?...m.8..........L.D..<.\&..o4.a.A...H1.z0.9..........?..j!.I?d.-!...d...&"_py.~..(...5eX.(....\.I.......9mv.x..w..3.=..U......;w..v.s...x...*..4..4........#.J.&-..L.hT[p...@C*I.F...g..p8..8.M.iD..)...C...8.1....I.U..V...D....!.TJ..B5..y0.8..z.).*TeT.N%..b8.dgX.._F.cu&.[..\.A..'.].S._.Q....\......*...@...`u.G..4]..W3g..f............v...:.#L...}.?..y....g..o....V.V...>....fC....g.......1M........?PK........Xl-D................org/PK........Xl-D................org/jvnet/PK........Yl-D................org/jvnet/hk2/PK........Yl-D................org/jvnet/hk2/internal/PK........Yl-D................org/jvnet/hk2/external/PK........Yl-D............!...org/jvnet/hk2/external/generator/PK........Xl-D................META-INF/services

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\hk2-utils-2.2.0.jar (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v1.0 to extract, compression method=store
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):67151
                                                                                                                                                                                                    Entropy (8bit):7.8546956420455905
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:1536:rr3g1oHemadIm5oWcl+GGt46aSJLF0SNwFeTTj4R1O/D:rr3F+m2IRWKTGtBJLF0SnTTE1O/D
                                                                                                                                                                                                    MD5:6CBAC4DF4874EFAEB2B6AFB5F6041301
                                                                                                                                                                                                    SHA1:4A51122AAA338DF59EECD06E3BAA6D5DE702046D
                                                                                                                                                                                                    SHA-256:E13A8AB0240262CE4F575E0A0552B9544257CBBBC1F488886698C96EFABAAB89
                                                                                                                                                                                                    SHA-512:F198BEBE348E4BAF84B1E635CF553DB088C2986CE7347E436508BC4ABF0E63F0BD46C6CF16B8029BD4D26D924EB1AE89AC4B2A50AF7D5E7A0654B5C8AFFE44A5
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK........El-D................META-INF/PK........Dl-D........%.......META-INF/MANIFEST.MF}.[o.0...-.?X......B.>.X.-.v...u&...#.......T......9.fJd`]....."...F...6..0.c9DD...Y..[.b7...R8....$p.ok.6..mY..T(...WF.M...M.NF.?.q..x..9C.Q....J+P.]x...L............cDZ....i-#.Pi...kk.V....+..?~O...P...<..c.4.....j. k."=.ld.....gP.6..k...6....KK._...N...U..U..F.L#.W.i.?y.1.n.S..H=..l~}5.]..gg.zH.B;.V`....?^y..|e....F..%..Z...+.X3...).x.Z..o.$LBZ.`\)1.s....+:.z<./.3.D.?.....O.q/.....Tw~......q1u#.P[r*`...PK........Dl-D................org/PK........Dl-D................org/jvnet/PK........Dl-D................org/jvnet/hk2/PK........Dl-D................org/jvnet/hk2/component/PK........Cl-D................org/jvnet/tiger_types/PK........Dl-D................org/glassfish/PK........Dl-D................org/glassfish/hk2/PK........Dl-D................org/glassfish/hk2/utilities/PK........Dl-D............"...org/glassfish/hk2/utilities/cache/PK........Dl-D............+...or

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\hsqldb-1.8.0.10.jar (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Java archive data (JAR)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):706710
                                                                                                                                                                                                    Entropy (8bit):7.961152328969167
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:12288:/LjYIIwgzbtAVZnXNll2CnNUAXfwW7j/IuVs5LD+8sYB49NIMNeG97HHi:vMtMxdbNU44eIuVALD+YKj7li
                                                                                                                                                                                                    MD5:7DF83E09E41D742CC5FB20D16B80729C
                                                                                                                                                                                                    SHA1:7E9978FDB754BCE5FCD5161133E7734ECB683036
                                                                                                                                                                                                    SHA-256:B04B3B3AC295D497C87230EEB4F888327A5A15B9C3C1567DB202A51D83AC9E41
                                                                                                                                                                                                    SHA-512:DAC86D742A066A40380FC8816477A62E8BB7BDE318E1F1CE44BA4B4ABE92216F079F0A91A3F3F5918AC27F139C1357356A10C63FE8C348B2BCC58F0C3B8D8B0C
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK..........8................META-INF/....PK..........8.j......y.......META-INF/MANIFEST.MFm.Ok.!.....cs.K.....@.Pv..}....u...u....uf...5..R.....N..q.V.FY...@.V....D..4]_....|A...<..#.Q.K.0$.w..0j.(..%s......ym......qV....>....k.........].c.h?....k...i.5...f....z..\..5..9...V\.._.9.....F.G7V.$.._.NV...e..v.[.0..PK..........8................org/PK..........8................org/hsqldb/PK..........8................org/hsqldb/index/PK..........8................org/hsqldb/jdbc/PK..........8................org/hsqldb/lib/PK..........8................org/hsqldb/lib/java/PK..........8................org/hsqldb/persist/PK..........8................org/hsqldb/resources/PK..........8................org/hsqldb/rowio/PK..........8................org/hsqldb/sample/PK..........8................org/hsqldb/scriptio/PK..........8................org/hsqldb/store/PK..........8................org/hsqldb/types/PK..........8................org/hsqldb/util/PK..........8.........

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\imageio-core-3.4.1.jar (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v1.0 to extract, compression method=store
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):72506
                                                                                                                                                                                                    Entropy (8bit):7.803205081149189
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:1536:mJwWXEQi4R8O/ADqSNur8yWBwuZRbjyWdnlHI03SekYqWc:mCQhp/Au5AwYRnxdnloTekYbc
                                                                                                                                                                                                    MD5:F981BF55862728F35856A61E8789BE28
                                                                                                                                                                                                    SHA1:E6A2AB00C5B39C70C024E85ED277698177CBF3E0
                                                                                                                                                                                                    SHA-256:21A42E88D3C9F7C8255CE77428F1F3BD377EA497FF4D42BAEC3B1EC68ABA22B9
                                                                                                                                                                                                    SHA-512:798F4090CD824CB45B7D8DA5D0F80103DC333CA76532F4E47D3F3C0831C3EC825454E6DB57B041B8330DA4E8D69C1827084E031163635723012DD151D3D96C95
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK..........'M................META-INF/PK..........'M................META-INF/MANIFEST.MFm..J.1....y..@...B.Z...D...7c3l.K2..7v+R*s.....l...$_.T...Zqv.....Yjb{&....O.3t9.p.W..)..t...I....e....{..Q.j..n.@rw4..b.S...";....v..z.4...%p'z;......y...zy~l.Dc5Z.........4.i..Z#g.b....g(...|MU.>8...PK..X.5.....U...PK..........'M................profiles/PK..........'M................com/PK..........'M................com/twelvemonkeys/PK..........'M................com/twelvemonkeys/imageio/PK..........'M................com/twelvemonkeys/imageio/util/PK..........'M............ ...com/twelvemonkeys/imageio/color/PK..........'M............!...com/twelvemonkeys/imageio/stream/PK..........'M................com/twelvemonkeys/imageio/spi/PK..........'M................profiles/ClayRGB1998.iccc``rI,J.aR``..+).rwR...R`........ ...\\.......y.y.....5.F.}Y.d..<^...Z.....qurAQ...c..mZ^R.bo..E....# v..@...;..~.V.f31...9.."@6_:...b'A.& 6.^.Pt..-H,.L.IU(.,.PpL.OJU........&.~".JR+J@t@iRNf..K~nbf..._.BxbQQb^

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\imageio-metadata-3.4.1.jar (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v1.0 to extract, compression method=store
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):77682
                                                                                                                                                                                                    Entropy (8bit):7.835396778613255
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:1536:1fVJejQe3ypu8H9PwZvLms7EdcGV/6IFpjp4DPJY:1fHejO9HV+meEVV/6aJp4DPi
                                                                                                                                                                                                    MD5:3614F6D6E3349F0621C96D40C8CD7BF1
                                                                                                                                                                                                    SHA1:D83042685DEA0584905F2157C4BE93F1D34F24B0
                                                                                                                                                                                                    SHA-256:56318CD28BD1900FF0D0E2DD54477898C32D0D243A66CA6A23F4E1FCA87E329B
                                                                                                                                                                                                    SHA-512:3B27CA654607380B273A82C89080FE77EBBFAB3F930CEBBFCEF7E34A42A019127152522A5B4812D3348B652B3C1FF926B152AD0C2F95187F8D15EFE05C869469
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK..........'M................META-INF/PK..........'M................META-INF/MANIFEST.MFm..J.1....y..@.....^U\(R..q36asX...}{c.".2w.|...........d.Z.8;.>`.D@U..ds1..a.&../.:y.h.].8C.G8..2".....o..u...G.H./F8(...FWf....}7.......^.]..C....z.[D=?=VW.~0Z.=..M.9.9.....[s.9.....:?a.....9.....g_PK..KB......]...PK..........'M................com/PK..........'M................com/twelvemonkeys/PK..........'M................com/twelvemonkeys/imageio/PK..........'M............#...com/twelvemonkeys/imageio/metadata/PK..........'M............'...com/twelvemonkeys/imageio/metadata/psd/PK..........'M............'...com/twelvemonkeys/imageio/metadata/xmp/PK..........'M............(...com/twelvemonkeys/imageio/metadata/iptc/PK..........'M............(...com/twelvemonkeys/imageio/metadata/exif/PK..........'M............(...com/twelvemonkeys/imageio/metadata/jpeg/PK..........'M............(...com/twelvemonkeys/imageio/metadata/tiff/PK..........'M............6...com/twelvemonkeys/imageio/metadata/A

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\imageio-tiff-3.4.1.jar (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v1.0 to extract, compression method=store
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):104273
                                                                                                                                                                                                    Entropy (8bit):7.93724920413004
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:1536:0DUnftW9DtU0unE89WcM9rAitiocibJjYYt8KU+5xBETDlyqXqdby9T1fkcMJLhE:LnGDtU0uno9ZVjrt8ebBETDEEz3oLhE
                                                                                                                                                                                                    MD5:599B52D3AB218A1430ADA0DCF0B6C63C
                                                                                                                                                                                                    SHA1:B88D400FF05A22AEDFEA8718892FFCF98A401787
                                                                                                                                                                                                    SHA-256:3B293371FC84216CEEE837A5CE91E37E4C43A2F0F07AC6FA26CFC52FE9E20EEC
                                                                                                                                                                                                    SHA-512:1ED71C7C5AF95BD29E34B4CAAF3845E4C7DE7C1DD855A2F3E07E66E5CFE64CCAD23F220650391E7D57DEE43F414516DFD87F40FD5184CC61C5CDCA7167214837
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK..........'M................META-INF/PK..........'M................META-INF/MANIFEST.MFm..J.1....y..@...B.Z.*..To%..6..$..}{c.".2w.|...F.|.\0E#.j..>...D.T...].F.>...8...P.$.F....$1.#`..}...%.N.5g..=....g....&........n.V..>d.....u .;C.^.n.^_..+.X..G$7}.6.....j............_.g._S....8..PK...&{;....U...PK..........'M................META-INF/services/PK..........'M................com/PK..........'M................com/twelvemonkeys/PK..........'M................com/twelvemonkeys/imageio/PK..........'M............"...com/twelvemonkeys/imageio/plugins/PK..........'M............'...com/twelvemonkeys/imageio/plugins/tiff/PK..........'M................tiff-image-metadata-sun.dtd.X[o.0.}...^..L-..NU%V@B..k.j..I.`-.YlZ!...C...1....w;......{......|B...........8.... .............i.......(;.N..i.}.;Yc+.......!.d...IAa=.cW.xz&c...Jh.~...e.W5....~J..6........O.o..vk.U...b:...qb..........h...~....wF.d$@....B...`....G..(.*.E..v....b.!.pA|M.(..%.P..........'eo4...m..*.A.Z.J._.

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\ini4j-0.5.2.jar (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v1.0 to extract, compression method=store
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):101578
                                                                                                                                                                                                    Entropy (8bit):7.9234613621745495
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:4b6QeGXbWQxmZTC2G7vArRf47Eb1eMVzo2h:xQXWQxmZTC2G7Ytnb1HVzz
                                                                                                                                                                                                    MD5:50738A9E30CCE8F6D63D5A2B63FFFD63
                                                                                                                                                                                                    SHA1:16561CB11C221B5928119E10D7636C95EE5C960D
                                                                                                                                                                                                    SHA-256:631656EB38639B0AE41161F706FF7FBE04313B5B8F42892DA5EC656390031FC6
                                                                                                                                                                                                    SHA-512:1397D4EF89EB30025E24F8DB0DCE6119AF521AE7C0E0454B6EA613894B01E437B4C80C71EAE7F017A2BB9F0868D780333BC74E1AB5F919C9F87FB2AE73BA5D74
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK......../..>................META-INF/PK...........>*..Ph...~.......META-INF/MANIFEST.MF.M..LK-...K-*...R0.3..r,J..,K-B...V..+.$x...R.KRSt.*......3R.|..R.x..J3sJ...U.I....]..l..fz..F&.\.\.PK........&..>................org/PK........&..>................org/ini4j/PK........&..>................org/ini4j/spi/PK........&..>8V.......$......org/ini4j/Config.class.X.x\U.>'M2o&/.L.6ii.i...RZ.N'.&....$%E....t.df...APAv...".".*`i.....P@..P\X.jQA..T.s.{....S.|....s.=.].<.....b...p..s.m.......X..+.w...7....X.>k......_...5......k...X.1k.G..k.5y....|...J....J...`..$,.5.,a..%..JX..v.....\...+%...Z...gIX.D.$.-....c..J8.....$./a....`...p!....F6.d.fl.a+....1.b.O..$.........\j.S.l....}....3..=[.[..`t..J...+..].h2........`......}............s.4.L......3..p..g..AV..=......*..np..\N.....0.kk....wsk.x.`......]~.t.;....{....1)]...s9....4..7.t{.n...Ez}N.U....$Q.I...(N...>.`..Pf...=....vt{.gL2.f.Z.\..^....r;;X42...w..\...g.....q.....O[.x@.\if.H^M.#..,..df2..,.U.i.\6.2.).5F.......l

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\is-0ATOK.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v1.0 to extract, compression method=deflate
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):77746
                                                                                                                                                                                                    Entropy (8bit):7.902573422135426
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:1536:3cqR1r0Vn/8c1I02d43LeWmTMRCFpEMzYDDm:3cqIlL1wSCWmY07ESODm
                                                                                                                                                                                                    MD5:23B6F7D0C025B570694E41718922A600
                                                                                                                                                                                                    SHA1:F50423490AAC638555F4EA6192F8E53C30D04EEA
                                                                                                                                                                                                    SHA-256:B4599F95CFD545300AB5CCB4E3383D3BA4A75506242D4E826865ADB882264E05
                                                                                                                                                                                                    SHA-512:EBE33338A6B6637F0158CEE4059A24C161314C208DF05C78C71558FFBC91FEC99B8B616EC7D9E60898BEF5141E2AD1E61FCEE30264A8485538F85D62B0F130DB
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK.........N4J.._W............META-INF/MANIFEST.MF.V]O.:.}G.?X}XQ.q..B......U..-...}X...:v.v.....8%M .E...93..8.3..#.....Z%$....u.2...F.._|..I..Rr... I.=7+.....v..m.b*R.,O..".....(+X..T..PV.v8...|...1.....#By*Ea+{..tZ.\9;..VQH.EQ.._....~g9D.....|)k&y..../..-.%=..].at.F./....^'d..p..`...L<..A..Fg...y4.//.tf........S...3OK.?Q+a..|..l......].../.....}...(.d.L.G.....-..jN....eX.mku..i.-.:.Z..?..I...t...%O.."...X....KH...j*.V..{.....{J.~o..M...6.........m....-r...F../.h...G.....9..E......,...n...~v............]>.....v{..`.e.9......R..{Ba>..R.?. 5X..K..B..?...pY'.1qmwb..p..M..l.O..../B.k.C.a>..kr...b90.O......R.....g....y...(........?P..Y.s....M2.../..j2.F.. ....[%.`R..M.we...q2.^...J...?..0.YA9.>..v..o.x9......)-.NAK...y{...i.+!.......)..G..k.6(U.4......e.F..y...H.......@l..B....6.3/._....[qE*. w..c.&.mU.)....A.]..(.: {6y.C7*.......d...a.NU....X.r.G.....K....I;l......e.Z...Ao.]..a"..(...0...|Se...7>:G4..E@..G..PK...._W........PK.........N4J....

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\is-0IH6C.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v1.0 to extract, compression method=store
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):4467
                                                                                                                                                                                                    Entropy (8bit):6.818051358498124
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:96:sgAXUQVJuaS2cXIerWlBHv4wYDZIzy2z64uqVu:sggUQV0p24WQrDyNHFM
                                                                                                                                                                                                    MD5:04177054E180D09E3998808EFA0401C7
                                                                                                                                                                                                    SHA1:0235BA8B489512805AC13A8F9EA77A1CA5EBE3E8
                                                                                                                                                                                                    SHA-256:0ADDEC670FEDCD3F113C5C8091D783280D23F75E3ACB841B61A9CDB079376A08
                                                                                                                                                                                                    SHA-512:3F44A932D8C00CFEEE2EB057BCD7C301A2D029063E0A916E1E20B3AEC4877D19D67A2FD8AAF58FA2D5A00133D1602128A7F50912FFB6CABC7B0FDC7FBDA3F8A1
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK........"ws0................META-INF/PK........!ws0................META-INF/MANIFEST.MF.M..LK-...K-*...R0.3..r.C.q,HL.HU...%M.L.x...R.KRSt.*A.L....u....4.K..|3...+.KRs..<..4y.x..PK..Y``]_...k...PK........"ws0................org/PK........"ws0................org/aopalliance/PK........"ws0................org/aopalliance/aop/PK........"ws0................org/aopalliance/intercept/PK........"ws0............ ...org/aopalliance/aop/Advice.class;.o.>...}.vv.&F....t.........T.[.1.,39.....A +.,Q?'1/].?)+5....+8..(9.-3'.....V.............X.$....PK...3..e...q...PK........"ws0............)...org/aopalliance/aop/AspectException.classuSkS.@.=K.iC.P.<.)".....A..FP@G..>...h.t...R......Q.w.BK[....s.wo.......=.m....3L.h..ig...+.".z._...Y.-..a....4.3.m.*..{...K%3...;5..Zv.. .<3...5..`.C......|1.......r.`....P..sB..e.r...FA..(.n.......n.T-).E...t..s..q.....~./...3.R.C..M[..UX..6...,d....;..uy..<^P ..c..b...OBJj.G.P.$.%.g.m..aPmi@;..5r...].)....my/..j.o.^.\...BW0..9O...f.r\.O.

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\is-0T8CK.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Java archive data (JAR)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):445288
                                                                                                                                                                                                    Entropy (8bit):7.945038655186032
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:12288:RibwIBDZs3iyr0FgTxf2sH/yZGUHf23XduYVc:R6BDDsTxf2gySdRc
                                                                                                                                                                                                    MD5:F8F1352C52A4C6A500B597596501FC64
                                                                                                                                                                                                    SHA1:83CD2CD674A217ADE95A4BB83A8A14F351F48BD0
                                                                                                                                                                                                    SHA-256:88FBDA4B912596B9F56E8E12E580CC954BACFB51776ECFDDD3E18FC1CF56DC4C
                                                                                                                                                                                                    SHA-512:311C3115F9F6651D1711C52D1739E25A70F25456CACB9A2CDDE7627498C30B13D721133CC75B39462AD18812A82472EF1B3B9D64FAB5ABB0377C12BF82043A74
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK.........Y&5................META-INF/......PK..............PK.........Y&5................META-INF/MANIFEST.MF.M..LK-...K-*...R0.3..r.JM,IM.u........X*h8...*8........(x.%.i.r.r..PK..R..WF...F...PK.........Y&5................antlr/PK.........Y&5................antlr/ActionElement.classmS.R.P...-M..-,bQA@I.R...,.V#.....p).i..Q..'..@.u.....M.j...9.=....~..0....0.D?t..d...hJ.+.M....j..p].....V..qG.]...'..y.32..8+.9....-.)..>.f.3..m:.\..,..gHZ....m...!1c9.?.0.....^n.3.U..G.[.N>..._t.9C.a9|.V..^..I"...=.'...K.u+.}z!.E1H`.rs.J.}7,GXdN+R).5o./[".6...d.*w.ia.b..*."-aA.".U....GXR......*...O%.*.aU..u<W..E.%...a.x......,#4....xE.!.T.a..7l..4..Hj..sL...M.v|.bN..F. ...nN 1.`..1....&I...*9$." ..b9.Y.:Z.A.`Y....Z,v.!.7.k.S-eQ.`....v:.]n..y.?~..nl.D...|sX'u...pz.S.)a..q..yJ?yJ'.+\m.#......8.BqqO.g..sD..k.,b...G`..!.Su....~....!.od.p.h....h.sQ....4z1.>....ap...MA.. y.%[G._.....RT..K...&. ......wt........[...T.Ot.9B..]G......3dM..v...u...6L.R0....PK..YT}........PK.........

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\is-17556.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Java archive data (JAR)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):1170801
                                                                                                                                                                                                    Entropy (8bit):7.925893185663666
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:24576:fdEpJhbhgR0gbFxlo/W1dtxRKqzk9fmb0Pxz1mGfCMvaZRq:fdcfq0gBxDDRKqzk9S0PVdfCwGRq
                                                                                                                                                                                                    MD5:39499F57D90A208FBE67A3E91F5AC058
                                                                                                                                                                                                    SHA1:5C4FCAE53DD82E2C549B8322D78C6FF47C94C8A8
                                                                                                                                                                                                    SHA-256:593FFBC1EA15E200D734CBCA1829EB8680AD301C058A9F9E7714CF9FD9E731FB
                                                                                                                                                                                                    SHA-512:ADDA3F3DFA83AE36CCD350DA8B7C176D21FD3AF6B684C62054F2EC466918AD4B60BFA5C603F142DC77BF139A522A113658811D3BB7D56F7C5B2A844FBCB37CC1
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK.........[LG................META-INF/MANIFEST.MF.......S.0.......p.s6.....A.o..q.s......m.^...M...E.....M..!.lB....TLp.9.V..o...C...>.7..V..:o..u0HX.[}...ml.m....u.p.&:1...R.*O.X..?)....'.Xc.}..4I.g.I...M.D}.)c?..ZA...<!)RZR......Cx....z.:vk...d.=..na.T>....L3g..\....f...{.X..f.6.u.w..U.6.s...e.....;....e.j..O...X.~f.Q.I..<....f..T.r_H..[.YE.[.Q.t ]...\..CC2..e..>L..I..c!.u..IP..*..i...(ust...f...p..\.T.o.....$....**3....0...#(..+.#AK...X:..]#..)(.F1..P1...?P..~...NQDv.k.T.........B./...EL.M.(.....G.O..)H..\.e...2,?.{y.......[s..!.....D..AV+=..F.g......`P.l..rl.#..m8.s.......n....B.......f...=JkQ}........4.....)c.....M.e_?.9c...,....J....S.I(v..=(.l..b'...m....~.......Y.....c,......F8T..dJ.9.......A...31..H....../a.Z.h^..P..*`..l....o...>...'.e8.ur.Wo./.t{.'.h...m.l^.G!B.......Q..n.g.m..v..luD.3.#.Dz....2-fk}....PK...m.r;.......PK.........[LG................META-INF/..PK..............PK.........[LG................META-INF/LICENSE

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\is-17MH7.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v1.0 to extract, compression method=deflate
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):568427
                                                                                                                                                                                                    Entropy (8bit):7.945408914505869
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:12288:22b5pXFRhzZOd4FI1Ue58Ci+u3Kq4kNGXgzWIN0ue:221f/zZal1ULXKq46GwCIaue
                                                                                                                                                                                                    MD5:703E37FFB3CDFCB7FEBD97D9C55B6839
                                                                                                                                                                                                    SHA1:4CF4BEA26592DE98B9126AC60BC91FB669176A63
                                                                                                                                                                                                    SHA-256:86007D0247A32310D823814320BC1EE9F10C5A9D3B9B5C78649CE0C9412C0560
                                                                                                                                                                                                    SHA-512:BE122CF20014330623983445B5390AF0C01F807FF9D5BA65FB109F3A971871CF564CE2C53FA68A8DD8A6D81E7DD95D36488986EA873D1A6A8EABC4A9C0B7DE17
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK........eN4J.4..............META-INF/MANIFEST.MF.W.o.8.~G...x8..1..4U..,....j{./.p.&..5q.vh.~g..I..rBE4.......{."..u.qm..|.Q..{L.Pr.#7...M_|....F....E....'.\o.&S.y.:...........^__).Y..T..Hf..h.i:..<s....l.=By El2{..U.lxd....z..Wq...n.]A./l...}..<.I...>mb.1..m..}G..G.c.u.q....y..d...E.3g..T(^..............Q[.1.C..W_..Dh...x....h+..0.@.m.@..I.0U.N.....?.EpI.;q0Y.P.G....$.hI.`.dnC..XM...u^.H........B.}2.,..~.j......:O,......R.K1...o..?.....(..._..%..BoAz.^J..yW.B..i......7..4.81..]mX.O...C.f{j.<c..s.Yo....57J...?...L...8E.t.Z.@W....C......m....9. .S.,.TF..y&Xwp..4u.L....R-3..s..V-...X..4...=..g^...".?.g.9.k.3.Fl..s....y......@L.....O...E..|.... ..,.....4.k.ap.....C&....d@//Q..-...o.............\.j|S1.J..q...a...H....3.h,..Q.!.qd..<"...'..i.7{+kf.c.(. .....@.A..VA...L2+.4.1j]I*+..V....U.......k.#.., NN....r.\.e_-SR....U......8......6T6...f9.l.A[..RW...u..4x.8`K..D...=......."..:P....Z...Vb.g.....E..Sw0...>.B{...=..?r.8...*.J.F.c][..>..W..o..]NV5.a..c...g

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\is-1DMV1.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Java archive data (JAR)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):708636
                                                                                                                                                                                                    Entropy (8bit):7.8681654916385275
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:12288:esKFn5+YGgC5JQy788Ad1cTXX0+/Q9QBNs5NzEt6k7GvTzp:7YGgCjQiMd1cbE+YSLsXz60l
                                                                                                                                                                                                    MD5:057585707B9AC791CCDF4AD20AF5E306
                                                                                                                                                                                                    SHA1:4F6BDF547F1A7F4F140CBFAC42379AD898F36216
                                                                                                                                                                                                    SHA-256:EF9A328928F9C8A63513DB197B858A1CA8C50266F8B4CA4D721F53E3397D799B
                                                                                                                                                                                                    SHA-512:C34863CF1C95A67B0443B18478F0FE18396DD4C5274E6228DA26F025A4882CD27EB490600294427A109E9235108CC6E20E06361B1C395964EEC52A8CA6389232
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK........{.lD................META-INF/MANIFEST.MF.....YKo.6......r+j3q..[.9t..."i.>..C@K..D..R~....%Q.DJr...4.8.~..h.Ds.d..~gRq....8=..'.G..'..%g.<.........../`..i2........fV>,._...+..w)....y....S..B..M.D.....2.G.....S.......<Z..f~~...4N.......,W..R...5y.;JrV.o.........?....2{..u........y.'.X}.).;-.5...g....+by...\F....;..!.._.d...8$..2...H...KF...@..Q[...X....s.]qX......s..k.S.....L.4..*..wg...9d)Y..D<O..sQh.&.."RM..5.mI....I...8If=X.>....w.@2..m.S0MS.k.z]......`Q.E.E.~.*X..B.\-..`. .|.....y...7{......I..dU.$..d%.....YPU.F!.;.,@..d.vI(Bz.JD...W.......;W..Gm+.....w.Y.n.].3..........F....Xy..;.......u..C...t../0.?....O.A..N.w4..5..H......R......3...`..\...0...4x..S.e...R....)..Q.3.!.6........l.X.#O.f....cV...+.>>6....5f.7.l.....A.m. 3.._n.q...n.H+"....J.../q{x.hA&..v.c."4D..1b="...b.{.G&.8...(....qN.w...l...m..".rt...r.Q..h..........O..Z.O..Xy7Q.d\.....aM.4.K... Uy......T.a..X_..= y..Dx3.!..9.Zc.k..}o.(.....p...*.%{.|.l*.......k.1..H..9...

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\is-1L5LV.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Java archive data (JAR)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):1207073
                                                                                                                                                                                                    Entropy (8bit):7.9076955919078715
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:24576:tEESygjwyOtq3CFJESGZ9R4JQfbqbL0YUZrUHlCQgspjwty0xeR:tENNEZtuCFpY/42bu0YmUHLpjwtyweR
                                                                                                                                                                                                    MD5:00B9A88A935985D17B7621C74A498BB4
                                                                                                                                                                                                    SHA1:6E60617C9D81EA1EF96913C226900BC2D1E69C37
                                                                                                                                                                                                    SHA-256:A3C7AB3A9B292EAA3354AD7BA7887FF6EC5803BB821AEEECFA3F63B65BF874B1
                                                                                                                                                                                                    SHA-512:A23D2F03894240F8648F211927BFA19B4A09DE42C36636FCE9BE2CFD5BCA7F48313B8D024E862E5B76C0868A474E5495FABF2632202611ABC21041C0F06FEE8A
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK........:.\4................META-INF/....PK........9.\4oxR.^...{.......META-INF/MANIFEST.MF.]o.0......r...:M.E.@..FWzk...%vd...~..0hH.I.B.:...$:.}....m..6B...X.^...+.......i.FE....*ND.!..`)...n6o.{..b....k......J'JsK._.z.....g.....4.........C.*.Q...f5......j...=.r...Fy(.CY..\(..v.YO.........]q..S-e......5.....y.8.5.`...w,..<.....\/=k..XI....%.2..N.6J0.S....9`zkO}.*....m..S........-.i.v.p.I.UvO%..Q.t.Z.......L..U'.B..IfO.K....w..*....1..:...2.c...."D..J.M[..K=..?k"cDVn...wt....X'........*...!.x...Yd.....4+.....&.3..P...'.h^.!g...i;..R./....X...e..DgP...AU..!>tVo...pm....e.`.Vsi..F.ex.S]...G"O.*......:.v~U.3..3^........x......OyP.......]..?.K.@.Re....#.>..PK.........\4................META-INF/services/PK........).\4................org/PK........*.\4................org/apache/PK........(.\4................org/apache/html/PK........*.\4................org/apache/html/dom/PK........*.\4................org/apache/wml/PK........+.\4................org/apa

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\is-2ALQQ.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v1.0 to extract, compression method=store
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):102661
                                                                                                                                                                                                    Entropy (8bit):7.636894622695592
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:1536:xUpEfEg1YniPpkzKX4yfx4FtplORMZVCzDbNWCWNPvZ8rEGyfoD8eYQKJ74n8K:xUs16iP+zK4O4jplOvRaPB8I1wD8pJu
                                                                                                                                                                                                    MD5:D7E7D8F60FC44A127BA702D43E71ABEC
                                                                                                                                                                                                    SHA1:3306A165AFA81938FC3D8A0948E891DE9F6B192B
                                                                                                                                                                                                    SHA-256:BACFB6460317D421AA2906D9E63C293B69DC1A5DAC480D0F6416DF50796A4BB3
                                                                                                                                                                                                    SHA-512:6B5CADCC300D565985428963B85411F34F56158610A4439D3B6B21B40E95B19E10C9534337096674B5DDA59F4A417B1B437E9D74C983C79912BE0C2BC90E61A5
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK.........U.>................META-INF/PK.........U.>G*WA....x.......META-INF/MANIFEST.MF.P..0.......6X...UA.P((^%...L.%I....?..{..gr.tB..=:O.'.....3...~.....&.X9...hyK m...r.#K......as5=.'....x......b..t.......l..."....e....}...X[).-.:..,..b...lpl..+.f.3>}...!'.......@.F}..Z"..PK.........U.>................javax/PK.........U.>................javax/persistence/PK.........U.>................javax/persistence/criteria/PK.........U.>................javax/persistence/metamodel/PK.........U.>................javax/persistence/spi/PK.........U.>.m..............javax/persistence/Access.class.PMO.@.}..*....=...D/6.=.X".....xZ6..d.vK.y.....S4r.x..........;.k......@.2.&'...eo"..5.Q...U....,..3...=$y........B#p....)=.L....M.t:.....70.....b......~hhJ......a(P.......t....zqD...X...2L.V.&...}.....!.X..F.RN.t....-....2__x..T..P]F.....m2.{A.PC..[E..NQ'...PK.........U.>..........."...javax/persistence/AccessType.class.S.O.`.~^Zh)......M..7.%~.......$!.T.;VS.i......\.l....e..21

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\is-2TPEV.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v1.0 to extract, compression method=deflate
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):41278
                                                                                                                                                                                                    Entropy (8bit):7.8930625402346335
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:768:wfBbxRONKWDdCosdTWmL1wkM12Wyj0mBfwdmwUYjMxAx3Jnk:a1bOjDdCos71wfuQ1jUgtk
                                                                                                                                                                                                    MD5:3719D04CA1D8B71146046838680443DB
                                                                                                                                                                                                    SHA1:43A3EA4DB0451C949807896DE4A76EBDFC28D71A
                                                                                                                                                                                                    SHA-256:3B4F46BB6ECEC04139999C598BCC9650E2B8D8DF47C820CA7AFF29A5381B4157
                                                                                                                                                                                                    SHA-512:34FB8E11D443DC7793998B3D52077B64B8D38FE4B73EEF0BCC3EB650CA17AA922703DAACEF3F92153EB9C75441DD9F7008DE9AD466A66AEAEBE37AD1AFB46971
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK.........N4J........7.......META-INF/MANIFEST.MF.UMo.0..G...8.@"&IiK.z.R......^..r....Nm'....$..Ka+.....7o&c".j.=S.......:7.H8.n...KMqqO.Y..L2N.T.. ....;.@.L.j.....4Bsc..Y.V..$.S,...k......OC/.~{..u..1g....7.q.....M...>N.i..i.|...y@T....6O...s..e..!..M.W.....~p..a....YGhA..p .oD...M.M..n.{.^._../zu....:....[..M..4.l.......,......`.d.Vl6....5...}...d.X*.n...........F&.$nz)._...~l.\.T.?S.H..aiQ.z...`..z.....l........[.ve...y`.c.O.m9i.r..RxNl.......c...._.|....p.s.KC..3.O3]....Z.6...7.....?X..:.o.n%7o.s..8.N......n...F.[.:....j~..%.Z....?%..R....3....y._.~p.^....qY...s.. r&..ko.(14)..{.:..T.R.h.30u.....X...g.~..........Pa.8..rH...$6R1.wR...%......A...cmO.p...uY.Ok...`....0F..F.J?..9...U..)1.......}.$.}.j.=.....u\./PK..........7...PK.........N4J................META-INF/PK.........N4J................org/PK.........N4J................org/eclipse/PK.........N4J................org/eclipse/jetty/PK.........N4J................org/eclipse/jetty/jndi/PK.........N4J

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\is-3JJ2A.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v1.0 to extract, compression method=store
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):72506
                                                                                                                                                                                                    Entropy (8bit):7.803205081149189
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:1536:mJwWXEQi4R8O/ADqSNur8yWBwuZRbjyWdnlHI03SekYqWc:mCQhp/Au5AwYRnxdnloTekYbc
                                                                                                                                                                                                    MD5:F981BF55862728F35856A61E8789BE28
                                                                                                                                                                                                    SHA1:E6A2AB00C5B39C70C024E85ED277698177CBF3E0
                                                                                                                                                                                                    SHA-256:21A42E88D3C9F7C8255CE77428F1F3BD377EA497FF4D42BAEC3B1EC68ABA22B9
                                                                                                                                                                                                    SHA-512:798F4090CD824CB45B7D8DA5D0F80103DC333CA76532F4E47D3F3C0831C3EC825454E6DB57B041B8330DA4E8D69C1827084E031163635723012DD151D3D96C95
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK..........'M................META-INF/PK..........'M................META-INF/MANIFEST.MFm..J.1....y..@...B.Z...D...7c3l.K2..7v+R*s.....l...$_.T...Zqv.....Yjb{&....O.3t9.p.W..)..t...I....e....{..Q.j..n.@rw4..b.S...";....v..z.4...%p'z;......y...zy~l.Dc5Z.........4.i..Z#g.b....g(...|MU.>8...PK..X.5.....U...PK..........'M................profiles/PK..........'M................com/PK..........'M................com/twelvemonkeys/PK..........'M................com/twelvemonkeys/imageio/PK..........'M................com/twelvemonkeys/imageio/util/PK..........'M............ ...com/twelvemonkeys/imageio/color/PK..........'M............!...com/twelvemonkeys/imageio/stream/PK..........'M................com/twelvemonkeys/imageio/spi/PK..........'M................profiles/ClayRGB1998.iccc``rI,J.aR``..+).rwR...R`........ ...\\.......y.y.....5.F.}Y.d..<^...Z.....qurAQ...c..mZ^R.bo..E....# v..@...;..~.V.f31...9.."@6_:...b'A.& 6.^.Pt..-H,.L.IU(.,.PpL.OJU........&.~".JR+J@t@iRNf..K~nbf..._.BxbQQb^

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\is-3L4RB.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v1.0 to extract, compression method=store
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):60539
                                                                                                                                                                                                    Entropy (8bit):7.888122896079115
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:1536:q1DQIG0KGzFfM4/TClQOofclslqC1lkM32qOEkjwMwtlk5lyl3lD:iPxROoGLqOZi
                                                                                                                                                                                                    MD5:319DBAB9B6EC1AEA0BF790A55133386C
                                                                                                                                                                                                    SHA1:28725380C07F917ACE4E511DB21CC45E9AE5A72B
                                                                                                                                                                                                    SHA-256:5BFC8DAF909D332F622CB0F42E425EC7CDFF55A3C2F4D855E2CD82566B0E776D
                                                                                                                                                                                                    SHA-512:AAA9CBF63B273160E72BAE342B8BB30611D21C5DCD21743F4FB42544C013DC6CC7E7E5E2C4EE2046B9D8742AC5F4DF6336983373EFCF6DE239637A7F8C24CBC7
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK..........v?................META-INF/PK..........v?.qq.[...........META-INF/MANIFEST.MF.T..0.}......Jd!,..!.L[...........cG.....$..dFj...{r.2...Di...........W..tG.....!W..GI.&.........=.a.s0.H.uT....9.>..(.L....(.....%...A4..jS.]R.H.&#....$.<....a.3..yx....'......-r....`...VI..i.HJ.~..MX......;...2.6+......b.<.F`.u...~.?.2%m..!.R.O.maB.x.rET4t..).&Z..#. .-.&...)m....2zy9.]%...qlk)....c70.N.S1..3...i..'.Q..7.(<.J..6.AL#.0...~x..u...5FX..........y}V............F..4.%.rMn~..4......R..Y.$J..D......m/M....8.....V6r`..4D\...:.c..908W9.0.c..F.j..F.z.......A.....1c.....a[..i..............4.P.%T.....D.....\..Y?7..g"......7...e...n........./.n.S......o.z.PK..........v?................org/PK..........v?................org/jboss/PK..........v?................org/jboss/logging/PK..........v?o.....-...+...org/jboss/logging/Slf4jLoggerProvider.class.UmS.U.=..pe......T....6.....T|K..D.q..ti.2.......+~..3....&..{wK.N&.w.{.s....._..P.c...{./1+1g".y....&$.M

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\is-3QKF1.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v1.0 to extract, compression method=deflate
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):34913
                                                                                                                                                                                                    Entropy (8bit):7.842815310061626
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:768:cdAtsqiNgUVm89SMvcHLUwlNiTyMAm0xpctjX:QAaqQgE9SbDlItqpg
                                                                                                                                                                                                    MD5:0BEB788190E652130A94600192867D15
                                                                                                                                                                                                    SHA1:C87DA0E86FAAE8BEAEAAF3F8E7270836C7C104F2
                                                                                                                                                                                                    SHA-256:379F8CF7A7378AC888E329C3FB678BC47DBBB1F7DFB693BB544E43AD5C0DAB0C
                                                                                                                                                                                                    SHA-512:E29F81042824E6BDD4AB812BF20819D72BA5B822686EE2F9FBCBC6B4B6153BEE26ECF70BDCCA3EC7A2B2778E237539785CC61614ED46162CC6A5DCE04ED415E2
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK.........Q4Jr..cn...i.......META-INF/MANIFEST.MF.WMo.0..#....VT"&I.h...].]A......Vn2.[.gc.......i...@..<..........^ V\..q..n.%a ....y......e.. ..o.x....J...g.....C.C..#3.#..[...E....'.a..>......K..^l.E(..G*.7.@...B.z..k..4.E......D.G6.Y1>..3...X.6.>.#...........v.l.MY.B[wk...R.....2.G2.....w.?.v.W....u^.h.r...CO./.1.........x,CS.r...Iqh?O...:....._I.?%.m.-S,..X.;..P%B.pJ.t2.!t._..z..z.OvJX...a c....M..|._.,....l..a.c..f.....K/..g.==..b.......I......k>1.q*2h..l.*3.i..fr.,>..6V!.q....3\..!Nyn..C.&...8&..).C...m&.4M.%...u.f[...9=._i.RG.P.b`....4M.).......q*..F1.d..l.i...5.t...G.]sk.n....0.|\.>.TsQ..8...ur..|.P....r....{&s...-.q.(5'....u......hRRMqO...].b....yv...ig...sjp.X....Rb...3j..-..vl..,1.i..be..n.@..!.bm.......5.....}D2.!c.`h.5X.]..8K);.I.s..|....8HW"...+.r...F.+bL........AM.W.z..V........T...t.....h..i.!.-...\......{..d{:..e..F..knv..L)3.gn.M...#........S...8.V...PK..r..cn...i...PK.........Q4J................META-INF/PK.........Q4J...

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\is-3QN0D.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v1.0 to extract, compression method=store
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):1894165
                                                                                                                                                                                                    Entropy (8bit):7.937531525369528
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:49152:ayr92D9km2aFiIX/mB/05HiY5oMLwK7tzSz9fZULYf74pFEh:ayrh2X/mMHxzHCxm8f3
                                                                                                                                                                                                    MD5:9C4A8D4D468DCC2B299E3AFF39C0C5B0
                                                                                                                                                                                                    SHA1:39A53E53C38689B59EC1245F807CA4AF83D18DB4
                                                                                                                                                                                                    SHA-256:A2F2B2F9BD274AD8174C9D4F2E3934FF1235A287DDE737EA45DD8D707497F0ED
                                                                                                                                                                                                    SHA-512:1CAAE0C97680D4D0BA8A1CD0155D58726D19282CDD694D9E4575E26092FCE470AB2FA26993C77C04597D1A413B51F74A4188B497C329B8F46266751B976BB55C
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK.........m.7................META-INF/PK.........m.7................org/PK.........m.7................org/aspectj/PK.........m.7................org/aspectj/weaver/PK.........m.7................org/aspectj/weaver/loadtime/PK.........m.7.Q.....Q.......META-INF/MANIFEST.MFm.A..0.E.9E..TA7....Q...N.H2)I...j.m].....0....`....^.=84....c.n.....|RK5...3%..r...:@...#...%X..,...#G..j.q.E..~\9...=j.ND.tn:.t@......zh.9.e..D....`K.j|....(^PK.........m.7B."o.......'...org/aspectj/weaver/loadtime/Agent.class.TmO.A.~.-\)....U.Z.=L|.BL...R..$!~ K..#.....Y.....7M.Q..mCQ.br....g........0.A/.=....c...C..iLf...b.i..L9(1..m?TZ6.".\.Q.0Q.....xX.:/.........<T.#....ty.R..z..b..L...~.....Bq.!.....@...fcG.....%W..<...7..1.w}.0V.d..*.U...../..D........OHN,E....|.\..Z.a}.j...(6gej...J..d.....B.xU....MRf=j.04..vV6Y...P.Y.e....Y..0..x..f.GR..j,....CU........=...#.*..{..]..{M.3&.7..M.]....t.a.oS.._.bMFU.T$m.5.k.4..N.a......y2._.B.~^.m...r.?...}.)n".....D>.2...)03..9.y.....C.p.d.5^.0.l.

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\is-495HM.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Java archive data (JAR)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):258327
                                                                                                                                                                                                    Entropy (8bit):7.75912785597194
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:6144:1MOH6CEukczSNUGP0e7UN/jnoH0LZ/+sH7DU94ynSum:taCcvvYN/sH0LgG7DJyST
                                                                                                                                                                                                    MD5:C8B2DBB2CED354D3E7832D5896ECDC12
                                                                                                                                                                                                    SHA1:A29211EBC4A6495A71AF3B5823EB7EF164D200BF
                                                                                                                                                                                                    SHA-256:5F33E8C265AE5483DC915CD5464704D499880E9844CFD795358B24697B0C324E
                                                                                                                                                                                                    SHA-512:4E4E15996FF023B702B18EA1F9292ECDAA2BF680DCC808D5150E06FEE726750DA4FA1BBA3EEE28F6915BAA1D7400080CFA01C8666C8909495E6CD0C8A2A18761
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK..........:................META-INF/MANIFEST.MF.....]Y...~..........:..B...$...(.C.3.(....N.h....Ga.=..[.^.0..u../.. M........J.......X.....?^>..N....,O..v..;/..eD..(......./e.X..c.cU.'...4......."..L.=.0.......~...r.w!.0....)6.(...Hs.cEAV8?..a9?.Q.3H. .~..i2.=....).m>.Y?n.....G?.n:.....?..........|....$m.Xi....q...oV.#5.'...2..i..#!...j..e7..;.<..s..W...z..+.. ..#._:^..,..V....g.....(....n...N.$....7.v.....8......V..PM'....P7..t...E.\.........1(....=?.w7....[.C^..y.n.n..C=m...n.....p.gc\..k.w.$z.1O/w.........s.X/......i'.?...gU?J.-_.}.r_.......{QY..\..B..d.W..n..m`{N...1.*gu...j......M..._T.u...."...J.......r92.I.?.&..p.jPF..;.......K...M.=a......@...3Y.N~..|..$|u.,.D..t........5Ce.K...";.\P.....n..m..{-v....Gr.7.|5S.....6..i@.....Re.RNd..[z... ..C9..5.4.......*Z...!..........9.?.k...r..mN.4.e..l..R.-..w.~.F../.O..F%.3...t.=z.....)V..|....83..jt.@...;..$.....z'q...Bf......O6g(G(.n..U^ ...p....q. L.m.[P.|*c.@l6.x.C..

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\is-4KHRJ.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Java archive data (JAR)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):112758
                                                                                                                                                                                                    Entropy (8bit):7.770520014653803
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:1536:RplFldF8ftppehYWOD4NoiZvI5Sv3dAVgS8b+9wA9puRYi0DjgkUSqFD:ZFzF8tEO5iRIs1d5GNHeB038
                                                                                                                                                                                                    MD5:3BC8176D36BECB7746E1F2594346ED66
                                                                                                                                                                                                    SHA1:61F0983EB190954CCDEDE31E786A9E0BD9767C4A
                                                                                                                                                                                                    SHA-256:CA88FCB9CE85AAC4F77E42EAC486AA7FDE6EAD6A545D74CCEF6089241C84DB53
                                                                                                                                                                                                    SHA-512:D31A783488CD7A0E7FE96A5ACE4B4B7E5833EE0E942EAC0533B5CF8B21AAB83D32CBC72C13B43A1DD2C3AAD4921238740A12408495E99E832090F129C77295D4
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK.........B................META-INF/MANIFEST.MF.....TMs.0..3...p.G,.@1...L..Z..7F....%.$..}.P..Mo..{OO...2%.`......"..\.W.7`..u,..b,W.ZX.~.\o6...2.z..j~p...a.....$....3....ac_t...".4.Ns.LVU.........C...i.zd...?L..+I~..L....K...?..........,.K#..l6T..%P..... [Y8...Y;.vI..T....L..w..../..4..t..y.s.%.......>N........Im..Rc=..cw.Kf.....@..D.[~k..&..d.,@.'g.w.0.q.H;e|.d....MFr..H...K..%.....l.>>.K.........*...a.X.....K@2_w..Uy..R.r....Ske..J.D.|IV+..sI..B.k|......3*.m".L..2...S.,f...*...b.P..h..1.....e..t.........:.K.......l..j..r~.L...6.ri...?.?......G.eD..]HkAVy.PK..............PK.........B................META-INF/..PK..............PK.........B................META-INF/maven/..PK..............PK.........B................META-INF/maven/javax.ws.rs/..PK..............PK.........B............+...META-INF/maven/javax.ws.rs/javax.ws.rs-api/..PK..............PK.........B............9...META-INF/maven/javax.ws.rs/javax.ws.rs-api/pom.propertiesU... .......q.&

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\is-4LG03.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v1.0 to extract, compression method=deflate
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):130954
                                                                                                                                                                                                    Entropy (8bit):7.898474046836281
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:7ytUILD+yKqJuT0GXVEFCcgPcGXJuiO7R9XSMfhYv:cvLWqJuYNCfPcoAN9Xhyv
                                                                                                                                                                                                    MD5:0FBEB5C1D9085A06EE99D4C6D0C0052C
                                                                                                                                                                                                    SHA1:6D2D7C82A4B5306EC7BF2D6EB4B67460FCE77240
                                                                                                                                                                                                    SHA-256:BC53F547390F90DBA3C12ADEC771FF6035C69156E265DCDB49D635A0C7F7D2EA
                                                                                                                                                                                                    SHA-512:266477348456F1F57C645FC14DBD20126B70771BC0C4B85522CFEA52F483BF9A863A622D480AEEE51F70BBE04985F52573C1726B245B80FDCB01448720728256
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK........#N4J...L....$.......META-INF/MANIFEST.MF.U.n.0..G.?X.V 5&I...a.rh.-j...a.&C05v6vh...'l.-.".B...7o&c&....!.\...w..B&.....g.:..cJ.PI!.LU.z.E..<...)....Aj...,.v...(.X<...+.c.....w.C/.....u..X.L.x.MT\,@..Lx....,k.>....i...."....kR.\.f...).e..|A{4...... ..sa..2"s....L...f..>.L.~."<?.gAs..J.&u..=.....!.l..\.\I{...-....~.0PY..t..._.;$...g/K.*7.......L.,...J.n....F[......?.LT..a.X.y..9.R..z....t...Z....J....vZ'.....Q..y...2)..#.Q...X!....1..b.J...t.F..G2.<.e.j..c..Y.,.QV...p....!}.h.w*.Xr...7.1....ZC...\Nq. ..Z.o........h.N........B...S...g.....ix.c..l........Tq.(...7.TS...Td. I=.d"........W.....uH.-.m..{...l..g......#k......W...I....`...j.O....\.-.zu..u..,.;..[?.n.W...S.O..fw..PK.....L....$...PK........#N4J................META-INF/PK.........N4J................org/PK.........N4J................org/eclipse/PK.........N4J................org/eclipse/jetty/PK........#N4J................org/eclipse/jetty/io/PK........#N4J................org/eclipse/

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\is-4P3SH.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v1.0 to extract, compression method=deflate
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):4253629
                                                                                                                                                                                                    Entropy (8bit):7.917126032620326
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:98304:KbTD8wJg8tSVUEZ2Udh6hoIbgip/HK0m3ZlkV9:KHD5i8GU4X6DgiJKhlO9
                                                                                                                                                                                                    MD5:4918FAA8958A502FD25EB4DBA99803F9
                                                                                                                                                                                                    SHA1:9E1B7E06D8148394632BCAEB7A5F68748C69DCE4
                                                                                                                                                                                                    SHA-256:A7AFC1A62AB04D47DA05216A80E954EE50BAD694CE9F5E8DC77932157E06683E
                                                                                                                                                                                                    SHA-512:F34AD11C08C442DE600C2FB18676CE9E073ECF23FA0DC931E120CA68BA156F45889DBC13FC2A4B497B25E4D25D4ECAF356273C99B8882778C063E3ADC72BEDAC
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK.........e+@................META-INF/..PK.........e+@..}............META-INF/MANIFEST.MF.....0.@.@.!?.k.NY..CG.Or...\..o...{.7..J.W..Y....f...H....Y3.[...bm..h.n.u.]...T..d...=|...8.`.!I..v..zY~..5....Y.1a)...{k.y.PK........6..>................org/..PK.........e+@................org/hibernate/..PK.........e+@g}..q.......%...org/hibernate/ScrollableResults.classm..n.1...%.Pz.-.Z.)..r&@!..."......8.V.u.:.y5.x...1.u..n.h....3.............<4.dBv&.\....>.yl$}.Fyh.(..;..8"..<.....me..4.l...[vY.....p.o...'.....i-.G..z......g...q.R'.a...0O..o...y.:..0~C9..;..e"..9..G.h,...J.g.@%...z.........Q/...p.....1.y.....V...UDW...Y[K....pa...1..VA..Qo....T.^K.f....TL.!h;n.o.QaW.?>.8..].K3G.#p..r.....*g....8...<.H.v....T...R}.5........K?p..5t.G.}...FOYm...w...]SA...!;.!.|SAw...2...||$m.Q...|,<|G..J7~s.......v...6....X4....t...h..s....mg.>..<.3..!.[..E..,O.".`....dE-Z......Y1.*Tp...5CY.........7...[.........r.....T.R...y.....v..XQ..Av.A..s.....y.......y....>}G..9...PK.

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\is-59GVU.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v1.0 to extract, compression method=store
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):648253
                                                                                                                                                                                                    Entropy (8bit):7.946545767180688
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:12288:z4ziuYTgkeAYxmAe80a7f5ZPKJT32wzMr5H//WRlzsDM0U0Ao2Fei7e1xIIh:eijTgkeAYxmhi5aT32wQ2RlzKPA6r
                                                                                                                                                                                                    MD5:2FCAE06EEDCDDD3E5B0FE32416F99C1C
                                                                                                                                                                                                    SHA1:79907309CA4BB4E5E51D4086CC4179B2611358D7
                                                                                                                                                                                                    SHA-256:EEEC97D5987DC8D525285FAB888BAB4C68A2EF1412335F73ABA2B804F88A6CB5
                                                                                                                                                                                                    SHA-512:CF9907EF316EE01A61F7736B20C5549B29785B7C801B1F8DB693B9A7D5478C9037719369534CC2B36C16457AE28C3F976E06C6137BA9E6B708808AF0BED7BAEA
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK........o..>................META-INF/PK........n..>V..1............META-INF/MANIFEST.MFe....0...M..}.V.x...LH0&..f...b1m!...?..uf3.f`.B.e..QkB.....5.h.x..s.#8K,.G-.{(.h;..t..........2..1.R.}..,.bI......#.`(R..9r~..4...S...K..3j.q....4C5..O]%..8.l...Q..=.PK........a..>................javassist/PK........a..>................javassist/bytecode/PK........a..>................javassist/bytecode/analysis/PK........a..>................javassist/bytecode/annotation/PK........a..>................javassist/bytecode/stackmap/PK........a..>................javassist/compiler/PK........`..>................javassist/compiler/ast/PK........a..>................javassist/convert/PK........`..>................javassist/tools/PK........a..>................javassist/tools/reflect/PK........a..>................javassist/tools/rmi/PK........`..>................javassist/tools/web/PK........`..>................javassist/expr/PK........a..>................javassist/scopedpool/PK........a..>............

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\is-5N0VI.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Java archive data (JAR)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):1192357
                                                                                                                                                                                                    Entropy (8bit):5.873549735513331
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:12288:/UG36wdw3/ji64NzK2gclfUA6f5h+XZTH8+hoJBU:/ypitK2/Tf
                                                                                                                                                                                                    MD5:43CCE16A28F282ABA113F262A2A55288
                                                                                                                                                                                                    SHA1:BEAC07D13858EF3697CEEAB43897D70AEB5113C9
                                                                                                                                                                                                    SHA-256:F8E0682AAAC407B6E039C66C22F45CFCA12EF00038F4A319045037461F19B714
                                                                                                                                                                                                    SHA-512:0ADB76CFD649F885E693C8C6BC5FC030507EEB0556AA3CB2CB60B4DC2D1BCECF236F714BDB83B4893F7BCA33E1EDE222CFFB1E3BE267D888FB6B686C4785E27E
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK........P6.B................META-INF/....PK........O6.B'..k...k.......META-INF/MANIFEST.MFManifest-Version: 1.0..Ant-Version: Apache Ant 1.8.4..Created-By: 1.6.0_43-b01-447-10M4203 (Apple Inc.)....PK........N6.B................com/PK........N6.B................com/sun/PK........N6.B................com/sun/jna/PK........O6.B................com/sun/jna/platform/PK........O6.B................com/sun/jna/platform/dnd/PK........O6.B................com/sun/jna/platform/mac/PK........O6.B................com/sun/jna/platform/unix/PK........O6.B................com/sun/jna/platform/win32/PK........O6.B................com/sun/jna/platform/win32/COM/PK........O6.B................com/sun/jna/platform/wince/PK........N6.B..U........0...com/sun/jna/platform/FileMonitor$FileEvent.class.......1.<....&....'....(....)..*....+..,....-......./....0....1..3..4...file...Ljava/io/File;...type...I...this$0.."Lcom/sun/jna/platform/FileMonitor;...<init>..4(Lcom/sun/jna/platform/FileMonitor;Ljava/io/File;I)V.

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\is-5V431.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v1.0 to extract, compression method=store
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):185140
                                                                                                                                                                                                    Entropy (8bit):7.9216858474735306
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:pF6mb9NczTyPXoTt75AQ6oBoEfDmwFHb/1Vd23l/ODoxb7DcKK:pYmb9iz2W75JLKEfDmwTVdilnxb7DTK
                                                                                                                                                                                                    MD5:7F97854DC04C119D461FED14F5D8BB96
                                                                                                                                                                                                    SHA1:B1B6EA3B7E4AA4F492509A4952029CD8E48019AD
                                                                                                                                                                                                    SHA-256:CC6A41DC3EAACC9E440A6BD0D2890B20D36B4EE408FE2D67122F328BB6E01581
                                                                                                                                                                                                    SHA-512:957A438894A196E534AF9AE1E61FB21E16F273952B55A81ABB8FAF0B139FC031EA940CF477F81704DB417D1CE6FF2D9DDD4A2CBF316903B0E2DC1AEAEF24F292
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK........v..@................META-INF/PK........u..@z../............META-INF/MANIFEST.MF.Tao.@..N........4&.Z..S.T..o..2.K......Th.k.`....73o.2).....:.J..s\....J...... JG.K._..U.(.9B].V....t.>~.Z...Ev..2.._............Lss..y.3TnNP..1O....)!.jn.1.....x.e.............5N........01.cX=...m.:G..z..(..)....Rq@.eH=..-..)...P.,V@.J9d..f.4.[......q.t.m.S.b).?4.0.:..d.g+c..^..f`.v\.g..x8..G.w\..=..I...f,9.#....S.+]0...w7..-...f.....E|.A[e..f.C..@X.f.`.^A..A..<..)w.r.!w...RD...;....Q.Z...ef.B..p.^..?.....\.y.....n .Z.......I,.5.....Z`,7"...1.p.-.....(!..P..IR-..^l.`;...f2[.;...Z'g2$I.W$Q..Z...'{..L.p.P....m..aQ......S{.n...$.....Q.'.E...R..~jzm,y..@.!+....hqE........[{..~..j/.yw..J...~.C.oyFv..e[.PK........M..@................org/PK........M..@................org/apache/PK........M..@................org/apache/commons/PK........N..@................org/apache/commons/io/PK........N..@............!...org/apache/commons/io/comparator/PK........N..@............!..

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\is-6J68C.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v1.0 to extract, compression method=store
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):11209
                                                                                                                                                                                                    Entropy (8bit):7.378195233199305
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:192:Rkon5uePZuVfsZUCWZ25Zfw2NuH3H5cQf8/coof3YQJHE/d6iZv5faV9U+2AV8Wo:RPn5uAZuVfsZUCW0TYiA3H5cv/Qo6HEl
                                                                                                                                                                                                    MD5:1DF800392C432E449D9A19ED7A8F54A8
                                                                                                                                                                                                    SHA1:2AB6236535E085D86F37FD97DDFDD35C88C1A419
                                                                                                                                                                                                    SHA-256:AC2126DFBCD8D398E4B64CD0FDCA21D2D64FF46E59326004DE2D636B37036C35
                                                                                                                                                                                                    SHA-512:A0F9DA4A2B13B3DE31F3ABA124A81D3CC6BA19CD243759A396F507E7F4E8ED18A0CB874EE3721555386A74D5F6BD4213BD846DBB21DDE420D7E1E995D0BD2F75
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK.........fU=................META-INF/PK.........fU=w.E.............META-INF/MANIFEST.MF...j.1....<..j.=...JW*....4.uc...]...E.B.%....7st......`..`".M..lG../j:..|.8{.....?.L[....;r..{[.c.vz..x.....p/...g/-i[Z.1!.....<..z.Ru..Eq.tM..:.o;.4^.,oB........)aI..0..pZrV..v..."W.MnJ..(...o..=..l..;<.x.....3^.....[.e}... ;...V`k....`..g_PK.........fU=................javax/PK.........fU=................javax/transaction/PK.........fU=................javax/transaction/xa/PK.........fU=.(.g.......#...javax/transaction/Transaction.class..YK.@...d.^.}...b.O>(.....o.8..i".TZ.......x'.m4A....~.Lr......1.8.8....6..a.<..2....z1~...+...k......(..A.g.M..X..T..t.a...g.i.IZ.aR.....V$....EC...k"..B..p.N.L.rO.G.....f.....QE^'.OQ..o...E...j......-...#.gX..d ...EPw...JR.;yK..^...<u.Z...//..z.......o.$.t2..b..f...'.Vu..M...00..>|...C4..4No..%.`.6c..C.x.M.h..J5..J..R.|'.f0...a.7I....X..PK.........fU=:.9.........0...javax/transaction/HeuristicCommitException.class.PMK.@..m.Dc..Zo..

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\is-6JTB3.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v1.0 to extract, compression method=store
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):9748
                                                                                                                                                                                                    Entropy (8bit):7.72059449707443
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:192:GZ4Wb2IT3VzVLZgkCGBX7h5sd4G671u/zot4ONraWLQqKQDAbWmU4:iPb2YzV3zs2Uw4OdJKhvB
                                                                                                                                                                                                    MD5:4EA379002969E41FEAB169D33815ED45
                                                                                                                                                                                                    SHA1:6B4973E0320E220EC6534478D60233FD1CC51C9B
                                                                                                                                                                                                    SHA-256:62382D95633A91AA7CE2976F1C6469164418DAC4FCF231021D8C11938E219343
                                                                                                                                                                                                    SHA-512:DA0674FA1D7526021F356629036E76022847B48F4FE9EE5554D8F242A9F9ED9F0AF5F1074AB8C18B4A7E8202F7F8C86C3E81E5BA97D96334A69109099CE417D5
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK.........._?................META-INF/PK.........._?].rG8...n.......META-INF/MANIFEST.MF..Mn.0....|......X.........b[.d...v.'..7?.R....f.)Wb...+...* ..a4..V.`/.C....... ..c@..G[ S^..h....z.{.c:...|.z_.*.X.}.,...cY22..wD...Q.O.B.B%m.'.....FB......NB.x......i.-."-..ZK.}..|.]_.h..+P...Y...........sa!....U.P..jUe.......1..F[Gg<....6aM.Q..P4../c....x..dF\..u.-HS...~.f!..-O...Ug.,n.....PK.........._?................org/PK.........._?................org/slf4j/PK.........._?................org/slf4j/impl/PK.........._?+$.*....N...'...org/slf4j/impl/Log4jLoggerAdapter.class..kp.....w-Y.,ccc.62....C.....0~..a.;..x-.e.,..W...I.4...I........`($.13......I;..v...dz...Z.V.p<.{w..{....gW...7n.....8....N.....98.B=..C.....8..q..Y~...;...y.<.y!........{..=..7...r...[..5~z..y..~.....o..8.]....z<..[....N....P......x...!....9.c.~..O...Z<.F..x".......>...X4..Q._.Lk......O?.....H,....e.X<.S........x. .......8pT=.."j4.....h.......Zi.hD#g....#j"QM.........Hu..4L...S:w.2.b+.D..

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\is-6OV9J.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v1.0 to extract, compression method=deflate
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):405963
                                                                                                                                                                                                    Entropy (8bit):7.878574402168652
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:6144:THyfu7HVqHVr+ktuElzb1qmxyBut4ZL+13D7Ho6rJgOl2j+acCQnTK7HZjR+M1Fg:THQ61qHVrzTzkButN33I8WOgavCT1k
                                                                                                                                                                                                    MD5:B796E0340603C27F70D7FBB40CAF2B1E
                                                                                                                                                                                                    SHA1:7DE9EEF0C6105381551E3F869149DC2026A0741E
                                                                                                                                                                                                    SHA-256:B6C46EC5B731377818B4FAF50B0F1E46A285D984ABAE686B63A618DDDF83F46C
                                                                                                                                                                                                    SHA-512:93EFA1B89615EBDA1ACA8A4560BC0A2BD2B2A84E39982757E766E6F1915E48E2CD989B4D99C1974C680D8B73CB4E894F9119819EC8A0A1BAD54F9C92F30DCE99
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK........-.kE................META-INF/..PK........-.kE.vu...........META-INF/MANIFEST.MF.M..LK-...K-*...R0.3..r.JM,IM.u........+h..%&.*8.....%...k.ry......tC2KrR.....2..u.R..1...2.3.34..r.qu.v......PK........-.kE................org/..PK........-.kE................org/springframework/..PK........-.kE................org/springframework/jdbc/..PK........-.kE...hy.......2...org/springframework/jdbc/SQLWarningException.class..KO.1..Oy."./._......1.....dbb@]...U.bgP..&..k........m....~........-.$.E:....d.d.,......}.|..w.lR.1+..S.).m..Y.T.Z\. ..E...,..N..d..J...M..Tr......A...1..F_I.b.B....=.?...s...-...?y..X. =4?..OD........1.9f..P..a1.%,.......s-..a.:..kS.9B..V?.>=.m.y.GG.Q.T.R...o.w._........k.7D.[../.Pc\E'.........S`.ScB.@AY7..X..0.d.10.I......4f..m5.x...w.....@......TU.\s_PK........-.kE.).@V.......;...org/springframework/jdbc/LobRetrievalFailureException.class...N.1....*.(.z..F..x0.0\T...&B.w....-)...D.....B4Q.`.....~...|{..+8NA..t8t .@..}+".W......3..(.

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\is-7M1F7.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v1.0 to extract, compression method=store
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):25962
                                                                                                                                                                                                    Entropy (8bit):7.811650269231441
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:768:wKfj67H7aOHXoGORsNn+rhf0kAzID3GegmzDQ:TW7+O3oGOunghpwmY
                                                                                                                                                                                                    MD5:75E1A2A3B84C59BF9D4F42DE57A533B1
                                                                                                                                                                                                    SHA1:2396D74B12B905F780ED7966738BB78438E8371A
                                                                                                                                                                                                    SHA-256:367B909030F714EE1176AB096B681E06348F03385E98D1BCE0ED801B5452357E
                                                                                                                                                                                                    SHA-512:ABA86178858B4EB876788A1D1BFA83FFD2EDF7A08AF45EECDC3A42ACC157C68D45CB6B578303CB7C93A941FF065624C623D877B279E3CC47BCF37724DB4612D6
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK.........._?................META-INF/PK.........._?..[....).......META-INF/MANIFEST.MF.R]O.0.}o....`.@.....N."J..jjw.+]W.n...6d.c.c....t&.n..|....l(..DN..w....e...%.....O.!..T;`3Y..dR..-.`..w.t..b.>.....#...m..(.f......5...if5d`.lT..+...-..;....~.Q.c..kT.2;KE_..,.`..l..4N...c..U..4>.*.^.......d...P.R..l.<.K...:#w[...U....7.B........h[..3..N.X..j....|.PK.........._?................org/PK.........._?................org/slf4j/PK.........._?................org/slf4j/helpers/PK.........._?................org/slf4j/spi/PK.........._?..1.....&...#...org/slf4j/helpers/BasicMarker.class.VYs.U..z..d.a..@"..ff.h.......'.L...:...;..D.wq_.5...FiQ..$F\P...7.*...'....N.0..|.{O.>...;.9......@;fB.c4.5...<.T".. ...*.1!V....!..*LB..!...u..&r...x... .......+a...a...xqX...x8.&d...8.Qa=V......kG..x.t....l....|./H....d.T3....=.%H.$T'.=g).5.d.!...g..I...*!..P.....g.S...[%.:..jZMj9...>yK...z.....$....T..o.{@B.FM....5_.5:.].c.g^..t./?9....H.Fa..]!.>;.>k\.IX.4.L{.;.9.>.f.

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\is-7V4QN.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v1.0 to extract, compression method=deflate
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):338499
                                                                                                                                                                                                    Entropy (8bit):7.867668225211464
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:6144:FvaEXic0OGG11Vl/8rByv2hMSylan1ep5ew2ji5E59vV2G4r29DAiTq+:PXt0Or3lE8ep8a1Usw8i5Er4r29soq+
                                                                                                                                                                                                    MD5:B5A6EE3B858D3ADA7616CC3D7656AE68
                                                                                                                                                                                                    SHA1:216CB56450E9132C2AA5E31B40417BB5EA778F3D
                                                                                                                                                                                                    SHA-256:883D486DA80DFC68AD309BCC54B023F596A1516FB47675CA93E828E721E9FF0F
                                                                                                                                                                                                    SHA-512:C62575BE2F94739C13574D3679ED2BC1F630E2ED1B90AE365AECF3C97EFDAE06FEDE69B929833284A399596A5852388308FE3BB445ED93690D55DF88A2D5AF60
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK........!.kE................META-INF/..PK........!.kE..^.t...........META-INF/MANIFEST.MF.M..LK-...K-*...R0.3..r.JM,IM.u........+h..%&.*8.....%...k.ry......tC2KrR.....2..u...0T.m2.3.34..r.qu.v......PK........ .kE................org/..PK........ .kE................org/springframework/..PK........!.kE................org/springframework/aop/..PK........ .kE}...........*...org/springframework/aop/ThrowsAdvice.class;.o.>...C.Nv.6v.vv..F......T..TF.......b....T...DF....t............l....}d.... ..9.y...IY..%...t:....A4.12020.13..02..I&.V.PK........ .kE..i.Y.......+...org/springframework/aop/MethodMatcher.class.RMO.@.}.... ~.G<.A.........&P=..,e.bi....<...Q.i5.5$...yo.M^v.....@.{..c#.(6Ul..1(z......N.i.....#.4.L....N..=c(d.A....P.7F..k.....}K..W{y.R........9...K.P.C\9.~.M...9&}4.0.y,.L1.....SO.t2cL.bX.mz.....l...t.E..w..y."&.q|i.33....[.F..Na..), .p.a....P.%./~...^k.i..g...]..F..v1....).m...$.E.$.....~._..42.W...........pd.b,,.R\.ek.PK........ .kE...N...\...4.

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\is-839JQ.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v1.0 to extract, compression method=deflate
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):242532
                                                                                                                                                                                                    Entropy (8bit):7.81939738950208
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:OmJ2ojX0Z+u7n/FQrSb/giCPBuYKqc82Jn7W2Sk3kani4huHorMRiGGBQGR2BW:V9X0v7bBC5/w7WHyPi9jEQW
                                                                                                                                                                                                    MD5:00CECF7D4C56A148AED65AC728D62014
                                                                                                                                                                                                    SHA1:E0422BAA59EDA8A9251916E249633E86C892175C
                                                                                                                                                                                                    SHA-256:BA9F749C3A957E731BF0C3C955BA06FDEE0F387416B425232AEEB5C3829D615E
                                                                                                                                                                                                    SHA-512:10DA6C1E33FF89B3055D5B636DC441F1A33576BAE2A2EF66FCFD045A3CF71805360CD8FB5BD3889AE53B930E8D2A9307BAC3C318456E5099D564B1892B11E0C9
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK........,.kE................META-INF/..PK........,.kE....s...........META-INF/MANIFEST.MF.M..LK-...K-*...R0.3..r.JM,IM.u........+h..%&.*8.....%...k.ry......tC2KrR.....2..uK*0..-2.3.34..r.qu.v......PK........,.kE................org/..PK........,.kE................org/springframework/..PK........,.kE................org/springframework/jca/..PK........,.kE................org/springframework/jca/work/..PK........,.kE..9{[...#...:...org/springframework/jca/work/WorkManagerTaskExecutor.class.W}p.g..mrw{.[...@...-$.....!.B.K.i%)...n.6a.....GB..V..Ym.U[m.U..%.F...E.3.Cg.C.q.Q.P...<.n.{.I...........~.w......6....x.6.#<|4D...x...!^.......0.....)...c...2>.B...'......x... .!4..0.<.......K<<..e|%.....O....&..2..a........p..o.../..f...!..d...C..o...Z.y8#.2.'.%.geLI.....>5..h...z..G...YF.k1+...D...m.j<T..&.NP.jj$.g.zj..-.J....S...U.....A..s.].X:....A{t..R,....#...=...*.[.H.u.....GOi...!..W..BD#.&.......>.[......q`..M.H0:.W...W....Z<c...yA&c..-.>.v].c....d.z:..0l.6

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\is-83JJD.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Java archive data (JAR)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):208804
                                                                                                                                                                                                    Entropy (8bit):7.981418646532165
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:AZ7A0CdNBlFsR96PxFLhOsDFRGNG7Xq/YV2dETNQyl4fh74luYtPBmQR0ncvqoX2:ASNBz9BxZRG2Xq/YYETNHOfRUtPRRznG
                                                                                                                                                                                                    MD5:DE6CF300C801226D4B19E4FDC258975E
                                                                                                                                                                                                    SHA1:49E72DDEE45CA9CF332C50B4C716781AC0DF07FD
                                                                                                                                                                                                    SHA-256:41565E543A043EE2073A0B3D93082B78614D2241AA2C6669E05385D94511851C
                                                                                                                                                                                                    SHA-512:1A152EFE851BD1FB029924F4854A9374F0FBB8A78B5A73EFD49B5807F45E7FFCCAC7CA780CC1BDF3090EDA6E491B2E4AFB57162EFAFBA274196D92CB972FC05C
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK..........9J................META-INF/....PK..........9JeZ..............META-INF/MANIFEST.MF...N.1..{K~...8c.A."..A".....&1..im!...].....J3.vf....s...Kq..6R,.HYv.P...R.P..V.......m.7F.....N.%...n...U.!.Jt....O<.t.....w..ai.!I!..........\3<.^].L......t...=.~..m"..Nl.....g..<..!G..c....c.Q`2..vM7.X.....PK.........9J................org/PK........!.9J................org/jnativehook/PK.........9J................org/jnativehook/dispatcher/PK.........9J................org/jnativehook/example/PK.........9J................org/jnativehook/keyboard/PK........!.9J................org/jnativehook/lib/PK........!.9J................org/jnativehook/lib/darwin/PK........!.9J................org/jnativehook/lib/darwin/x86/PK........!.9J............"...org/jnativehook/lib/darwin/x86_64/PK........!.9J................org/jnativehook/lib/linux/PK........!.9J................org/jnativehook/lib/linux/arm6/PK........!.9J................org/jnativehook/lib/linux/x86/PK........!.9J............

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\is-8771S.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v1.0 to extract, compression method=store
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):63777
                                                                                                                                                                                                    Entropy (8bit):7.56111950694482
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:768:fK7EUX2gKq/jvUu2EIW0/3VDch1JXEs8igb0ldk2wkz/t/+yjGDeIsrAkNk9AZlK:4t3r2EIhR8Cz7sd9rT6DcrVNmAm
                                                                                                                                                                                                    MD5:4C257F52462860B62AB3CDAB45F53082
                                                                                                                                                                                                    SHA1:8613AE82954779D518631E05DAA73A6A954817D5
                                                                                                                                                                                                    SHA-256:F39D7BA7253E35F5AC48081EC1BC28C5DF9B32AC4B7DB20853E5A8E76BF7B0ED
                                                                                                                                                                                                    SHA-512:BC137C5F7FA6B7092F9FC233D8BE7D21D6767F8AA51C2E934B73692C82D28DBB410F55674D7B5A0E1523B514654339277B535B7F5BB01D457A11ABA2ECA3BBED
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK........Wx.B................META-INF/PK........Vx.BC.T....(.......META-INF/MANIFEST.MF.._O.0....;4<..G.2..CL0`H4._.+TJ....o....N%......9....xEc..L..*`..v.Q...z3.V......r..)b...........F.........w....k.@K.g.Mp..Nl..".q.o..9F....f.V.O..B.h.Q.km.M!.Y#..?X81.BA..(.8H({..|o.O.3.Z.[....\...q...?q..fBZ/|...T.:.Z..*.:.o..3.T,.{.5...A.........S...2H Z"....+.l&..P.Y............G...GE22.c.:...c*_\.~......J=..Z....C.."......6ND..P..I.jm.[..8\...,.5..G.O#.K6mn+...z....T. ..3H....8.I.3....q..PK........Rx.B................javax/PK........Sx.B................javax/validation/PK........Sx.B................javax/validation/bootstrap/PK........Sx.B................javax/validation/constraints/PK........Sx.B............&...javax/validation/constraintvalidation/PK........Sx.B................javax/validation/executable/PK........Sx.B................javax/validation/groups/PK........Sx.B................javax/validation/metadata/PK........Sx.B................javax/validation/spi/PK........Sx.

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\is-8FG0S.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v1.0 to extract, compression method=store
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):90843
                                                                                                                                                                                                    Entropy (8bit):7.881156211227141
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:1536:r8V3wG0h1ETxJU3cGxK+nd7z4q/ZLPM3LcUpuquDYV/YgMmzwvBKGgcP5fparl66:r8VZlJcJd7LNsIUptv1FzwYGH+
                                                                                                                                                                                                    MD5:331071330075F62D047CB9F119FE4F1E
                                                                                                                                                                                                    SHA1:21F183828EF9431E007A67957CAB3AD4EA1561CE
                                                                                                                                                                                                    SHA-256:CB734241B1C11F7AEDE68E49D1AE8E71CE7E307ABEBFC4FE99535A2B3DDECDE5
                                                                                                                                                                                                    SHA-512:B1C6021F515B7E9793BC79D1539B4A782559519975151FD43DBFFD33E4DAE75ACE5B95C8E7A7E105438E519A628DEEED2A574896313179CDAFEE32E4C92CC979
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK.........'M................META-INF/PK.........'M................META-INF/MANIFEST.MFm..j.!.F.....P.R.x......$.-v.VYW...$o.i.?../........;T./Pj...Zp....zHh...L..#.G..49up.7.>`.#...3$...S..O.W.J.%g.1D........F_....T[........]..`[....$.sSux~.T...?...M....:.._zV..3.#.)...._.]..X...3..PK....B.....N...PK.........'M................com/PK.........'M................com/twelvemonkeys/PK.........'M................com/twelvemonkeys/net/PK.........'M................com/twelvemonkeys/io/PK.........'M................com/twelvemonkeys/io/ole2/PK.........'M................com/twelvemonkeys/io/enc/PK.........'M................com/twelvemonkeys/xml/PK.........'M............$...com/twelvemonkeys/net/HTTPUtil.class.V.S.g.~.....1.(*F..i...x".D.<.G.pI.\..d..K{.mm..v.3....V..L.....u...?h.)}..!.d....~..>....../.P.../:..@.....k).]x.<..2..T.Xu)X....!.=,....Q!.q....8..$N..qZA.|vh.....4.`....+.....!.`....#\....A.g.........\@.....JX.....>..aC....}...>..<g.....MW.....V....fn

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\is-90Q0N.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Java archive data (JAR)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):47195
                                                                                                                                                                                                    Entropy (8bit):7.919628197363683
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:768:kvW0eN+uoWRYaX2NlWHD/ryAhCDZEJXw7hczLq+73EpZvnTDps7W0ug:kvWZN+u3RYcauD28QhjpZvnTMWq
                                                                                                                                                                                                    MD5:38839FB32C40F7F70986E9C282DE0018
                                                                                                                                                                                                    SHA1:25D8A575034DD9CFCB375A39B5334F0BA9C8474E
                                                                                                                                                                                                    SHA-256:97B3786E1F55E74BDDF8AD102BF50E33BBCBC1F6B7FD7B36F0BBBB25CD4981BE
                                                                                                                                                                                                    SHA-512:FDED045C23C97C0D4FF3D2166290CEADD8D6B97147611BCF10FB3AD42D2E22A97664AD7DCE92F491C18E7FBC437B6F333E53DD4D98E98F340E1B9257D7E6F22C
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK.........teH...9f...........META-INF/MANIFEST.MF.......O.0...K.?4;.M...e....0.05.\...=...v..........k?....).l....P.I.Q......? .2c3..=......q.4..."...$}..0z5f..u..@N..O..R.+0...4..{..F..Q..RhD9..tE..`....haly_,..".a0.k..~.\V.h.O%gt..Z.9...1.?..I.."........Yo..i.A.:]..@.w.e\. D...P..+.B*R:^.N.e...H.;..Ri.v].......u.*..j..4..b..^k..m{..s..|..Lkc...E..=.......<....-....;.....%e<GP..F1..cT..(.....PK.........teH................org/..PK.........teH................org/objectweb/..PK.........teH................org/objectweb/asm/..PK.........teH................org/objectweb/asm/commons/..PK.........teH.z.........-...org/objectweb/asm/commons/AdviceAdapter.class.XktT...n.q....C....&."....6..@(..@+.L..y9.`....'.][.. TF)* ...(.b+}S..ju...G..V.../..9wf.....e'k.}.~.}....s...^...o.....j..).U..c.>....p.}g.~.Xm.{..k.nP.&.O...i3.*...X.}.T8`....P}..k.W.)(a..5m...,.J...~S.Op#.6^}......4Y.W..H.D.z..@".[}C..5y.&_2...{..ws.&.op(_M.X.L.{8j.z]>.|. .g..7..;. .g..V=..4...G.M&..

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\is-97AAG.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v2.0 to extract, compression method=deflate
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):25381
                                                                                                                                                                                                    Entropy (8bit):7.879666469310294
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:rt7B1+6JAPYKV61qv6u2vCrKDIt4cbViJm4Bh77ua1y0icMNh7G4a5EJnOre:BH+6KwKo+rKDI6Yip7ugDXm7G4RJOK
                                                                                                                                                                                                    MD5:DDBE532DF264AC014C9F99E81FE76C06
                                                                                                                                                                                                    SHA1:BD47B54064DD2C1879F8ED3DA02E3CFE54778590
                                                                                                                                                                                                    SHA-256:F7397EF23FDCBCD36223A82DEE8FF726F8D1F7EB26693956F0F44DEF0A1F7C5A
                                                                                                                                                                                                    SHA-512:ACB010BEC6BFD5D5D88D05FA7D1C6A7EC2E823A1B0B14E0FBBD7AAEA657A7532CC96D169CABC5DCD2519B61D42153F2241879573BC3B0DE7B2A643182A99930B
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK........D].T...2K...........META-INF/MANIFEST.MF.S.n.0..#.....H.IB..T=..C+.vw/{r..L.;k;..}..MYi...)..y.yf.X.u...+.JH.ngf.;......[ K^.".Re..J.....i)dFo.'.P@..a.s]:.s'R..Y).......A*Ea.....K.rB.....&/$.\....L....r.K........#...Y|.(..`4B:....:W.d8|%.d.5...2...!Y......x|..."....^..X........O"..o..Inm..6!.-......KH.I..DA0..,Yj.....l)..Y....G.HF.......F..V......6.@.'...Z......i......@......w...&m......aN#...m=...v..L...=;.B.*.X.-...R.....f..v..Ja .?CZ..\U.h..b-.8...-x8..u|nQ.E.,h...b..|r.....|8..j:]..N...MO.z;..%=3....z.q..yw..k.{.p.....|...Ky......t...(.p..v#............cW....||....Ck.P..#...+..`.M.q<.v...PK........D].T................META-INF/PK........C].T................org/PK........C].T................org/eclipse/PK........C].T................org/eclipse/jetty/PK........D].T................org/eclipse/jetty/continuation/PK........D].T................META-INF/maven/PK........D].T............!...META-INF/maven/org.eclipse.jetty/PK........D].T............4...M

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\is-9EMPJ.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v1.0 to extract, compression method=store
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):67151
                                                                                                                                                                                                    Entropy (8bit):7.8546956420455905
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:1536:rr3g1oHemadIm5oWcl+GGt46aSJLF0SNwFeTTj4R1O/D:rr3F+m2IRWKTGtBJLF0SnTTE1O/D
                                                                                                                                                                                                    MD5:6CBAC4DF4874EFAEB2B6AFB5F6041301
                                                                                                                                                                                                    SHA1:4A51122AAA338DF59EECD06E3BAA6D5DE702046D
                                                                                                                                                                                                    SHA-256:E13A8AB0240262CE4F575E0A0552B9544257CBBBC1F488886698C96EFABAAB89
                                                                                                                                                                                                    SHA-512:F198BEBE348E4BAF84B1E635CF553DB088C2986CE7347E436508BC4ABF0E63F0BD46C6CF16B8029BD4D26D924EB1AE89AC4B2A50AF7D5E7A0654B5C8AFFE44A5
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK........El-D................META-INF/PK........Dl-D........%.......META-INF/MANIFEST.MF}.[o.0...-.?X......B.>.X.-.v...u&...#.......T......9.fJd`]....."...F...6..0.c9DD...Y..[.b7...R8....$p.ok.6..mY..T(...WF.M...M.NF.?.q..x..9C.Q....J+P.]x...L............cDZ....i-#.Pi...kk.V....+..?~O...P...<..c.4.....j. k."=.ld.....gP.6..k...6....KK._...N...U..U..F.L#.W.i.?y.1.n.S..H=..l~}5.]..gg.zH.B;.V`....?^y..|e....F..%..Z...+.X3...).x.Z..o.$LBZ.`\)1.s....+:.z<./.3.D.?.....O.q/.....Tw~......q1u#.P[r*`...PK........Dl-D................org/PK........Dl-D................org/jvnet/PK........Dl-D................org/jvnet/hk2/PK........Dl-D................org/jvnet/hk2/component/PK........Cl-D................org/jvnet/tiger_types/PK........Dl-D................org/glassfish/PK........Dl-D................org/glassfish/hk2/PK........Dl-D................org/glassfish/hk2/utilities/PK........Dl-D............"...org/glassfish/hk2/utilities/cache/PK........Dl-D............+...or

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\is-9F2RI.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v1.0 to extract, compression method=deflate
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):55005
                                                                                                                                                                                                    Entropy (8bit):7.910636409186194
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:1536:AvahKxEWfQG0DKTDkr1ERoIlkv7c/RZ8pedpf1gZd9:AvahKxhTMERoVvwPdpf1g5
                                                                                                                                                                                                    MD5:D0902FF811DFF1CEB7261E2A2C85AFF7
                                                                                                                                                                                                    SHA1:9C40873BBE63EE495365E4344C323B991BF7173E
                                                                                                                                                                                                    SHA-256:570B8F97D6A909C59794AA92B322B12CF1C07D63CCFD4AC510DBE7637F203F9B
                                                                                                                                                                                                    SHA-512:1ACFDE864BFD8C1CE5F2CE826ABE0BC64BB1A28158E56FA0B343EF953E4F5DE252CDE67CAED969EE83501B10FFE8CC27C1BE49FEB68812233BFE4A321B097BEF
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK.........N4J... ...4.......META-INF/MANIFEST.MF.VMo.0..#..,.+..I.m!..-..tQ....Vnb.......w.@.%i.P...=...<gL..Rm...4."@.v...DD.:?....M..@.....N.T.. @....3b!...hnL..Z......s....x..[.....y...m..V+...Xg../.a.........\...|....U..#Y.....6A..../cN-...9...;..+..n\.O..q..ZP.)<..3".e..F Q....7W=....y.wR..~..D...h4..0....))l> ,Y......0..V...V..6..].&..R.tG.. t...34......"........."../TDR.h.E.j<QrAC....:.........7XS....W..ok.||.emc.Qkf1F..Ih.........nC.y.."bG.i....O..........?.xl.`"........%.<..4t.bf[..-_.JA....O..sb.|1v.L...sA{.J.<%.(....>)JQ-.../.*.....B.K.k.J...<e.......d.....<0L.Z...3..|e....M....?...*....w.n3.i..[..4...../)!.\....s.r{......<.....$...`SL...@Qbh.........@.....B.....OJ.h0S-k.......8.37...>].}~(.'.^..>..'y.._).!.,......R.l..l.....g5.>..x........s6V.S./..v/~...2.SN......^..9.@.<Do.......U+..?PK..... ...4...PK.........N4J................META-INF/PK.........N4J................org/PK.........N4J................org/eclipse/PK.........N4J.....

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\is-9FBS5.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v1.0 to extract, compression method=deflate
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):42128
                                                                                                                                                                                                    Entropy (8bit):7.682605744014708
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:768:oHdxqjMg1yAhE060/hssgXSqaOXk4+bGNB1cVfgIPHknYU+1h:EYtEAPJ/hHgXSqaQKPH+6h
                                                                                                                                                                                                    MD5:CEE8A12A4512173AE92E5FA71C2212C1
                                                                                                                                                                                                    SHA1:BBCF8A0CA712F7957D57AE902F9EE21BF0E19FAC
                                                                                                                                                                                                    SHA-256:89EAEBAB6757B7FA31130E74713B49D0ADC26845D90C40F92AF15922BB2D22ED
                                                                                                                                                                                                    SHA-512:3BFD4EBD7BFBDB8328B15060E50709CE15913F46081A90601E88D0965DE4B91EB35BEAA5D3DEB0C49ABE64D3CEE2E29061D48D202455996FBA9A7B313F8B7A7C
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK.........Q4J...ek...........META-INF/MANIFEST.MF.T]o.0.}...`.0.DL..-M.C.xh..j..a...\...3.....:....TUD..{.>..N..306x.m..).h.{W......d.....k.d..R..).[HS.......?...&..3..R...H{..zMY...P..=Qo...z8....1...b}.P../L..~...%HkzP.`...X....v.....-....'W,].+.2..]/.....#.hpN.4..8...Q\......)y.c..d..........u.'..8.'.Y.o....m..f....\C>.@V:..\q.....f+..D4i....j>_.n.I.Y..a...X2Q.+...iJa...)...m..|qVe?..o.y.t.V...2W:%.:bg.T.'.l."..S.=..i./V.....J.{..,..=.Jac.c0..@iu.....-.....`.......2s$......t.j.j....S....-.8.R.S..P.c\/......sx...Y..?.....C........%.b..50.y...e#...Ij7.T...{...m..j].xs......v.q..LJU... =.8...z..q.....q.[M..zR....fS=..3.`v..k..&p.-.n.g7........|..PK.....ek.......PK.........Q4J................META-INF/PK.........Q4J................org/PK.........Q4J................org/eclipse/PK.........Q4J................org/eclipse/jetty/PK.........Q4J................org/eclipse/jetty/websocket/PK.........Q4J............ ...org/eclipse/jetty/websocket/api/PK.........Q4J............%...or

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\is-9FDBE.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v1.0 to extract, compression method=store
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):275501
                                                                                                                                                                                                    Entropy (8bit):7.911690321268742
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:6144:LB9LxX3zUbllVwh9Zgo4jkHtLnS9IyGI1vzPxTxvDVUMcoVlQjM:LBdq5DwPZZTNLfyZx1jQQ
                                                                                                                                                                                                    MD5:9B31EA48800BB3209976244AE0313066
                                                                                                                                                                                                    SHA1:F76FF64F941E71395A0E07CAD82EE44310EEA842
                                                                                                                                                                                                    SHA-256:A42C7D7DC78324877A2BCAE9367A8E675ED4B90A813336B1D7CB8ED9F1EE5D58
                                                                                                                                                                                                    SHA-512:FC3031B0CACC123BA3D4062F772061D9B533951E7E3AA91EE078045AD51FE071EAC0CC49B4BA24AECB784B7942E6F5D01B253866944D056B9B875B589C9CC8A1
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK..........zA................META-INF/PK..........zAN...............META-INF/MANIFEST.MF.UQs.6.~g.....vjd0..&3Mr.L.....k.2..m5Bb$....+ ....`.o?vW..D..36....J&(..Mv..6...B.,AJ.1)..0LU.+i.d...\3........A..=t..9)>..!....<?.K..x2n(.Y?...3.....c...w^..~......Ks...s......#n.........O.......S.....v....K7D.]^........|s....'I..\.WbY.lG.B0.s...`.Jim.3.Z.R.]...ZN7..k.:..=.w.%.b.Rn..tW.f...m..n..2l...T)..[......dyG..L.....n....Z.-...Rf.....!.&.[.....?.Pf....2i`scm.........o(.m3||.....`.Clw..b./..f$.p:..?.....O.|l...n.^....p....[.&.:....4..e.4.S..$.].\.k....T.).......,...8..8|....6W....Gb.Te.4.#.........E|.....Uu.....2C5/l......|...#......|....@..d...J. ...r. ..B+.......(.wE..b..pIE...L......w:...z....<.e...-...H..F..Prs..M....J}.XG..7..ute.K^..S./..t.l@^......#... xb..A....&x..u........}Oa...t....G.,Y..l.>......]D.x4..Fa4..(.}F.8..$...-.0.O...<7.n8..vy..4.m..|.?PK........f.zA................org/PK........f.zA................org/apache/PK........f.zA........

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\is-9Q97F.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v1.0 to extract, compression method=store
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):104273
                                                                                                                                                                                                    Entropy (8bit):7.93724920413004
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:1536:0DUnftW9DtU0unE89WcM9rAitiocibJjYYt8KU+5xBETDlyqXqdby9T1fkcMJLhE:LnGDtU0uno9ZVjrt8ebBETDEEz3oLhE
                                                                                                                                                                                                    MD5:599B52D3AB218A1430ADA0DCF0B6C63C
                                                                                                                                                                                                    SHA1:B88D400FF05A22AEDFEA8718892FFCF98A401787
                                                                                                                                                                                                    SHA-256:3B293371FC84216CEEE837A5CE91E37E4C43A2F0F07AC6FA26CFC52FE9E20EEC
                                                                                                                                                                                                    SHA-512:1ED71C7C5AF95BD29E34B4CAAF3845E4C7DE7C1DD855A2F3E07E66E5CFE64CCAD23F220650391E7D57DEE43F414516DFD87F40FD5184CC61C5CDCA7167214837
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK..........'M................META-INF/PK..........'M................META-INF/MANIFEST.MFm..J.1....y..@...B.Z.*..To%..6..$..}{c.".2w.|...F.|.\0E#.j..>...D.T...].F.>...8...P.$.F....$1.#`..}...%.N.5g..=....g....&........n.V..>d.....u .;C.^.n.^_..+.X..G$7}.6.....j............_.g._S....8..PK...&{;....U...PK..........'M................META-INF/services/PK..........'M................com/PK..........'M................com/twelvemonkeys/PK..........'M................com/twelvemonkeys/imageio/PK..........'M............"...com/twelvemonkeys/imageio/plugins/PK..........'M............'...com/twelvemonkeys/imageio/plugins/tiff/PK..........'M................tiff-image-metadata-sun.dtd.X[o.0.}...^..L-..NU%V@B..k.j..I.`-.YlZ!...C...1....w;......{......|B...........8.... .............i.......(;.N..i.}.;Yc+.......!.d...IAa=.cW.xz&c...Jh.~...e.W5....~J..6........O.o..vk.U...b:...qb..........h...~....wF.d$@....B...`....G..(.*.E..v....b.!.pA|M.(..%.P..........'eo4...m..*.A.Z.J._.

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\is-9VSS6.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Java archive data (JAR)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):706710
                                                                                                                                                                                                    Entropy (8bit):7.961152328969167
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:12288:/LjYIIwgzbtAVZnXNll2CnNUAXfwW7j/IuVs5LD+8sYB49NIMNeG97HHi:vMtMxdbNU44eIuVALD+YKj7li
                                                                                                                                                                                                    MD5:7DF83E09E41D742CC5FB20D16B80729C
                                                                                                                                                                                                    SHA1:7E9978FDB754BCE5FCD5161133E7734ECB683036
                                                                                                                                                                                                    SHA-256:B04B3B3AC295D497C87230EEB4F888327A5A15B9C3C1567DB202A51D83AC9E41
                                                                                                                                                                                                    SHA-512:DAC86D742A066A40380FC8816477A62E8BB7BDE318E1F1CE44BA4B4ABE92216F079F0A91A3F3F5918AC27F139C1357356A10C63FE8C348B2BCC58F0C3B8D8B0C
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK..........8................META-INF/....PK..........8.j......y.......META-INF/MANIFEST.MFm.Ok.!.....cs.K.....@.Pv..}....u...u....uf...5..R.....N..q.V.FY...@.V....D..4]_....|A...<..#.Q.K.0$.w..0j.(..%s......ym......qV....>....k.........].c.h?....k...i.5...f....z..\..5..9...V\.._.9.....F.G7V.$.._.NV...e..v.[.0..PK..........8................org/PK..........8................org/hsqldb/PK..........8................org/hsqldb/index/PK..........8................org/hsqldb/jdbc/PK..........8................org/hsqldb/lib/PK..........8................org/hsqldb/lib/java/PK..........8................org/hsqldb/persist/PK..........8................org/hsqldb/resources/PK..........8................org/hsqldb/rowio/PK..........8................org/hsqldb/sample/PK..........8................org/hsqldb/scriptio/PK..........8................org/hsqldb/store/PK..........8................org/hsqldb/types/PK..........8................org/hsqldb/util/PK..........8.........

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\is-A78NH.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Java archive data (JAR)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):195119
                                                                                                                                                                                                    Entropy (8bit):7.706968549402945
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:AEcDYEdaefjX7tEOqbhp31ODvqTatMHLWpa9uU6M806Zz10P4umpf3HpI:TcDYEPjJtq1LOD2aqrpkUzOdpI
                                                                                                                                                                                                    MD5:6DEE9238DD2900171197104951940778
                                                                                                                                                                                                    SHA1:3845D5AABD62DC1954F2C0E84A799068C917AD2B
                                                                                                                                                                                                    SHA-256:EC225A1C66D4505FECD1AD7644CE4477E626F439FD9230DBF8338CEBDFC3A0E5
                                                                                                                                                                                                    SHA-512:49FBA74C5E3223B6A4F557A71C9EFB4069B04A337E7F2C1B4877D6DC5C812FAB7CFB5BE406CD4706261BED0D4ADEFA1A6190AC73FB02C201B316FFA3A066D3B5
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK.........[Y4................META-INF/....PK.........[Y4c.U.,...........META-INF/MANIFEST.MF.UM..0..#...V....u..Xh%V...l.^M2.W...N...v.....h#q..7o.L<......D...}.#.fc..N.......\./..P"..v....;h..<....I..j7...w.c..\8..pVq..8.\9%..2..u...h.....(9.`.$,.N..-%..b.A..D.w..'...fc.'.Z.b..+....n..........=...Y..D.&R....../.~.....^.....9...uJ..y.'..9..,..........2G4c!x.X0...SX.V.tI.Zf.t...#.X...U..g.]0;.s.t.p......P..3z$......b..!F..=ym.`f.]...o.N..B...a.3.5..fi\.D..V.o.....k.^....&....f.WD.....D..(....?..D...........*...z.<./.....G..p.....*.......~p...O9x,.B...X....*.Bs..J..'.S.re|...*s.Q,;.5.&...0.R2{.5..Q.N..j.q,....-eR..Q ..PK.........[Y4................javax/PK.........[Y4................javax/xml/PK.........[Y4................javax/xml/datatype/PK.........[Y4................javax/xml/namespace/PK.........[Y4................javax/xml/parsers/PK.........[Y4................javax/xml/transform/PK.........[Y4................javax/xml/transform/dom/PK.........[Y4..........

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\is-B98LJ.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v1.0 to extract, compression method=deflate
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):196425
                                                                                                                                                                                                    Entropy (8bit):7.9016252417898
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:OXzk2q9kw/Zz5CwzJhF6z32qH3r9Tr1rbsxOxFaz9hYJsPkHU:OXzk2otC6bF6trp18xOk9hLz
                                                                                                                                                                                                    MD5:DDE18B2DE9E0586381145805B8082774
                                                                                                                                                                                                    SHA1:6FCBF13701C2DFA6EDDCA2F54165ACA2A1FF4903
                                                                                                                                                                                                    SHA-256:296B818CC516F16D48D831037C40002CD9C3972F3AF130EFD675B7C5B44D7F3C
                                                                                                                                                                                                    SHA-512:81E0275D339462ABB97735B48F56AB63EE30F3CC52CA8ABC64E3DF1D497F02A3B01B03B556212153DFEFCCFFDBA9CC6BFDBF63BB0B3C90C8934BEF9716DB0C5D
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK........!.kE................META-INF/..PK........!.kEq?..y...........META-INF/MANIFEST.MF.M..LK-...K-*...R0.3..r.JM,IM.u........+h..%&.*8.....%...k.ry......tC2KrR.....2..uS+..R.A.c(.[h.g.gh..............PK........!.kE................org/..PK........!.kE................org/springframework/..PK........!.kE................org/springframework/expression/..PK........!.kE....P.......2...org/springframework/expression/ParserContext.class.QMO.@.}.H.R...=.A.C...1.&$.....b...bi.(..x0.....2.....{.7;.........6.5l....G.;.v54.(Q....=.".1....2............-3.......tg.)..:_.%.".....T. ...P...gs.9C..yK......K.X2....}tu..<.U......$.\w.@.'...C...S..).>X.F\:..L...r..zT.L.R...*...%.RB.y..UJ.*....).S*.Mld.....P..e24<...j....B./.B.M....:.w..W.^.~Nd.tg..S...S.C#T.gIQ..PK........!.kE...p....1.../...org/springframework/expression/TypedValue.class.TkO.Q.=..m]Z.@.gU.>Y.....Bb....!..K....m.[..%Q...&.(...J....e..s.=sw......$...@&....ra.C.b".?2.&y..aJ..0U.Sp...A..~.asA<.....2y..k..mV...

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\is-BRFCB.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Java archive data (JAR)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):36227
                                                                                                                                                                                                    Entropy (8bit):7.810477260501331
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:vYFvW/gSOv69kRuCUcGgBcTVZIXARuBsnHqMLGYrsmP8T9KcAYCefMwQz89+uPrW:AZJv69cuScJZZRuGnKYIRCefWA90nkK3
                                                                                                                                                                                                    MD5:27E8255EDB875A3ABA695D1F9432244F
                                                                                                                                                                                                    SHA1:DA0DD0EDEE48B570CD1E23895E0AC80E09EB272B
                                                                                                                                                                                                    SHA-256:51339030FE1A20B428F4A21A9EB8A901F401020B27893D6014FB10D197D83731
                                                                                                                                                                                                    SHA-512:8492870BD073F73E5856170309E9B457FF66396625CDCE419DCC7835068C51D05132C4E6D73C55EBAF92370A677E5A32D436A3DEE07B63AA9CCFDE778027506E
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK........]..?................META-INF/....PK........\..?x.-S^...j.......META-INF/MANIFEST.MF.M..LK-...K-*...R0.3..r.C.q,HL.HU...%-.x...R.KRSt.*A......t....4.K..|3...+.KRs..<..4y.x..PK........]..?................it/PK........]..?................it/sauronsoftware/PK........]..?................it/sauronsoftware/cron4j/PK........]..?W...........5...it/sauronsoftware/cron4j/AlwaysTrueValueMatcher.classuN;..P..ML.7..l...5."....H..g|jBL yQ....`..<.........av...?...Va....A.GA..1...<Bi.l..:H..vg.U..l....d.&q.l.I.J.L...D'y.i.<..j^xUJh..(E$.X.C.kB.._+.08'....7.`...b.b...(.PF.+....(]>..PK........]..?s.|.........)...it/sauronsoftware/cron4j/CronParser.class.W.W.g.~&;.......2...,..6....4.J..&.B.-..............Z/.J....Z...............s<.....;{a.%.9|.|....{...}..[.....Q.n...u......x\B....."2..dX.9(aH.....*...".\.0. .Q.q<......xx....#HJp...q....2.M....O*......1...c...C<|X.S2>.....1...>.P0.2>!.2....o.J.e|F....,.9.>/......E...t._..e...+<|....0%.*;>.Q_S.u|C.u..0-.d_,.s.......

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\is-C3DC3.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v1.0 to extract, compression method=store
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):103165
                                                                                                                                                                                                    Entropy (8bit):7.91547566027566
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:1536:KZVgVWf2NftQJndvpyVn6P9Fh1jGJY6RSVTMj/YxHvKc5JmqZbn:fXzEGn6lFh1jGJZSYglvF5JLbn
                                                                                                                                                                                                    MD5:AA4C5E5448646AB936094EABBECCA98B
                                                                                                                                                                                                    SHA1:DB2658F013FB163DE4A99274C2EB9E17EFE535D2
                                                                                                                                                                                                    SHA-256:01FA37060692B85BB704567081B61EEE133B529540CE9143E258E267F5738A74
                                                                                                                                                                                                    SHA-512:608A28E1A812661EA38F2FE77F35EF7196F64A1CE93327B9B8D2BB5C9AE1D4BE9E40C0DE731206DAA23E7F644C68EDB4C19FF27F3D17EAF24903561C8F53E561
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK........@..B................META-INF/PK........=..B..!Of...|.......META-INF/MANIFEST.MF.M..LK-...K-*...R0.3..r,J..,K-B...V..+.$x...R.KRSt.*......3R.|..R.x..J3sJ..).e.)...]..l...z...\.\.PK........<..B................org/PK........=..B................org/java_websocket/PK........=..B................org/java_websocket/util/PK........=..B................org/java_websocket/server/PK........=..B................org/java_websocket/exceptions/PK........<..B................org/java_websocket/framing/PK........=..B................org/java_websocket/client/PK........<..B................org/java_websocket/drafts/PK........<..B................org/java_websocket/handshake/PK........=..B.O1............org/java_websocket/util/Charsetfunctions.class.U[w.U....I........&......mi1...[..8.N..L.L(....._..U.d-..'.....~gfH/L.>d.3..............~R."&".T.)..e\Q...f.taV.8.W..U.YP.....~3??P.!...0..nQ..%.i....+.a9.S.!...!..`.(..XB.n/.V~.qlgXwM.p<sC...,.N..S6...v.A.M.M.t.$..{.%4...1-c.R\4.Ym.@M

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\is-DPRF6.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v1.0 to extract, compression method=store
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):142439
                                                                                                                                                                                                    Entropy (8bit):7.850962744291261
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:QrUUUtHYtZ3Q+uQEojLOAMgDQUOscwTzzdaTmvzzqcq:PUKHaZMbAMCnc8Mgpq
                                                                                                                                                                                                    MD5:FBC8593BC4B52F63D92699A916596256
                                                                                                                                                                                                    SHA1:62948CC26572EE26A3F2343FDCB9F9025F278CE6
                                                                                                                                                                                                    SHA-256:B64474A690E840EDEA7C78F4B593CE5380B956437A12BB430A2F7AD3553A5161
                                                                                                                                                                                                    SHA-512:8953D14418B669CC1E5E3DC41AAC7B189DEC9F586FEDEAC75BCE562D6D7D50D945436BD4F53B8CE625E7396F51213AFF199111F72588B53C366E98BC2D6EFA5F
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK........Jl-D................META-INF/PK........Il-D}y..>...........META-INF/MANIFEST.MF.T..1.....`q...2!a.q`..I AY..2....n.n`.>.Kh....U...z.0%.`]....Z..I.....i.jS.7l...fI..Y..vEW..e....l.$..N...Ji..bY.#.5...j..U.L.#&.`..>;0..,r. vB.'.V5.\...@%.+.]F.Wi..mTJ..d.....Ho......n...S....#...S.zS.[.....\.P...O&L.V.....H+Pw7.8'S.....".q*.7..t..k@..f.|..2 .....N....%..-^.o-.>...c..C..A.b.#.W@&l..dUd*.PG..P.6..a...P.4CJ0#.....(.ic.x:..-..O...u......K.;O..w:.v..x....,..XnD......x.8.....z..D0.:.VlW....>....>O..IW(....=o.-.6......G....;.D...(S..4[''........9m.{=T.I..Syz:...3<....\J...8W....z..5*.]_...j...8[..j..S..Y.......v*.i*..[.?.{...PK........Gl-D................org/PK........Gl-D................org/jvnet/PK........Gl-D................org/jvnet/hk2/PK........Hl-D................org/jvnet/hk2/annotations/PK........Gl-D................org/glassfish/PK........Gl-D................org/glassfish/hk2/PK........Hl-D................org/glassfish/hk2/api/PK........Gl-D.....

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\is-DRNBO.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v1.0 to extract, compression method=deflate
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):120502
                                                                                                                                                                                                    Entropy (8bit):7.955600727128229
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:ZNDKulvJuInMneain0Sw48Ueqyhmy2dvYETyMu60zuV2J:PO0Jpmtin048UeqyoxC4VE
                                                                                                                                                                                                    MD5:A403D02DE3D22D2DDEB5CE859723FEAA
                                                                                                                                                                                                    SHA1:21BBEAD8B56E21A2B4263A3449BC70FD4097F8FA
                                                                                                                                                                                                    SHA-256:833D33FACE1C4E56F87C196D99D76881630980C1AA2CB7E8FE9431C192E17DE6
                                                                                                                                                                                                    SHA-512:3D73B267F122E331BF72268F820D9BFED3DD84CA75463455A19F4C46C69EBF8FBB68C4AFCBD00FCB0678E658BA60D392B5FBB556625293796FE6B56BE519358F
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK.........N4J................META-INF/MANIFEST.MF.VMo.0..#.?X.V .....T=.,.......a.+71`jl.....w...[. TT..'of.0 .......I....^.>.)..Wj.....QkWh&.S4.z. ../.J.BwJq.....3..WA.d}.Pah.&...\,..(.L(.z...i..........d.&.)S..T&..k.Tq...XMTy..j.*.....V./.S.9^.i{.......o......<... .rU....*FSj..."....L....k.[....uy.u.L.k.K.<z..3.i.[.$s...i)\>.9..."....j..x.....Q..m.%..R[tOV. L.-.c4..F}.:.7.....NE.%.e*._.H..Q..X....&6W....$y#c.{../..z....o~[...+(......N.N..\.@.I}...?.x..+._|^...v.{.GaE.dF.A.(.fvUB..........>...W...m .X.:.9.....u"......x.#0.B..yJ.........0Jg.\......452......4.......rvXR.....WY....}e...G4c.)....Q..Vk_j.g....k...@u7U.....)!.Y......t.t. ......8.....U...1A8_.]M..in.w..@.2....<.P..[..!....V..`.@.._@.u......9.y...A..4.......h.C.U.....zw..U.5Pl.Ow...?.P...1.dc..N-....-}s.Y.8....W.*..PK..............PK.........N4J................META-INF/PK.........N4J................org/PK.........N4J................org/eclipse/PK.........N4J................org/eclip

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\is-E33TM.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v2.0 to extract, compression method=deflate
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):107784
                                                                                                                                                                                                    Entropy (8bit):7.944760279138607
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:pKEhy92fjfYLwe+svK+WMIBsTsdqoLLneKKD5o57:pH092fjfmvK+wKTJMrKFoB
                                                                                                                                                                                                    MD5:BCD2E795091B51CA6DD2C7D53A9B0EE7
                                                                                                                                                                                                    SHA1:4D0438A4F729890766F6612085712F40805CFD30
                                                                                                                                                                                                    SHA-256:1AD2875321895D757875D91C1F25BA6542909C4D76ED2CD34B6D451F55A6B83B
                                                                                                                                                                                                    SHA-512:A557FCE1C4042A4423418C6BFCA2F8B8E40322B736AADB8E8EE3BAD04C4882625BF982A0AEA06E8DCD14F611EA6345B55FC4F991DFC5C938AD7C452327F8083A
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK........I].TT.............META-INF/MANIFEST.MF.UMo.0..#..,.+..IB......J[A...^..&.L.;k;i..;NB.~.= ..7.g.9.lE.q~S...!..lL.%...x...D...$...3.s..<[3.l.3.c.&~t.). .k6.3#.bX..e.q....H.5..g..xK..aMU....$.4..@...E.R.hZ......[..7..!.pp.s..}...)..!........!.B....3#.P.b4.....2........Yk..^...)z...%6b..L8.:%f."|..t..zcBT?.v.A....+..2hLv..:.5Z....6..I.....oTG...p^6().VRU.0D..q....@... .....:....>nV.....MK( ...0)F......~L....c.[.Z0.>f..XF.=P.)wr...&.+....._.....GV...).O.i...ME..V.p...j.....y.....W.g.F.;....&.Y..?.9.K..V...e........=.[....=..kZ...D.Y....L. ..+"n..x....A.>.......J,.Vx.|-p..........Z<.....yu............i.?-.....R.\.S....)...f.'\aL..w.g....9..)......k.)......m.iW..r.;..X.-.KJ....._.>.]....Co....f..PK........I].T................META-INF/PK........F].T................org/PK........F].T................org/eclipse/PK........F].T................org/eclipse/jetty/PK........I].T................org/eclipse/jetty/servlets/PK........I].T..............

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\is-E4CIG.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v1.0 to extract, compression method=store
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):62050
                                                                                                                                                                                                    Entropy (8bit):7.921403317877874
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:768:Oirgim03eHcOSlWmuvjpNToHSQfWZy2VDfEXsHtprlPox2u+nA5q5ddrSxw3qKrg:Xtmjc+TbT4SKQ5VD7Zi2u+niSddrtvrg
                                                                                                                                                                                                    MD5:92EB5AABC1B47287DE53D45C086A435C
                                                                                                                                                                                                    SHA1:F6F66E966C70A83FFBDB6F17A0919EAF7C8ACA7F
                                                                                                                                                                                                    SHA-256:70903F6FC82E9908C8DA9F20443F61D90F0870A312642991FE8462A0B9391784
                                                                                                                                                                                                    SHA-512:E5D1FC8EC4544E1FA0F7C4AAE8DBCCA466C4987BC92FBBC430B054B10D646B745ADD4A754B1BE9D50EDD64330C798C53173A97289DB57A966312E16F934E9D1F
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK...........B................META-INF/PK...........BY+.R............META-INF/MANIFEST.MF.T.o.0...)...o...h.T..RV.....&US.&&..;r.B..].@.. ..w~..^.L...,~.&.Z....u..T...X4c...6.a)...Dz>.*#R'.P..b.<?....QKu.t.M.<......).se..s<.V.....WX.....5DV..Xk..K.cJ.^.....W.6!.O9.........~.\.U..`...e..(...#.*...E.U..Sk..,.b.....p...:..}....[..u..!k...v.u~c......I..7W?.!....N..~(..Z.\.{#.c8.<.f..2`......d..u.#...oX...>.G.....~B.'..j.+.w..2;.1..0`........o.koq..)....+.EF..:>..D...S...Yj.ALJ]..H..Hrp.a..g#..c5.v.M....R...B....5.|........o7k....J.N..D.R.Z.=W...[........L.Rv.+..f.G.z.5..g.x_...u.Vdb`+.mf.zr.~I.s..*'.(....JB.....B...C..x.... ..(....?*.y..=....;......v.V-=z.{ll.k.Wq.S...g.;y`.j.....x9.^_...O....}..nh.4h..3.{4.^..c..a9.V._=....M...]v'.2..&.:...PK...........B................org/PK...........B................org/apache/PK...........B................org/apache/commons/PK...........B................org/apache/commons/logging/PK...........B............ ...org/apache/common

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\is-E7GOL.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v1.0 to extract, compression method=deflate
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):867531
                                                                                                                                                                                                    Entropy (8bit):7.865365062135231
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:12288:ejWovawIGmhHK1nvQ+MMgnv0aESYlLc9zwpR5pi7H9dYdo0HLSbxkLdk329G+lv:ejXvaav+Mgnv0/LizmjpCH9deTioqP+9
                                                                                                                                                                                                    MD5:C346A369CF96D1F04A70A65FED340D52
                                                                                                                                                                                                    SHA1:2FEAEA75B4A188129BABCE4B149197FE10DCE6B6
                                                                                                                                                                                                    SHA-256:4FA5673825EC6982736982C71418DCE4AE83CBB689BCA653493209DC1309780E
                                                                                                                                                                                                    SHA-512:2E02E9EC7B253DB9BF4CF7B15FA8080B06A74D5CF2CCF0D87EC26AC5220BA579759BFCB922A5741CB5C7916E6FEEDCE11E7E8C3A9117B30DC898342A12E991EC
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK........+.kE................META-INF/..PK........+.kE.^.x...........META-INF/MANIFEST.MF.M..LK-...K-*...R0.3..r.JM,IM.u........+h..%&.*8.....%...k.ry......tC2KrR.....2..u...JR+J0T.m3.3.34..r.qu.v......PK........*.kE................org/..PK........+.kE................org/springframework/..PK........*.kE................org/springframework/cache/..PK........*.kE..[R........%...org/springframework/cache/Cache.class...J.@...i...Z..z."...<{. .E..z^.1..$l...<..>.8.'..qa.g......z..p.........Rek~4.,.Hz..lf..*..A...zc.8..W.Qq..$^.&.k....../[.....Z|...7.vm:/L.W..>...).k.--v...ZT...y....$..I.tL...X..^d.pQ....4.cB...m#...'a..O...q>..}~..#.Dw.w.b...{N..w:.ttp..#.DC!y.]...PK........*.kEU..>........2...org/springframework/cache/Cache$ValueWrapper.class.....@.DgcLL.`aoc. ...A.,.....x..D......\J........<_.......:1W..t.M.].L.X.N)G....ZG.N2nB(../.." .s......Z.....#Zrr.Y.G-..5!....X..,K.........`......Y...l..q.9..PK........*.kE..A.....D...,...org/springframework/cache/Cache

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\is-EJRNA.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v1.0 to extract, compression method=deflate
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):452498
                                                                                                                                                                                                    Entropy (8bit):7.9313659465678
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:12288:NwQyOP++d1nf36ogEilByq39N/FMZxL9fVRHk5SgL:NwQVDPrwlAq39Lox1rk5fL
                                                                                                                                                                                                    MD5:17887CB40224DDFC3249AEDFB7358560
                                                                                                                                                                                                    SHA1:810C4E4275E399FEAF6E8BC51AA72645BDC06205
                                                                                                                                                                                                    SHA-256:5538741F52C7764EDBC31CC890FFF2F9B99A1A740A9288C43BFCD5C87B871E68
                                                                                                                                                                                                    SHA-512:FA2469BD15B4481E7111DFD3EA976A084BEC6D1D97F15C0A8AF93D4E3DC147BF32121A900FF55915093B7B12121F6FCC7FEBC89A6711B92020438FD1C0B6D110
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK.........N4J.5..............META-INF/MANIFEST.MF.VMO.0..W...8.@"n....qX..X.,....V&...n.......'%4..A....=...x.b>.m.'P..8 .u...4..8?@..'&[...l.RF..2.j. ........y.....I.^.......s.R.z"_......a...=..v..P.D.../.a.....$.Yy.M.I...f.,...-qW./...%M1.n.f...$.....C:..]..w.z~v~..s......|.G.i3...r.P...`..}w.?).l.,..b....\A4ZC...G.+..|P].b(.G....L6...Z.K..#..c.%....b...u*..g...K.&.".WR....R=v..D*.. ....(....N...&S..u.X..f...S_S.j%.\.._....)..O....R..Y`z5.......ul.1.yj....K]..A"O..J<f..i.-w..B.....LU...yZB5...fS.%..C.\..Z.<..T....j.....(\f..gMc..V..?..X...{DkQtM~>.R3......k..S.X:.V..`...GO.1..+.......1....b..D../a3.N..!O.\..........&...3N....:....o..g..1.....qd.>Ub.8...c.u.......w.^.?.0...[......B...8.Xx.Qf..3K'......A.D....h]v.}S....E......jf.......Lw...p....Nk.\..C}.go.%..U...N.l{%i.Z.r....1*Q..aJ...yZ..S..l.{D..y.}[5k.........aC.}q.U|..F.}}..E~...m...a......+..........w..T..Z....:..).n.M...&'...3..^..:...F....^.....n....PK...5..........PK.........N4J...

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\is-ETOT3.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v1.0 to extract, compression method=deflate
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):21338
                                                                                                                                                                                                    Entropy (8bit):7.848740350449547
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:flWiPIJjmnp9nDbL+yeuLrG2A6xW4t9cJi/QrQblPYIQ4:tWiPI8np9DbLzLrjAIWe9cwYMBQX4
                                                                                                                                                                                                    MD5:7DC87F04CBDCC1FDDC90B17713C1AC92
                                                                                                                                                                                                    SHA1:E78937C6299B5C3FE4EEA9318D020566487012DE
                                                                                                                                                                                                    SHA-256:49A757232ECF236B012494BED1B47DB26E4F70682E379BF9613150688F478472
                                                                                                                                                                                                    SHA-512:2350EFEB1BBFF4FC380D9E4EA9F83541494A98E77D68F7C25A5C201D2E8BAC2E7A0EFDE2CD85D331B670A8B01B3B97E3F5AF2612FE4A9052492B0CA1095E83C3
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK........iQ4JA.."............META-INF/MANIFEST.MF.TMo.@..[..Xq............ EI..z.6..K.].6..g...Q..Y..1...}c&..... .\...w..\&....Aj...4.tV..e)..@U6.........R....:.B,x..x{'*. ..@*.".i:O....Q!.-[bV....0..+x.*~.C5d..c.\....... .o....O9$.R....^...\w./..$.5............aG....J.....~$.EB..y........d%.H....L.n22..F.u.._w....Oj..\/S$.&,~b3....Z..~^T.]4....'.B.V.}.C-?&.O.{.f).C.i..'A.>|.Jamp7.._..m....V.o.k...7...3......,.h4.4...*YZ..N.ey.J.<~=.c.......o%.....23_....P...?W.....4.s.......|C.c2 .'.j..Y....M...~...*?.....[j.q.S.......$..4f.w...-.Y.pgD.M..c..2QYD.U..'.Z@...g..)....X.8.>^.......$<}..t..xUR.....%.....0....o,..Y..Te...1t..#..........H.....z.... p..y.PK..A.."........PK........iQ4J................META-INF/PK........cQ4J................org/PK........cQ4J................org/eclipse/PK........cQ4J................org/eclipse/jetty/PK........cQ4J................org/eclipse/jetty/websocket/PK........iQ4J............$...org/eclipse/jetty/websocket/serv

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\is-F6FNR.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v1.0 to extract, compression method=store
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):95806
                                                                                                                                                                                                    Entropy (8bit):7.852873716063267
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:1536:mtzeg5uZYCaY0D2oRqwaO/pgnKqG5JQrHnr0PnEEl0qDx+HD:mtzu70D2oSORgQ5OrAck02xWD
                                                                                                                                                                                                    MD5:79DE69E9F5ED8C7FCB8342585732BBF7
                                                                                                                                                                                                    SHA1:3CD63D075497751784B2FA84BE59432F4905BF7C
                                                                                                                                                                                                    SHA-256:AF456B2DD41C4E82CF54F3E743BC678973D9FE35BD4D3071FA05C7E5333B8482
                                                                                                                                                                                                    SHA-512:32F7E3565C6CDF3D9A562F8FD597FE5059AF0CF6B05B772A144A74BBC95927AC275EB38374538EC1C72ADCCE4C8E1E2C9F774A7B545DB56B8085AF0065E4A1E5
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK...........B................META-INF/PK...........B..{.............META-INF/MANIFEST.MF.TMs.0..kF.A.S2..8m....m...z....Q..#....].@<...U.....Z2)6.X.;.F(....1.....E/l...lG..e..ma...FG.4.&.".J_...H.cR*.,..n..n.S..]...U"....QO*.R..1Bbm.w..-.<....c.W..hZ..:.}@L"..I..9..FDm...........`q...I.4 S.;c:...I.'.;.Y..?.6.n..........&..{:....l.}.!...)3.0..eY!..h._s.E....t[.l......y._z.........2.`..}}..7W.....[......B...4.V5U..n'.....|...J....TD.l>..=.B.z....m~X.....iy...Z..@ Kl%9..p.}..{o\..../<...C.$.N{...?...g...j6..a...S.......c..9......Zz.V)......0..PK...........B................javax/PK...........B................javax/servlet/PK...........B................javax/servlet/annotation/PK...........B................javax/servlet/descriptor/PK...........B................javax/servlet/http/PK...........B.b.a........+...javax/servlet/annotation/HandlesTypes.class..OK.@..........."X..s.."....6...6.a.v#.M._....%N<.....}..........p..........\..ZG...X.2..........*6.e)#[%....S.

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\is-FCBRJ.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Java archive data (JAR)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):53866
                                                                                                                                                                                                    Entropy (8bit):7.7778453938519805
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:768:TlvIIwip2Rql6eMZei10S3IlfaJ1GkQzyY6ooWqKoPdg+h6+cySVUHsNeSZOX7rm:Tl8qfM0i1hsfajgeooW/B+cySVxZ2uJ
                                                                                                                                                                                                    MD5:3CC0F2967701C5388D3DA8E6DC7AAD8B
                                                                                                                                                                                                    SHA1:154B384E478CE7D57252A0F1622959EE15C47142
                                                                                                                                                                                                    SHA-256:BCE20C810BB086B101DFBADD708D3F3CC923DC08BB130BE41F0943EDA0C8FE8F
                                                                                                                                                                                                    SHA-512:B731875B657745F9E8DE5727C3EA85823A9494F1ADC0A2298AE1955596E6E157850D94EA7F4506C801442A366B66E163359345FB02F7431B508780BE43BC949B
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK.........lD................META-INF/MANIFEST.MF.....W.n.0....?.....%N.:.I.....M.K..#Ml&.)....}..b.Z...Xz.f.'fE9{...{....p.d2.\..[R.W"`O..||.q.a>...... aa.}.^L...<.N..z[8...oR<.m.. ..../Y.m.o...B.s.r..vf..aQ.B.\S..........h./...nG..~.....-..\A.[.T.'.6.n)..q..2.|}s.|..v.0}.....c.M...x..F......d.....=.L..{...fJc.\.R1.....4p..N..=.@...v.\... *...n.f8..@5..\>.....[.N.wn.d.0..+Ri../t.Vs.+a\..4.H..........G..U......l^sf7...Sd.....Z.uz....'...nk. 3b..0.....|...CCA.f!...yd<`|}.A.J.....Q...)..Tn..sS...H...]!Si..?.u....(....[S[C.*-7...gt.M.v9.z.e..t$.I..*..elNW.(2.`.<r|E.e.2....4.Na....S.k>952.....m..L..d:TS.]6mdyN.e.l.Q>.~fNU....#..,.q.......P{.L..#..K.R-S0{.&....Y.H..fN}w.u..#Sm...Q.+Q.....o....b.......|!A.0...Kao....+.....;'... .)/..i%^y?qO.o.?..hB...F...7....e S....Z.x.C.B...j....5.`.+...4.C]L.W...%...R.,..]..W.....,...7.H.nS{E..V......]........'.o....._...~........N../PK.."..`l.......PK.........lD................META-INF/..PK...........

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\is-FDUTQ.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v1.0 to extract, compression method=store
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):81271
                                                                                                                                                                                                    Entropy (8bit):7.791419794562344
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:1536:o4Ug0Pg+ZHcUCSU8rAud2yXGaL/FTlg+cBL:vUg03HpCSUY9rFT6lBL
                                                                                                                                                                                                    MD5:2F183E60AD3D10E654BC3C276445033A
                                                                                                                                                                                                    SHA1:78BCF608D997D0529BE2F4F781FDC89E801C9E88
                                                                                                                                                                                                    SHA-256:CEA2405CF0F5427E226CD4957973E8B3D83091DEA2F6383A7168192C790ECD06
                                                                                                                                                                                                    SHA-512:C2D5CC7FC72F5DA115294806294D65CE2B57A74C6E136CE3C8F78202A0FE00134B8322DE1DC96C9C9DB445AC2CD37BDA007391EB60B0D0FFBB5E1C3D363A8B21
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK........).}?................META-INF/PK........(.}?................META-INF/MANIFEST.MF..OK.1...|.|.L."....b....U....&.%......a.=.q....t.nG..-.."...F.U....4..<}MY..).DX....Q....T.{b)......q...~...@.vu+E..u.1g.b....S...........!D.S.)6a.....~q.Q..[...Zs..8z}~4j(e4..Z;\.[b.S..A...<....X.c.RH..PK........'.}?................org/PK........'.}?................org/hibernate/PK........'.}?................org/hibernate/annotations/PK........'.}?............!...org/hibernate/annotations/common/PK........'.}?............3...org/hibernate/annotations/common/annotationfactory/PK........'.}?............,...org/hibernate/annotations/common/reflection/PK........'.}?............1...org/hibernate/annotations/common/reflection/java/PK........'.}?............:...org/hibernate/annotations/common/reflection/java/generics/PK........'.}?............&...org/hibernate/annotations/common/util/PK........'.}?............+...org/hibernate/annotations/common/util/impl/PK........'.}?=,..........M...org/hiber

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\is-FH64I.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Java archive data (JAR)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):53468
                                                                                                                                                                                                    Entropy (8bit):7.946464308228651
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:768:6rUAs5+v5mNz7jiKFCqX6ueeG+MXZWuNQM7KeLnq0hHtnZfn6hN1:u9knCqqus+8NQM26nqetiN1
                                                                                                                                                                                                    MD5:3770466405F163D6616B65C32E16A3CD
                                                                                                                                                                                                    SHA1:5EF31C4FE953B1FD00B8A88FA1D6820E8785BB45
                                                                                                                                                                                                    SHA-256:D2DA399A9967C69F0A21739256FA79D284222C223082CACADC17372244764B54
                                                                                                                                                                                                    SHA-512:A9246CFA56CCBB645C01FDBB77622DF351A9CC6FA4C4A61F0FD6D83AAAB951A7E625480FD759DCDA2423C53AA5CE9E31F254B1D23AB039C303E9AD0FEBBB0679
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK.........teH.2..*...........META-INF/MANIFEST.MF....}.AO.1.....h8.Ml.E.I...5.j...v.j..n..........2...9..O.....R..Q.H<..Ts.2./.U......2R..X.2.2......,.....0#.-.0..42.....`.v.7..|T... *.........z.3.....o...J.......Q.M.H...s..@.. l.F'..do..4......{.z-]...'...ni.....Q......x.,\.vsoZan...OJ.0.........Xj.......{_.Z..<B..N....GO.M....PK.........teH................org/..PK.........teH................org/objectweb/..PK.........teH................org/objectweb/asm/..PK.........teH............)...org/objectweb/asm/AnnotationVisitor.class..]O.`.....(+.....:']...`L..b...../.4M..R.~...&.%...~(.9m...3{..?...y....??....]..@E. .v.P.{b..w.'.....'.;......~....qt.^.i.....><.....}.&a..u..&l..{..u. ..........s'3..(L_.^.>.z...uU.<$(..9I.......'......'.........5E%Bu(+B=..@..$.>.f..AtJ.............H..=...7.f.>f.<.....<B..e....X..cId..E.D.E6D6EZ...%........H.v./..;...|G.9u,....y.....U..3.e.....\a.......c....A{...kH...Jp....w.b....1..W.....10.t.@w2.Y.K..i.....k..a..

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\is-FP5EK.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Java archive data (JAR)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):308863
                                                                                                                                                                                                    Entropy (8bit):7.884396117260113
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:6144:UohU5MMRxDpMT1saqsSscC7+Km/45yVecAgDI0CmMBZ4:jhUpRxDpg1slsSfTKm/4MeULCPBS
                                                                                                                                                                                                    MD5:91B16B5B53AE0804671A57DBF7623FAD
                                                                                                                                                                                                    SHA1:4166493B9F04E91B858BA4150B28B4D197F8F8EA
                                                                                                                                                                                                    SHA-256:0E22C49AB86A6533299160B95DB9201FD7040F4F082E90D563CA7E8D972BBE3A
                                                                                                                                                                                                    SHA-512:EE13F72B87587FD5CA4ADBAD7A5AB2A04CFC056C68FE3D0633F2DBD554564AA8043C6A1447FB2450C01855AFCDE116C74DB4B736D684558507CA7BC7EC391F8F
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK..........<................META-INF/....PK..........<+D..............META-INF/MANIFEST.MF.T.n.0....?.9..E?......@..m....4...P.JR...YJ....../.v.3....3.......b..0.R[.......!..v.o.9H...<...G.N7.v...U.I C...0..t.!..ft..3.b&8s..=.'!&.?.}d.M.~?DU.ML.R.......r..2..a..RP.Pe..9....1...d..D..).....V..h..m..k..,.-.#.t....R.5.O..\la.I/..&...ra ...s...Z....]Ln{.A.da0(2m\t....7..B.)...r..j...&T........teAw.l..Z..:..i.R..[@.h3..."{....H...A. ...v..."..B.CY.............e..K...&/VU./.z.'.U.>.y6..{...n(C..7KVd'.~.T.\.Gg....;.........+.\..V....o.........l....W.0......5m.t`...8...}..........z........j.1z.A2.gnA@..cV}.K....z.m_'p.r{`.....:..=...f..u.3..z.Z....V.'J.....f/}.....4.n......#).T.h..]xh.^..w.S.dtGl...y.A.....PK..........<................nu/....PK..........<................nu/xom/....PK...........<."mq............nu/xom/ASCIIWriter.class;.o.>...=..F...R...\}.`gO...."v.FF.A.xHjE.L.....&3/...AU.'+.,Q?3_."m...$.....e.[k..0.2.q1.0.32......''..%..X4.5...s~

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\is-FSUD4.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Java archive data (JAR)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):156881
                                                                                                                                                                                                    Entropy (8bit):7.762969978142032
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:tiEEx/OjKJSNrtBCiYsXM0omY7UKVzyAcbvOi674laSyjQb:tVxI0DYs0uefcTL6BMb
                                                                                                                                                                                                    MD5:36E56C9B13E6A768187FC1A9EE68ECFF
                                                                                                                                                                                                    SHA1:4A2D03D3AB2D0ECB2771320A35764A8205C006BE
                                                                                                                                                                                                    SHA-256:3E4C789AAD32BDA167DD6BB3764CA6DD4726A515B0D2AAA1A4205F585E77CF7C
                                                                                                                                                                                                    SHA-512:800267BDE6467D9682153CA0241B3DE320536552996C97CCFF16F685E4F3E101F0FC777A736F91CDC2CFA26AE3B02C7E2A2F3AB85DEC0EF1EA0486889479F6DE
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK........)..:................META-INF/MANIFEST.MF.....[Y...~...?t...p..."....2.L.......(...U.........Q-.i._.k!.i..e...2..._.w......K.od..V../wO...*n..X.x.}.......^V|..?y.5...........M......:.........../+..,..i...I...wc....7.../.........y...{.$\.....+."..7I....&+....:N.8.....~Q...R.....k.Giv<.}.......4.....or....w..z_...._7ef../.w../w......sw....v^q.A ...4.v...H..gE.Mu7;7|.~..Yj..$...?.i....:....s..>..7nR./..i.....J......y..%..S........>g.<ls...9..q......f.>O...9..z.....SP....0..0..0..0.^. .........'.S$..}..m.<...:K..Qqx......b.*A..8^3..5%\.....>....f.'_.J..Ek.O.ho.76.,3...}\......<.sV.J.x~....g..]IF...l..)x'...0m....y...^}N......9...z.*+.9.....-..~.+.q.36bM-5.8Y.E4.]W.....=@.....L.^..(....r.$.>.z..<(5.Q..x.uOJ:.H.......G_..q...=8.#f....$...$.-d!h!..,.W.w[..Y.D...W.Wb'7..-k..K=1.(.f...P.~H".Ld.@QD...QxE.ViSx~..w.x5..F...).:......M..f#.W.P..Q...S.uYp..."..X.A...."Y.k.)..r....G...K..-..O...k.^5..U.V}..........@y.UG7..W.H.

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\is-GI8N3.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Java archive data (JAR)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):36611
                                                                                                                                                                                                    Entropy (8bit):7.580265692066697
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:768:v03vilnIEjwkPyHdX0NPFarrL6IIqIvta+xXUf:v8inIwwkPy9ENPF8rL6Iqta4X2
                                                                                                                                                                                                    MD5:510563AC69503BE2D6CBB6D492A8027B
                                                                                                                                                                                                    SHA1:FC843B649D4A1DCB0497669D262BEFA3918C7BA8
                                                                                                                                                                                                    SHA-256:DD93009FB5AA3798BCD9AB0492A292DDAE0F0B1ED2E45A75867A9925C90E747A
                                                                                                                                                                                                    SHA-512:63832BDFCE55C1014D0EC6C7B8019FBFF5E8503FDCB19E93AA6F21D2609EBE50EA9A8C1C36132EDB9E5064B909C669EAF02C91624B54D9E9504DEFEA808E5DC7
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK........(i.B................META-INF/MANIFEST.MF....m..n.0.E.H...m.....b...@.E..%2....m.....&U@.]t....O.`.06\.6L...V..D......A..F..w.q....80...l....j....s..9....8.#0T3e/.'.9j........h#5...B.=.k....4A;kU.E...KM(.Le^R). ...q..c6......H...h8..O..t..b...u.._.e....Fr7.....G.~..Y..t...].........Jr.".:A.;n........c_...4ui.T.h..[&....%..g.....1.6.......U..0.......+......>..Z..C......Z(..!.G..)y....q.._PK...uQ.p.......PK........(i.B................META-INF/..PK..............PK........(i.B................META-INF/maven/..PK..............PK........(i.B................META-INF/maven/javax.websocket/..PK..............PK........(i.B............3...META-INF/maven/javax.websocket/javax.websocket-api/..PK..............PK........(i.B............A...META-INF/maven/javax.websocket/javax.websocket-api/pom.propertiese.A.. ...;..g....&=.5.<.....*.B......u.+E*X.. ./1.}..(.*M..P..s..0.q..@..:.......{.{.P.9.QK%|I-.....W.%3'..*.T.....af..PK..R.=.z.......PK.........B............:...M

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\is-GSD72.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Java archive data (JAR)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):258875
                                                                                                                                                                                                    Entropy (8bit):7.947801994952566
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:6144:TKDTD6A2ES+HaRzz+ZIHWV8dDw/p5JTAhzYGuFl4F1w:TKw3Q0fEIVDs5JMhz6Fl4F+
                                                                                                                                                                                                    MD5:A9F7504E534420911FF6AFDC1019CF5E
                                                                                                                                                                                                    SHA1:0142CE64DCD709A4B5F6E7D71305A31D3893D077
                                                                                                                                                                                                    SHA-256:6184DC12A30BE189D7417CB619A2143762FB9A6FECC35707F2A31FB2B280C1E6
                                                                                                                                                                                                    SHA-512:7E1FC3B402E2ECD9E3D3C2E1BCA50C6287BDDA76F45F0C110FF80BF10CDD439B867E959AB8A9F6D0EE81F17764E460CF3D8FF27CFFBFD72DDE0057BDC8E4931E
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK.........PLG................META-INF/MANIFEST.MF.....TMs.0..3...p..4.6..1.!.:....i&....Qb[.$....b.............)...T\D62.Q..G..S.'..K.<..Z-...v......<.xo).C._..,....F..$..y....\.c./...!..oJD.....M3..-...r.?....<...l..%..8`!..0........VZ...}.W.."....L.L....v...9.......l6...]1"._.....G..t>..b...G..`...15.!.u...w.B@...2.r/s... ...R...E..6:..$.X.Y...>..]..O.&t."...,H|.6......../*....E.&.......%._..0.....$!C.?k...H\\.....P.....v.J.....2+.<u..R..r..g.t....a.ml..l .c.....j.........a.....G..*`.....N.d../s...a...9a..M..T.T...C.t>.U.1.U../.....'.C..x..+}.".Q.6......n.m.0,.S....c....H.ag..N.4.D...I..PK..Ba.m=.......PK.........PLG................META-INF/..PK..............PK.........PLG................META-INF/LICENSEM.1o.1.......$..:.U.C...u..K|w..D..S.}.........9.B...r.;.G..v.....@.Y@M...((J...H.T.O.()E.R$.....#....(.......$.5..?.rQ........F..H.|R..O..k..&.z.....0.[....s.. 4..k.Z./h.s..z...g..]uO../x.G.87..M.........Z......n.*...PK..........L...PK.........

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\is-GTFPA.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v1.0 to extract, compression method=deflate
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):159466
                                                                                                                                                                                                    Entropy (8bit):7.836744062657023
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:Ik/GZmHTRUTAjeOjGsmhzGmxDEgZtmKh9XZQgOOd:IR85zjv6imxDEgZt/rXZQM
                                                                                                                                                                                                    MD5:CA3787D5C84695976559A211BC6FC12F
                                                                                                                                                                                                    SHA1:4E7F2EB46A22E8E23C18502E0D9AFC667961FEF1
                                                                                                                                                                                                    SHA-256:1EECEF8E88247FF3BCD41693F7B40A0DCE6BFE7671980E18B962F0B0E1812EDF
                                                                                                                                                                                                    SHA-512:DCB57E8546BE15418C1251CBD4DB99EB65765A7DCFE179BC93B6D77CC4DBE2E28BBCDDD9531CC04338B668F9013DBC7B831E16E802AF19F9E3B98C3A2F5A9288
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK.........Q4J..~.M...........META-INF/MANIFEST.MF.X]o.8.}G.?X}X..1.mY...[...`...y......6.......$..!qRU.hr......3..g.....J..%.....U.......H'/^...7.....5...CM>/../..CXn:....w.B.......(....T..~..V.......5.vo.....a.H.x.....T.G..vl.-.|.o..../l...>...Zo..?.H.S..N..zE......3Hd....7 .W....L....>.w5....F.+.vr.f..9. ....Y....w.p.I.......<....CG..XF.X...6.H..2.....5.g...j.h...#h@..Gew.,.._..C.W=Q..../c.LR.y...1./.KU.e.G.y...y.N..;........^...r<...[....F.!..nj.......X)e.$...."..o.a...!.Ds...w...<`.Z.l....}Z9.KcX6.>.L.SK .K....x..)_c%j..'H(.C...W.....>.P.j|..j..$.k.9A..((....yZ.<...e.#.?G$.....O.%T|y=l..h.<.........(...\....>0...&.9.0.....H..,.....C4..2.iv..`n......D..5sk......QA.9.]~.........gwi{.8.RA..@.U..5...... ...h........a.HSh..C...w;...!B...k.M..P2...Lkd.H.t. .........*.S+...v...Q...%.%..[^...@..o.."ht...3<.....e.....de.6hs.c......V.SH.y/g..5J.,.j{Y./....I..xjC.D2..3.l...4..r......@.*...F.].}]<o.]..L.l.l.....;..N.g!.B0.,#Zx.c....]R..S...i

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\is-H71GP.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Java archive data (JAR)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):151688
                                                                                                                                                                                                    Entropy (8bit):7.864915233624376
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:cDxN8qyGsubdxJ3ws4HLn1iY77mGMtB7mX/SpmTSc/Y6xwc:cNFyPubdLg311nEtE/S8TLY6xZ
                                                                                                                                                                                                    MD5:ACA89047D46700B3A1C94BF5357FCE6F
                                                                                                                                                                                                    SHA1:FB973800C0329E5FD51B1B3EA8D5DD8835EC191D
                                                                                                                                                                                                    SHA-256:F3E68C5041AC7B86A80953229DAF68BC6699F2F68CA923A95CB1C4F72BD25B4D
                                                                                                                                                                                                    SHA-512:C55E1038F7B97F91446678D5FE40BD8957EE0938130458091CD7EA67179006AE82E1FFE35D61F4D513E65A60AAD24D848999FEADBEF1522AE3E9204D20B80831
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK..........lD................META-INF/MANIFEST.MF.....W.r.0..3.?x.u..#$...I:.v....M..a_@.,y$...._X.....s./..`K.......SoD.......f.C.d.....drv>...@.......X.%.>....}.z...J....E.....(..$....R..p..x,.9DxE-dG.......6&.....HE..$....X.BC.[q....5y....0.x..,.....>~y.=..Fdm"^h.b....?}...i.........D..(...$4bi$.p. B...$3.N...t.3e....)....b.....W.^....f.......@...j....h.......j.t..w;^......c....KJI......dc.K.7.}g...S..J;...~v. N......t^")..x-..R.t..JUK...&.K.Mu.2&.CV..JnF....FS.#..._'...a.............;a....U..J.2..T g..C.R.i.....S.k.v....f.x...y..5]..^.T=T:...5~. Y.C.b=...<..7(n.'dz&..=hv..1..IT:....lg...v.K.H=.H.`m....OZ....$;o{....f~.F.i.w1o..wD...s..?........]...=+.%.d..0.#.<..Q...rw.}T.l....(.mv.r.....8{.t\@.....J.......n.3....7..V..$Vi{.vL>.....R..:5.....].A[..JM...ST.>..R..ju....W..zW}.9!..u;...S......}S..PK..`..7....d...PK..........lD................META-INF/..PK..............PK..........lD................META-INF/maven/..PK..........

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\is-I6BEL.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Java archive data (JAR)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):914639
                                                                                                                                                                                                    Entropy (8bit):7.99052113322922
                                                                                                                                                                                                    Encrypted:true
                                                                                                                                                                                                    SSDEEP:12288:yl9FVbkvc1E3s88cSS+aBjZ+bfKlaVx9q7DAgTa64wmVuQaarjaUI/cc/p:oHb6cybjBcjK8T9q7DusQfrj1c/p
                                                                                                                                                                                                    MD5:A1E20E48A367063023DB9137CEB7C63C
                                                                                                                                                                                                    SHA1:9B3A11C613EC3FD3440AF4103B12C3DE82D38B6E
                                                                                                                                                                                                    SHA-256:DAC270B6441CE24D93A96DDB6E8F93D8DF099192738799A6F6FCFC2B2416CA19
                                                                                                                                                                                                    SHA-512:D59D542518FA3E9AEA162531C2836ABF2374430E962771F9B051C6F7CD2CE19438841A5787CE47E15E24759C6321F823ED06131E556E5660963A728ECEE8123D
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK.........b.B................META-INF/....PK.........b.B...4............META-INF/MANIFEST.MF...r.0.....;h..X.'......H.d2M&...D.-....O.+....n....~:...k".339~b.p).h...`!*+.E.+C..//.Q.,5#9K...........xt......E....J........5../Sb..Q..f+.7A.;..........9<K..y.2Oy"yb".z.n....X*.}......e3......f.......So.[.#.p...2c..lq".....=..."I.^B./RC.o..V..q....Ww$cVL.+..P.U...7..D......F....^.....w.k.5KV{F....;.....6......+.R..........S..|..J...........\{..8.&c.k). XD.d=...../....n...k....)-..J=.........D..<.u..S..X.C.0.Y..8sPT(.E~c.+.k,.*..#.8..5W.5slkm(..Ay..\.&.p.a9..X..O...hI.Mj<.H..+U5...TI ..@E..G...!....\l.f....qEQ3.w...(.,......u2T.Duq.......OT+.^.@..m.u..r8q...zg..j$......Z.N...*....._w.!......b.0.yweM....4Xa..;..N..zN../Z...ae...Pi...n..vOv....0a..PK........:S.B................com/PK........:S.B................com/sun/PK........;S.B................com/sun/jna/PK........;S.B................com/sun/jna/ptr/PK........;S.B................com/sun/jna/win32/PK.........b.B

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\is-ID6CC.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v1.0 to extract, compression method=store
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):14867
                                                                                                                                                                                                    Entropy (8bit):7.303064978164189
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:192:Qq+T+P1Lq30PybEJmTROkz+MToaSA4/qvRvQGUwf0JbBUn2zoG4iCiNxx6MZv:kTEaRlMH1hBUn25AiNxxV
                                                                                                                                                                                                    MD5:5772DC62EF11F77CE60F26F9D325ED6D
                                                                                                                                                                                                    SHA1:038E954F6C768B3F097B169EC6C937327C179A4A
                                                                                                                                                                                                    SHA-256:0C699A71D20D6D4180B93B7443EAD7D37B057C92DAE8946738DF36BEB037953B
                                                                                                                                                                                                    SHA-512:87FDF1EBE7BA20EE54A687AB54C97CF0EFE8D546527F09A7649EC6DAB78ECDB074CAB114D3DB2CF392CFB1A43DE2BCB247B080B033B6D86EE063CE189B6CFF6F
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK........1l-D................META-INF/PK........0l-D........Z.......META-INF/MANIFEST.MF}RM..0..G...z..4e.n...-Z.%P..^+.~mL.;..~.{^....{..y3.f^.....X'.NIB.a..\..5.........TL).4.*...A.Y........;........|..w.B"....t..,...~U.y:..0X.R.hqI.Ovd..a.......QB..M&.Z...WVb 7..J.$G,T]f.0G.)....--0...x@H.$gG.c%kU..E^@.cS..2..Kc...Q.3+./..t...7....k..:i=...9..!w.........N.d...s......+......+...^1.v.....j.6....*...j..}\g.d...3....V..oE.A....mH..z...C..Xn1..T..h....9n*.sSVR.Lj%5....g...[.........aB.......h.lpi....[.7>.N.MPT........q...kG~..A...PK........0l-D................org/PK........0l-D................org/aopalliance/PK........0l-D................org/aopalliance/aop/PK........0l-D................org/aopalliance/intercept/PK........0l-D................org/aopalliance/instrument/PK........0l-D................org/aopalliance/reflect/PK........0l-D.c.wG.......)...org/aopalliance/aop/AspectException.class.T.R.P..N.M.RAn"*..Z.zAQ@......:...L..I'M...........|(..4...3..s.g.o..........

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\is-INTN1.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v1.0 to extract, compression method=deflate
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):631768
                                                                                                                                                                                                    Entropy (8bit):7.884078646028978
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:12288:4XrM7JMcT9JDzr/f9fEzZqv6UYKCDJrHEq:f7a4DP9fEzoUJkq
                                                                                                                                                                                                    MD5:E9DAFB4D999CCE8435949859932CE7DE
                                                                                                                                                                                                    SHA1:01CB1FE35B23C7D6946CA8D1897698845D84B18E
                                                                                                                                                                                                    SHA-256:33A6AE266BFB3703B82BA7D155612C955AF92948990D839DB70605D2CAE8906E
                                                                                                                                                                                                    SHA-512:3C89D654867BF48C8E6CEB2EDB5B8DC5EE9F167EF31E55E7836692F92CBA45342FC1F96FB9854498958C3A5062110647C10995695DBB373266CD6445A75B5453
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK........<.kE................META-INF/..PK........<.kE8k.*t...........META-INF/MANIFEST.MF.M..LK-...K-*...R0.3..r.JM,IM.u........+h..%&.*8.....%...k.ry......tC2KrR.....2..u.S.0T.m2.3.34..r.qu.v......PK........;.kE................org/..PK........<.kE................org/springframework/..PK........;.kE................org/springframework/http/..PK........;.kEa..@....S...0...org/springframework/http/HttpStatus$Series.class.VmS.U.~..d.......--.B....Z..i.....4b.KX..e..M...#..../:..2...eFg......MJ.....9..s.s^.....O....'......../c&.+.e2.w.D..........L.S.>.l... .4.....:..c...D..W...c.=.....e...i.Ss...ymnv2-..M.2....8....b..t..'.....W]c....>H.y.fb....^.........d2..S..Y.I..2.$. .dZK...Oe2s...Tf1.y&...v......].L/.t.......(.v".wFS)YX!..i.1gK..;o,.#..s........H..O.......KS..3.E....Ar.u.C...,.......\.....[.(.Z..;..e.....4..v.(C..0H..F..C....?L.....M....Y..}*P.e,gW.D)S..j.rJ.cg.;..q....)......u.U...b........U.!.b.k*b.S1.A.k...l....../m....,gnzV...8>.wJ..b.......:7./.F..\..F9

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\is-ITUH8.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v1.0 to extract, compression method=deflate
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):128645
                                                                                                                                                                                                    Entropy (8bit):7.898525132436497
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:8huClo5mgiMo0neO8tXRGBxaSZhRoXR+e3yijs:8huSgiMo0e/exa7XVyio
                                                                                                                                                                                                    MD5:A396DBFAC39E458225803F946F7537EA
                                                                                                                                                                                                    SHA1:9EC51A7DD751F4049D28C91E4E65326060922F6C
                                                                                                                                                                                                    SHA-256:A531BED14D5501F99C0DDD5FD4DE07C095F8F24A9AE652E949BA2215AB6709E5
                                                                                                                                                                                                    SHA-512:CB8D54EB5257CDCFC1BE289D06E9773EA237C96EE8B07659F22D1815E3EE62CF01CB10CDC1E244FFCB4381778B2C8AD9CA476ED72269B5B759B0B71C9CBD2CCF
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK........2.kE................META-INF/..PK........2.kEEj..............META-INF/MANIFEST.MF.M..LK-...K-*...R0.3..r.JM,IM.u........+h..%&.*8.....%...k.ry......tC2KrR.....2..u...JR+Jt.K..ZJ0T.m5.3.34..r.qu.v......PK........2.kE................org/..PK........2.kE................org/springframework/..PK........2.kE................org/springframework/cache/..PK........2.kE............"...org/springframework/cache/ehcache/..PK........2.kE}..gq....#..:...org/springframework/cache/ehcache/EhCacheFactoryBean.class.Xy|..../.d6....B8...I`.p......@d...c.;I.vw.......j/AE..ZE-..&....b....Cm........fg7...L._...7..}.....{.<....`.....d2..p2....LNe..7^.__.G.4.=.....<...&_c.u&g.<...L.b.4.o2...g..m.|...g.<..y&............^..E'...x.........'...W..x...?._../.WL~-.....o..7.[^.;...<..&.d.'..3...g.*........M........?....V........mf{G@p.A.1..0....0W@A@..y....b...$M.i.?..WR.RgPF....A..[.".[.h.G.H....WC!5...........D?O.JaI....5O..#.....iZ.....B.Uq...W..%..iQ..%!..9(....[...KRy...f.

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\is-IUDB3.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Java archive data (JAR)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):788046
                                                                                                                                                                                                    Entropy (8bit):7.786417691497363
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:12288:/4GnZF04sK8CzwT1L1OqBdKSQtbKOgBzFU0M0AylRtVdZovkJcslL0:/jn/01CkRhK+9Bze0MD0Rt/ZpcslL0
                                                                                                                                                                                                    MD5:F318F3A9A707966A92FAE3389436B7F9
                                                                                                                                                                                                    SHA1:EFE8ACD5C71A67CF46FB7D23685F8939BCFE15C9
                                                                                                                                                                                                    SHA-256:9E9FF0266D17721AB12FAF601C4581D304CD92014EDB76E0ECE94F61C50207AA
                                                                                                                                                                                                    SHA-512:39DC6FBC85D5E3A725B6015EFC6FD0438D0BF5571B7FA69059C85737674D09E9FC8E5D6707FEC01B220B4AE4C6905859F4C5C0C2EB919F00601A071A73C60B76
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK.........,8................META-INF/....PK.........,8................META-INF/MANIFEST.MFe.=..0.E.@...u..k.V.B.........6.I....C..{..B.]...D.kk..1.,5#.6R=.z.k\q.9..nb.....K<..h..Ck...Y..@...(.rVHmDVI.....V.W.?O..p..ME5. C..Q......6?.v.YG.....c.8..PK.........,8................org/PK.........,8................org/quickfixj/PK.........,8................org/quickfixj/jmx/PK.........,8................org/quickfixj/jmx/mbean/PK.........,8............"...org/quickfixj/jmx/mbean/connector/PK.........,8............ ...org/quickfixj/jmx/mbean/session/PK.........,8................org/quickfixj/jmx/openmbean/PK.........,8................quickfix/PK........Q.,8................quickfix/codegen/PK.........,8................quickfix/field/PK.........,8................quickfix/field/converter/PK.........,8................quickfix/mina/PK.........,8................quickfix/mina/acceptor/PK.........,8................quickfix/mina/initiator/PK.........,8................quickfix/mina/

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\is-JGSV9.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Java archive data (JAR)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):16141
                                                                                                                                                                                                    Entropy (8bit):7.908028090301315
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:sFq3xRqXW9ve1fME4Ck7BaGDUPDgSHqh35i49YB1sRQWD:crm9mf4ZpGzHqhXeBiRN
                                                                                                                                                                                                    MD5:35315811FC55E7C4DEE2FFCD3F2A430B
                                                                                                                                                                                                    SHA1:336F0063C646CD059B6A7E4EA1D2960C3D8E9D4B
                                                                                                                                                                                                    SHA-256:F8605F22655A41C0FF832DAD9311FF23074AF82F6F5FF323AB35E8CD73159166
                                                                                                                                                                                                    SHA-512:810EEFD8CCA23BEC075D33C91D700F8BF4B3CFBD5194368ECE700A0C8120652D41CD8CFE1C2F431AE60461D616FB463F08788BFC6239D669D615145737DA655A
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK........P..:................META-INF/MANIFEST.MF....}.MW.0..........|....E@A..{.x.4.@..$.._.S.J...y.}f..v.(^"...$$f.eT.r....G..R............L}`..|....$.1....X .......`4@T..n.k.B.>..G@.z9..~.f..^R...V|...#...L....s.,.W7...'H..n....IU............q?.j.....je.X........2..n...i....dL.......&.X......G.#..Gj.jX.p.....H..0..._..*..r.h.g%sa_....9G.....~.Gz..0..*=.OAs2..BA....t.IHP@n..L..H_...7...B.9g..G.Pp............tQ....}.......}.{c.X......}mk....a....~.l>u..L.eP.o?Qc.m.'...a.<......~..P...u..7o..Qg.........P`.|.'.. JA4..k.d.z..S.!.<...n.}.........W......r1^.......X+...;D....J.......mm.^.M{....D.9....<.ll.q..pP.7..b.....+...H..PK.....kf.......PK........P..:................META-INF/ECLIPSEF.SFm.Ms.0...3......U.......XP.jK7N...0...}iW.qw6.y.sB.2$.....5).D..m8..@....Z.>b$.T.......&..I.o.x3E.....c$.^..o.T4...}..U.....p7.&.!8.5..]P.fg.*..........N.u.4..Q.'....&..Z...m...w.eL.k.Wg...T.k."#Y\...$...+ ....cJ..+.%=(..h.......>.$.aph!..o .Ud..u.I.}

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\is-JNHSE.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Java archive data (JAR)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):481535
                                                                                                                                                                                                    Entropy (8bit):7.892871329463679
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:12288:bvmaYhW47H/IPPlWHzPor26I7xSjjJApPdst:bv+hW47fIgEU1st
                                                                                                                                                                                                    MD5:363678F015902BCC040308136F845A3F
                                                                                                                                                                                                    SHA1:7999A63BFCCBC7C247A9AEA10D83D4272BD492C6
                                                                                                                                                                                                    SHA-256:7AE3FDDE7AB0CAE4735A2AEC04381AD9B6E25C93D24205F3ED315D9866F12FE1
                                                                                                                                                                                                    SHA-512:04E6A76176FF0A84AE12516B301ED5C88F33184B2175BF8A65F65A2CDBB41FB5874FFC41E5E6624BA9D4E6C97D62A2B8E9026EDC7CBB3027C46025965C087CBA
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK........1.~<................META-INF/MANIFEST.MF.......o.0......<.Iam5.>.]'u..Z..N&1.il#.@....'.|8d.......|_K..(=~#RQ........t+..?....d...#...;A...l.'.f.....u....^a..t..{."....A|'..|.6L.rR.......rM$..}v..(...E\.#......:.Q.9....G.`H.8..&b...3.E...._...:.....tb..".|Mc....|........M..k.Z.#*h.......0..TuB6.m.Z.-..F..p:#..G...g.,...^..../...%.........gj......._./...S.t..n.6.%.s.q...3..U..a.....p..l....+U.-.V.(.EZ..8...k....=...bg...8=.....M...s.;..._..............(!.'.`.|.8..>.$X.(..%....o..d.S^"....,M_.Z..$...z....h.3.0.......N./'..er.s..^...).@3.......2.f..|...i..NT(.Vg...CJ....Wp.w.....p8.!..N..V........x...>."...........0gNN.|.d+.d..<..Yu..T.)..I.Hv.}nEv/...2....^..3[6f...~.].f9h..Ns..f.....p.v..B.C......Z...y...>...NK.W.9...&ig@r.$]8.>..U.Y\...r.a.D.HY.....E.....V.....qL..m.W..M.u.8GE.O....p0..bn...:..9k.e....o|.JuR..Ub.w....PK....H.7...r...PK........1.~<................META-INF/..PK..............PK.........~<................META-INF/LICENSE.Z[.

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\is-JVJAH.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Java archive data (JAR)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):1058001
                                                                                                                                                                                                    Entropy (8bit):7.8741160125377165
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:24576:4MOQBbn2oyP7dzFIzBnRA2Ftmks5ErULTpM+zp+lmG:PlByb7P6rFeEWMMp+lmG
                                                                                                                                                                                                    MD5:76A903C2538EADED77650967D556FB0B
                                                                                                                                                                                                    SHA1:20FEE24BA2EEB55C2A71ED662239923191F237CA
                                                                                                                                                                                                    SHA-256:0A9CAEEFE6EA695BCD77B78FAD5560393A7FE43A8D5B809D02767C12BFFC1089
                                                                                                                                                                                                    SHA-512:F4F54F175FD30E32FC52EB2CE7E40AA70EDD42E1E66BA281E518AB70D69BF8A2F3692D96CA023D8C9D266E48BFEC58B63D8AA5CC4F39275A8C64E317E58180C7
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK..........:................META-INF/MANIFEST.MF......W...6z?...&&...f. @../..o.p..\..{....T....!z...U..Tf.\.Y.....[7.P.....c.7...............S$..f?...+.z.n..Ae...........,.F.. ...%@..?{{....O.o..'.}4S...#...];....;.L............].....\.?.......................&..o..6.....u."......;......9..........||.,...gcO.?....?V....j6y5....Y.V......o.........!.vl.c.._.?..[....G......z.o.0s......9o.......~{.o/.R.i.?..W....e.Av~_...{...$......|~^.&.Y.a.}[......?....u.......B.>........m.w.W..fv.c....y.......?^.o..=....ON.[.6#C..u;6.p...?'.y..\....I.._.u...V.u.V.O.k.d..........x.o.1.]...Jw.........?z..1..g..f..^.;....\A..._|.Z"..`6........_...y...H.......yW...M...z(...k........Ed^...>..Y....~..W...!+o?.`.o'O.^.....Em.?.:|X..S.......~.t.c...e.>...\~`...|.`.C.I.k... ..o2.-.A......RV.........V|....ba..L..)?..zw.Q.......o.....E.-...[nvU.0A.`....8S.......}...}...(....Y._....8.+.e.......|.T..?..o?.......|.5i..4....^..z.R.09..d......~.]...<.....8S.r}.

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\is-KGUU0.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v1.0 to extract, compression method=deflate
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):613679
                                                                                                                                                                                                    Entropy (8bit):7.910040172253245
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:12288:qKfbWQ57+JcsxLzBtKhH4yN0yDd3qydKY1q1cWZM2cihF:qKZh+J8hH4mqydKYYrZp
                                                                                                                                                                                                    MD5:3EEB562E2D6CF906F5AC1674BBBF1595
                                                                                                                                                                                                    SHA1:A1D13F4C8909986E1D40B81CD3BC8EF19A856616
                                                                                                                                                                                                    SHA-256:C79C3F5F5F62BFBC6A8637293DFFD3C7AF932755A2916393C232648492F01E2F
                                                                                                                                                                                                    SHA-512:4EB8E29569CA8242F4148AEBFFA5FE7972CD84D529514ED918A2E46FE0046F2EF31E67A038B628F0DB99550CBFD49703730A89D8057AB968F41823D682181785
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK..........kE................META-INF/..PK..........kE...v...........META-INF/MANIFEST.MF.M..LK-...K-*...R0.3..r.JM,IM.u........+h..%&.*8.....%...k.ry......tC2KrR.....2..u.R..1...2.3.34..r.qu.v......PK..........kE................org/..PK..........kE................org/springframework/..PK..........kE................org/springframework/beans/..PK..........kE..L.S.......3...org/springframework/beans/SimpleTypeConverter.class.QMO.1.}.te]...?.. ..../...1bH<.(X.....<..&....q... .6y...{.~~.}.(c..5.)......M.......X..4'...Q.!VS....KW\....7..J.....Z....3w.g(..|OK...| ..~(..w.RC.<..y....F....P.n.s...f.....;XB...W..9.}..F....Ml9.....u=....6..S.0T.s......YG...EO.F...Jhz..z.Cy.....Y=...<..T.......h...6e..Q.d..`.wDn).>#Vx....D.L..6`.p.I. .C8Tq&d.`u,..3..PK..........kE(.........../...org/springframework/beans/PropertyMatches.class.W.W...~fwvgXF...b].+...bC[5Z.LI.5 F1.awXF.....i.A>l.4m...4..6=.'9m..s..=....?......m.{ga.0..0s.{..>..s.;....z..n.....h8+.f..b...l.9XB6).y.S1.`B.

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\is-KH5QH.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v1.0 to extract, compression method=store
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):26366
                                                                                                                                                                                                    Entropy (8bit):7.842351935385798
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:768:/y9sH2UybW4C0kHr0PneJElcriWIC6I6iHW:/UsWDbrAr0PnEEl0nICy
                                                                                                                                                                                                    MD5:75FE320D2B3763BD6883AE1EDE35E987
                                                                                                                                                                                                    SHA1:479C1E06DB31C432330183F5CAE684163F186146
                                                                                                                                                                                                    SHA-256:5909B396CA3A2BE10D0EEA32C74EF78D816E1B4EAD21DE1D78DE1F890D033E04
                                                                                                                                                                                                    SHA-512:2453330B27A0822BBA440C28B98AE1D83D60D97DFA2D040562DD5126B3548E0CAA040FEA3B886AC6FEB0A858E6C1BC45B6C5472B180F1F14792E5CA33E355959
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK.........B................META-INF/PK.........BvJ.Y............META-INF/MANIFEST.MF.Qo.0...-.?X}j.....T}(.UTaCk.../..3.A..gS..E.....s.....i9...`.4. =.a.iU..)./l....lE...3.d..W..I..'....o....?......U.....8.-.h.H... .TL...j.r&.N.....j.W@..(..F.....H2....".i. .....v:.hh.y..7{.f?.>9....u..p..s..[.YU5Z.uG...&cQ.c.t.[f....cT"../.....d.O... X..//......y.ZM...Z.K..]..vE...P.K.)R.>.F.eZ7.J.t8....%]..T.6.......{.89.@..hw.b......\.........Y..ox...........Z......B....R...;..1..|!.,{.S...].#.~.PK.........B................javax/PK.........B................javax/annotation/PK.........B................javax/annotation/security/PK.........B................javax/annotation/sql/PK.........B........... ...javax/annotation/Generated.class.RMO.@..U...........I.zZJAb.M)$..Y.JJJk.._....G.gc".4..7....Lv.......PQ.L......K.E..a.z....=.O.=....@b..........@0..~.?...............^...o...d...!.Nn........p.._...rm .m...Io>.......d`...?.3.\......T.@9^a.p.........

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\is-KP84B.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v1.0 to extract, compression method=store
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):171588
                                                                                                                                                                                                    Entropy (8bit):7.9341974275058975
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:D/lT96OmfA5wMLgXaYgFWBQwVhDWI48eKKRx+dWehTkkOWlV/4:D/lmfIw26ldGyhDj48eKKRYdfgkJ/4
                                                                                                                                                                                                    MD5:5E2019A1B747202CB93F63164339C802
                                                                                                                                                                                                    SHA1:58242E53D1FDE189E2957E7BD107FECD42FB875A
                                                                                                                                                                                                    SHA-256:F13448A2FBB10AB0D6E4189195CE357DB5F2C9E0A03D8FA2CF1BAE296E1CE74B
                                                                                                                                                                                                    SHA-512:8CE5307ACB2D8A90929B01B80F06FBF13FA6652600380E53611F04B9907701B060C1D306088D8905BE67C6E08ECD71FD83363167446E054C4BBB87BE0C912ECF
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK........`l-D................META-INF/PK........]l-De..A...........META-INF/MANIFEST.MF.SMs.0..{....S,0I.0.!@.i.Z.is.....Y.H.1..+...ms......J>.c...+...i...2S....t.q.....,.-...-. ....U...0q..p.A..s.$....../..[...`.+Z.p..f.Wuh.k.b.g.."-..^?...m.8..........L.D..<.\&..o4.a.A...H1.z0.9..........?..j!.I?d.-!...d...&"_py.~..(...5eX.(....\.I.......9mv.x..w..3.=..U......;w..v.s...x...*..4..4........#.J.&-..L.hT[p...@C*I.F...g..p8..8.M.iD..)...C...8.1....I.U..V...D....!.TJ..B5..y0.8..z.).*TeT.N%..b8.dgX.._F.cu&.[..\.A..'.].S._.Q....\......*...@...`u.G..4]..W3g..f............v...:.#L...}.?..y....g..o....V.V...>....fC....g.......1M........?PK........Xl-D................org/PK........Xl-D................org/jvnet/PK........Yl-D................org/jvnet/hk2/PK........Yl-D................org/jvnet/hk2/internal/PK........Yl-D................org/jvnet/hk2/external/PK........Yl-D............!...org/jvnet/hk2/external/generator/PK........Xl-D................META-INF/services

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\is-L55E3.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v1.0 to extract, compression method=store
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):86066
                                                                                                                                                                                                    Entropy (8bit):7.902460080040838
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:1536:CvEKwxhuIxcyvc0GfUGQiGQBL1LmwlgzHyzZLQwJ9x9GjnBGRc2HeX78IfjRu6ym:CvEKwx4IbvcXUGQiGGBLmwlqWZLXBGjJ
                                                                                                                                                                                                    MD5:A9B7A43A507277DB0544EE8C8A1AE521
                                                                                                                                                                                                    SHA1:48A6483960ECEDEC05CCCEFB17B95FACEF98C1DA
                                                                                                                                                                                                    SHA-256:E3717DA5E934D08CD11990217E25AF32948100E2346167AE7AE831DBD897EACF
                                                                                                                                                                                                    SHA-512:B8F14C1EC1C1AC7F4D00BA9F478C2E552F9AEFC99E5ABB56A7E9270F7C46D2876799044F4F59F9D14112E42499C913A79536984993D0A36E0BEBDE8DB1A80BD1
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK.........'M................META-INF/PK.........'M................META-INF/MANIFEST.MFm..j.!........-..%=.t....b.i.Uw..M...f[..A...........+...l.R-8.!B...iH...b...q.............Bi.d.'z......*.S.j..f....l...F...y...>.Vj."...EpWz=..h......T._.(.q.F.C@?.+r.sQ..|M..tq&~..K......9.i..{..g.PK...P).....T...PK.........'M................com/PK.........'M................com/twelvemonkeys/PK.........'M................com/twelvemonkeys/image/PK.........'M............(...com/twelvemonkeys/image/GrayFilter.classmSMO.Q.=.3.).`..".E...jh.G.#j..*D..a.P.(L.f(.4"n....51nL$$.\....._a=oZ%1.$..w....2..../..!.F.Nu .~....j...f4.4yJ.i.g......%...e.qA 8Vq+..L..<.P.Ef..*.=.Q]..Yk.!.....@.L.*.MZO|..2U*.T.R...t.6e.F.+<S...v."E.E.....FW.M...D.....#..tJ..0T.U....l...fo.g+Uk...K.$.H.j..9....O..l......[..S.&i..9......_v.#..U....M......#..z.@F9..1..~$/.#.@#^c.E.^a}.]..J..W(|...(...o.E.S.Wo....C$eH..O...R..5.I..}Y.N-....s.|..g...PD?...]..$.`.....x....M......c2s....,Rtt........I...g..'...k.

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\is-M0ELP.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):18136
                                                                                                                                                                                                    Entropy (8bit):7.824179157484512
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:rK3M89MrgQl9OiKYbWWlCWiFRApPZ8MSuBaKYFjeydt8qWH4TUJ0nx353rzJDRt+:+QNbkR/oLOew8POn7Nby
                                                                                                                                                                                                    MD5:ED71B8A4C3EEDCD52038F2A8370057CB
                                                                                                                                                                                                    SHA1:202BEBE1F47D6FDACA439FA5806313888D1D04A9
                                                                                                                                                                                                    SHA-256:2B11118807E710E65412E0D3D1309D83209256A3838AE618A6FF6F5CD1F64422
                                                                                                                                                                                                    SHA-512:923E5D05CBA756E1C9243369F776AACA2B0E8505E9AFEE6E57726D60F33E68BBF72F46883B89728386DC382F28EBB3986BD2131C9675F63FB9B4069EBA7942C3
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK.........y.B................com/pretty_tools/PK.........y.B................com/pretty_tools/dde/PK.........y.B................com/pretty_tools/dde/client/PK.........x.B....Y.......9...com/pretty_tools/dde/client/DDEClientConversation$1.class.UmO.W.~..2.0.]^.k...u@.k.j]..........uw`.Cff....K...lS...&5....1.;.(qI.M.s..9...o_..0..m8.S-.tt...C......F..J......:.qM.T.u._i...&!.p..tb.!&&JE..2^..9.En .p.)gcC.@...E.a.....F(..... .#.R....X.P.@6D.1~ o..MOz.-.........bP..N.b..."..g.gI..\._tBO.i./...>G..}'..K...~n.#H.u.k^...(..J.;.\......h..z.U..X.#..B-.~V......q...F...KF..z.IOEw......g.$]?.<Y-...T4|m....d.m.....Q......w1@.n."&4..L.)..0m.[...10.4G.....%t..7.....|/..K.U.C.sf.{.HR>.A?...[..x~.h..rx-..`.?..".g5...4{.$..{....*W..&.N49...../-..J..f....g.`>.YB..1.dzK.7N.g.....b~_.....z;;1....2..x...4..O..~.h..R..0.^.i.._.z.....H!..`>...<GK.O..%.O...52..$.........g...A.I.l...h.i...m.K.#<.i......,...|g..E./...7.m.mO~....|......._..<K..r .0....n.......Y.J"..d...

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\is-M40N5.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v1.0 to extract, compression method=deflate
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):50242
                                                                                                                                                                                                    Entropy (8bit):7.942977620125212
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:768:ZdMPyMnpalnGd27bjuGEfrDYWMOGxUtTZj5hTIgwzx8Opq5sPqC4gsPxdLmKEyYr:ZdMa2alGpDBMktt51Ifzx9odLBVYmN4H
                                                                                                                                                                                                    MD5:70D32F37864D71B43F85D2B81067435C
                                                                                                                                                                                                    SHA1:689941E2658C888E529A52F77268868F4282518C
                                                                                                                                                                                                    SHA-256:81AD18A0B9CC5856C1CAD3DE01742AA75F2F86E3C0FD89B0385360EA9A0D90D1
                                                                                                                                                                                                    SHA-512:A2031ED1708D70CB1E339315DC380D5F4DD7F83FD4FBF5AFCD7480F70334CBAB122F9EEFDC26517CD447083C89C27A6C5D9DA009DEA67B6899B84953AE8E450D
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK........<N4J.MV.n...'.......META-INF/MANIFEST.MF.T.o.0.~.....a..1I.....`<....[5i....`j..v(..=',.....(...|..w.3.`l...p%...................UY!.,.>.$..>...r.-.S.g<.i !kk..~yy.,g.......=..L...AL.................vQH.u^_.p.>)L{.x+.k..UJ.[.{7.\...\Wom.h.Ft..Q/..R..l0>$d.....,.1c.*.K..J..w.q.z..v.u..u.....k.{H.w.T.V.....C.".....4_.1Z?.f."q...W,.+m... M!,.+..n..fN.a......8N.-5... 3..2...Y/..@jK...`..g.:+...pWI0j.(.r.q.qu.cy.0h.0.D9.qO...q.Z...Q4.U..*..9C..X..<4g. .L....?}.k.9.}.8.`.~.r{..Rf.).p............|...z.@...B.K....b.7.i.....p...u.=..wSuyHP.......dB....f!+...\Y2g;..r.Y....7._..J.6.R......k.Pv.o.......o{[m.`........[.,...{.O.Q.....PK...MV.n...'...PK........<N4J................META-INF/PK........9N4J................org/PK........9N4J................org/eclipse/PK........9N4J................org/eclipse/jetty/PK........<N4J................org/eclipse/jetty/xml/PK........<N4J................META-INF/maven/PK........<N4J............!...META-INF/maven/org.ecl

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\is-M584I.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v1.0 to extract, compression method=store
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):101578
                                                                                                                                                                                                    Entropy (8bit):7.9234613621745495
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:4b6QeGXbWQxmZTC2G7vArRf47Eb1eMVzo2h:xQXWQxmZTC2G7Ytnb1HVzz
                                                                                                                                                                                                    MD5:50738A9E30CCE8F6D63D5A2B63FFFD63
                                                                                                                                                                                                    SHA1:16561CB11C221B5928119E10D7636C95EE5C960D
                                                                                                                                                                                                    SHA-256:631656EB38639B0AE41161F706FF7FBE04313B5B8F42892DA5EC656390031FC6
                                                                                                                                                                                                    SHA-512:1397D4EF89EB30025E24F8DB0DCE6119AF521AE7C0E0454B6EA613894B01E437B4C80C71EAE7F017A2BB9F0868D780333BC74E1AB5F919C9F87FB2AE73BA5D74
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK......../..>................META-INF/PK...........>*..Ph...~.......META-INF/MANIFEST.MF.M..LK-...K-*...R0.3..r,J..,K-B...V..+.$x...R.KRSt.*......3R.|..R.x..J3sJ...U.I....]..l..fz..F&.\.\.PK........&..>................org/PK........&..>................org/ini4j/PK........&..>................org/ini4j/spi/PK........&..>8V.......$......org/ini4j/Config.class.X.x\U.>'M2o&/.L.6ii.i...RZ.N'.&....$%E....t.df...APAv...".".*`i.....P@..P\X.jQA..T.s.{....S.|....s.=.].<.....b...p..s.m.......X..+.w...7....X.>k......_...5......k...X.1k.G..k.5y....|...J....J...`..$,.5.,a..%..JX..v.....\...+%...Z...gIX.D.$.-....c..J8.....$./a....`...p!....F6.d.fl.a+....1.b.O..$.........\j.S.l....}....3..=[.[..`t..J...+..].h2........`......}............s.4.L......3..p..g..AV..=......*..np..\N.....0.kk....wsk.x.`......]~.t.;....{....1)]...s9....4..7.t{.n...Ez}N.U....$Q.I...(N...>.`..Pf...=....vt{.gL2.f.Z.\..^....r;;X42...w..\...g.....q.....O[.x@.\if.H^M.#..,..df2..,.U.i.\6.2.).5F.......l

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\is-MAH7F.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v1.0 to extract, compression method=deflate
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):36145
                                                                                                                                                                                                    Entropy (8bit):7.837112308649389
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:768:856da1kcDKbHUltjxTgiZRt/B5FSiq4q0frElma6aSaJuTTAwIlK:1da1klb0XjxTgiZD55FSz0QlnSaJuTkC
                                                                                                                                                                                                    MD5:2A9B4C10AA92EA650B8DF3CEA990BEF5
                                                                                                                                                                                                    SHA1:D44BF488435FD0D0355FBBFB63592188922F3907
                                                                                                                                                                                                    SHA-256:602A1B57FC53F301D3533D0A5A3FE29325F23974ADD955C88616154649A52A51
                                                                                                                                                                                                    SHA-512:F3EE1F2ED54BDE6F7E1A49B02161657F7374438B44C24B5BD9F00AC56C9830AEADE20F032CEDADEEDB5CC9323F206A9697E50FCC541333D6B82C41EB0068E856
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK.........Q4J\.i.@...3.......META-INF/MANIFEST.MF.W]o.8.}G.?Dh5*.1.........V...yX..-.5q.6....8....Q..{...........v..TL.....[...w.B....\.$.v....Mh8."...k..._..n.x..m....9K..7........B...d.....g.._....}...........@.W....g.r..P...{...WP....#wB.....0.0...m.....>....K&!..@..X.q.bR.&..y@...O.9`$..d.9...u.........TH...5..j.5.g.#f.Ltd.s.)...&.R.k...l./.$t.i.FgX"[..<.=X.E..~.....%.[....q,..&.Z..Q.!.t.........q......(..'E..(.a..2...r.<.a.E..fa.A...~|.. ...3.J!z..F..<....@.V..yjA.|h...V.a#O....2.~......r7.\.&.2Js.z. I..n..j...dDT(....f_.dO...3z)."O..I....dB.R....8.."O...(....Y.....l.......Eh.:.>......c..Wp.c..ga...).m6...p.?3.4.L.f......d0l]....O..........3......HP..S4...|R.$P.......y.......m.|.b..8......W.Va..j<.*.8.. .c....?..N-R....?d..r.u4:ya.?..RR-$f3.(.....f...,.....(.A.N.3..4...*...lV..L.......y6.].fe...yv..(..Zs..G.VKOr#OQ3....-.T.Pe..iTA.R.;.$..X..w.w3..y.......]]....r...mF.[...^H.........<T.5...s.@....G..l...B.Ru<.G........

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\is-MAMR9.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Java archive data (JAR)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):46968
                                                                                                                                                                                                    Entropy (8bit):7.595755124084132
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:768:QjCGDsHftDENRY1ZX6sUfHhUimsjayK7ND24wplH+Khu:QT4/yN1P/hUiPU1
                                                                                                                                                                                                    MD5:B82283550745B69DD95E7D835714E971
                                                                                                                                                                                                    SHA1:A0990E2E812AC6639B6CE955C91B13228500476E
                                                                                                                                                                                                    SHA-256:03348C047D981376CC444FC466CD80BDA8D7EB0698DC6A99DD52C5AA15EFF5AD
                                                                                                                                                                                                    SHA-512:F3D8E800CCDC56D805068D6644FA3D4316A933E49CAEDEF0918925330906C9097664DCB8C4150F3726CE37BAE6B5DD459AA2A2CAFBF5CF85BC67CDCB0D21C081
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK........t..F................META-INF/MANIFEST.MF.....SMs.0..3...p.i%d .:..:..L&.Ln.a-F.-........)i}...}o.w.B.%..>.M..>...V......j.@b....^..o<....$.......N..:z......ZF@...V%n.o,...A..R.. ..X..Q....H.....E.V+.h"..d..T:$..E....?.&>Y9...F..*[....8....+oftY3Q.....f..v^.36lDE:mLF...lH..3.ue..`^.].L=.....Bz2o....A...B.r/t.G. ..[8>.6y.-..I9.I.u.?. ........L..4)..1.B.......>..~$.M.. ...D.je.'...<-6e..{.w..%....n>s..*.+.}..;....".H....U..>..LY.}....C#M.*.p.....j.O.C.7.k1.^..x.su........z..0.{...1.O.Kn..n...........B.&NT..&.....>...ij.l..$..PK.....B..../...PK........t..F................META-INF/..PK..............PK........q..F................META-INF/LICENSEM.1O.@.....O.Z.$...B...2...8....N#.=G)...?..C2D.. .v.O&....Q%..((gq.$.P...9...r...8<......gR^a.[Z..je.O.#..R....*4...+.....@G..m2.t.~....n..P{...1u)..(..m.}9..B.EOV..!.>.X.....w..oB...M]..\.U.........>....PK..e.'....=...PK........t..F................META-INF/maven/..PK..............PK........t..F.

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\is-MGQRU.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v1.0 to extract, compression method=deflate
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):31717
                                                                                                                                                                                                    Entropy (8bit):7.860930120098471
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:768:r+76ABMwuqh6+X9NC9+P6OFZqoVwTNMLeStL:rLA5Zzi+3VqNMLeI
                                                                                                                                                                                                    MD5:0CC5AA8C66C693EBABBCF934A248232E
                                                                                                                                                                                                    SHA1:8858E4D6442F73CCF677119BFAEF3F84ECE7E2E7
                                                                                                                                                                                                    SHA-256:4C6B5F04F7FEB0C3D0EC0BA213363938275DBE2B12F4A8FF6BA2BAA646A33F8F
                                                                                                                                                                                                    SHA-512:820BD1284E6052C3C058F0F15C3FF3EB94415D6897453822A8375D02A73C4EB153F9EF0C8A6F2337719B1A02A4CAF3E6262E680855125E2A3E8BB9850D43B22E
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK........IQ4J....H...p.......META-INF/MANIFEST.MF.WQo.0.~G.?X<L 5&.]....2.:A..{...&.\L...........lB ..>..;.wLX f\..GZ..%.....8.%.>s.E"4...n....KNf*.=p].?k.-...C)x`2...x..K..n...l(....TE.L.uw|7..?.....r.....".=.}..+.Cwy(..c.p.f.>nW..`...v.......`....n.J.....gb@/.C.=...^.....k..A.[c..D.b&...]./....3.....&;.3.^....."...{1.?.."R.....5.R.....*.Fb....+i{.........e[0.t,...d.G'c.#...*.... 7y...2.'..*r.(.......,..yK6/d>..z..p....|...N.,q...|.bD..{'.A?<X....2....c<h.).5.Bs.).6H...Z.R....../....8..YD..5N....pj.8...._...xj..'....8.....pj...^.z..a..J.'N.8e..QXOS.8% Y:N.a..U.].`...hO..h...N}.!..g!..mWz...g .<roZ.....T.;.7@.....<..........(.G{...y...h-..+U.f.+h....[k.7.p?.I...J&.RHR.&S..i.1z=%..BBY.:.G4.qL..x'..E..ud.P\..Tq1..e....ON.N..u.).j...fQ*..t.M..S.}?..8..T[....s....L..3...%..9.H*....U.~.........~.V6...o...l.M.M...Y.88V....}..?.}j.r...h6..PK......H...p...PK........IQ4J................META-INF/PK........DQ4J................org/PK........DQ4J.......

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\is-MMS5Q.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v1.0 to extract, compression method=deflate
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):91036
                                                                                                                                                                                                    Entropy (8bit):7.904373333079498
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:1536:hDrGCAQgcH5h1nbXGoo9lnZ8EtbC8OlFdiyNTpmQyD+sL:hu1Qx5nn5eZ8gG/iy9eL
                                                                                                                                                                                                    MD5:BA329876B118A3D3B473176A3BA5AC23
                                                                                                                                                                                                    SHA1:677AA94298F42D322E2F19045693A233613537B6
                                                                                                                                                                                                    SHA-256:39925C822FAAC60E7239BD0C283737B2E65657931151358D4A18F643B3E16C16
                                                                                                                                                                                                    SHA-512:868A274AFB60F2A4BA3EE445179E77F4C5B32A4D2AFBEAF99441A2EDC71198B61AE62A7DF0607298534479A2766728334E3A49B722BBE6B0520D070213F22C42
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK........tN4J..1.............META-INF/MANIFEST.MF.VMo.0..#..,.+*......z..ZA.....a.&...8k;....'...B.@(3.<.f.9C..1h..\...[..q$...:T<1....Y...R.d,..A..g.S......b..........;e...@...En...}....w|.|.5B!.<...F2L....D8...4).|^._%.>.9...E..&Iu...<.`...jS.5...]..w.z~F...[.d.Z.>.#g.....9DH.E....n.....W...~az..)W..?0.{~?^p%c........h....d..d.../i.g.w.c.%C...cKt.u*..'d.%...,..f....`.'.$gD../.GR...{.z=Rr...X.c........a...Z.07.......^bk...h..P......pR....qZ.=........tD.'...Ee!..f.].!..8;5..Q.|.`..y..2....@.).....+..|pl..J..4.8.1...D..c..T.gy..R.e.B8-S...;Z.....gp..l.t6.z.)..[.Z...Z....P..S..1.......\=.........N{..5.%%.X.:..~P*:..z..e...,..!N....O...3!.NO.3.e..=.s2d..I..d$Rt......P.6..3..7).%.`.C6.i....A...3 ..r......q......9.)...*.u..8.....V.i....J.r....k..H~!W.)|v..7.`Z'.L.{..:.......t....z.^..PK....1.........PK........tN4J................META-INF/PK........pN4J................org/PK........pN4J................org/eclipse/PK........pN4J................org/ecli

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\is-MRHQ1.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v1.0 to extract, compression method=deflate
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):406830
                                                                                                                                                                                                    Entropy (8bit):7.923672372299203
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:6144:tackqLNEt/CJceogqUvb/Wuhi5WHdDHC//y1mc+eAJF+kKvAKAfZdE29Bl:taczNEt/R0P7WuRVHOy1mciFm9k/9Bl
                                                                                                                                                                                                    MD5:51826DCA625FD028C82F0F239AB0D236
                                                                                                                                                                                                    SHA1:1286983A3AD4549D7F7FD0F3784E747667B44B70
                                                                                                                                                                                                    SHA-256:61468C0429C568BC1DDA98B81DBC6C8B74E6CBFCF76B75ABBA50BE5944A5708E
                                                                                                                                                                                                    SHA-512:A320DCBB18A8980434EE88C92DC00D98D0B8705B6510A3F39A886FCBCE127AC6000A397D3472557D9E0BE263CC4028234F7C6FAB19624AFDCC9AB381171BE61D
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK........*Y.E................META-INF/..PK........*Y.E'..Q....xI......META-INF/MANIFEST.MF.\Ko.6.....0|+...G...{h...t..Y.'ZfbeeI+.q..;C.H..!...Mb...p8.q8.WVd..i/.....z...\..>We.^....._...!i.:+..kv...4<=.Y...eq.=.<u._6....U..._....ow...c../.....I.Y...u.......C...>..<l.Ys!.'{HXQ.-kAT..B^....R...m.:.5C.<.%T4.b...C..I|...L..,..DU...'V.E..s.&.z.....8.`..+.j.H..t.U]>eha..D.....C...,..70.e...Q..8.QBND.......Q:X........?...<W..P.5... O..-.Fy..f.(4.....".p....>.... ....Wh....;;.P..S;.4...w.59x..;B.......P.Tm.T.i...W/...........<."./%....#{b.I.3?.....H.kYS..'Y..v....x........5......^...Z...8..%.a...q.,.y.....S.1...)-.k.l...|.t.|.N....xN.....>..H.(x.d..o.........y..q.[.g.2.t..1.1"{...T...Y....V...g.\...d..D.....OH.d..Rhg...i..........U...v..v.. /[9.B>.t?..ar.[b"..S.......m=..cv...........A...fyr`m..n<B....;9...9. s.A.hW).Y.BC _%.....0z0....0...7M.2..8.!)+^dz.2......S.@...aJ..q.W...5.>...B.4..Z.P.S.J...<.|.;R~...!.4..Qc}#.Ja.....Y...........<Kb....T*....T

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\is-NDD3J.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v1.0 to extract, compression method=deflate
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):110391
                                                                                                                                                                                                    Entropy (8bit):7.940398532595281
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:u8E4bjK2i/vEbOYy8I2v16N40t4ZdfMKANMC:uSK5/vjY22tf/EMC
                                                                                                                                                                                                    MD5:6B9BD77D7052109DA1A0522A202014FA
                                                                                                                                                                                                    SHA1:406A6EDC22311629B41E98AB26901574D243D408
                                                                                                                                                                                                    SHA-256:5740DE237892CF919C3E679FB6818038D9A1C54FAB3AB72295BAF712A5E21503
                                                                                                                                                                                                    SHA-512:07721D8FBDA672C7FA212D059DD5A530C34233191258E53522EF669DA606BC106A1C5DB43A60DF77E88AA0356C367BE6E96FC985D99FD641A203FC310427E76B
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK.........N4J..<N...........META-INF/MANIFEST.MF.V]O.0.}...`.a..q.....`.6.2../{.Lri].8......:IC.M)CU.*9....{.=d)..m.;P..4"..].<O......)^\.1.2.I..<HU=."r.j&.....x:...<.TCD..dQ....DY..1P.F=Q.......m......u.B!.<.%.~...SH..A&.Y..l........i...WE|.?..R]f.:.......w.B.i@g....AX(.............0m.2....Tl.x.$<:.1.NeX)[S......s.I..qn..3.dj.A.....=...d.P|4.._..wI...M...2.-...\.,......I...5...A.$...:..;H.."./.U...@\...z.,~d#.|..."....u~...+.G.ng...,M%.W.a....I.^.gm..i....A0.........OY3.y6Gr..2.S.'.y[...-E.L.,&...KZ....s....[.JB.7.l.C...@.[..6.t..o*......f_m...e...U.].....Y...QM..|..5c.<..5Ew.H..Xr.9......*..U...s..C..<O..~F..#N.N..AEg..O;...U.;.U.^....J..?.D...=........^x..$i8..!^.....c.b.](`...d.\..d.f...y....:.y.b[.g...:.9v?jPx.....j.k\.UK!O....o./.s.qd.....vmk....o...c.Y7..#....#...6...7.}.l...C.&:...t.l.V..e@.>.......M..."..7"{....%+...G{.<... .\.u..PK....<N.......PK.........N4J................META-INF/PK........zN4J................org/PK........zN4J.

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\is-NLLSC.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v1.0 to extract, compression method=deflate
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):475305
                                                                                                                                                                                                    Entropy (8bit):7.908749745010502
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:12288:ZruOUCEkXuls0n0nWdMj9NEMDXaEQXxDza:Z6qrXumjvJrpF
                                                                                                                                                                                                    MD5:CE43F7933316AD89EF6F3ECBBD91F777
                                                                                                                                                                                                    SHA1:C582284B9FAAA35F92462181541C5F2D4CA9EB38
                                                                                                                                                                                                    SHA-256:34BBAE3B6564FF2AECF4A37AA1DA6A7896B5336CB2092FDC5FFDDBCBCC2127B0
                                                                                                                                                                                                    SHA-512:8AE0A55E62283C754C6129BE265AB6AF3DA034977C5CD40E93BF0980AF947310D9804999857CD13C79E4309D87BEF4BC88D5AB6B99421C42B9AC57E5FA343896
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK.........i+@................META-INF/..PK.........i+@.q$.x...........META-INF/MANIFEST.MF..1..0...=R...m%&....v..6R.D....K....._I.w.w.=W.0..].......{7o...bd.....Y.aX.U...._.8>.....P..$.^.....8'.}...woPK.........i+@................META-INF/services/..PK........6..>f..."...'...;...META-INF/services/javax.persistence.spi.PersistenceProvider./J...LJ-.K,I.K.J....R..3.KR.S..PK........6..>................org/..PK........6..>................org/hibernate/..PK.........i+@................org/hibernate/ejb/..PK.........h+@.A.J....L...6...org/hibernate/ejb/Ejb3ConfigurationObjectFactory.class.U[O.Q..No[.*r...K..rY./..B+H..D....m{hO..6.-i.U...$.g....8gK.p%..n...}.=....7.sx...s..Ux.D.S<S.U.\E...^..")...EI..fI.....V......2.7..f.e."g....o6kyn}..U....^..-!.O.>.,..s9.*ieA.ns.W..Z%?.1.=QjZ.-L.].....^.M..b./q.#...[7.....U.}]..FI.(S....zM.pS...".b....EU...e[.........{..N..7...&.Kn.E*3v.a...^n...4j...]+cP...Y..x....&0.m.g..H.E.Z.$.....F.io...k...d5zj...Y.oa..0~.lR..s...]..n./&....V..e.

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\is-NN53M.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Java archive data (JAR)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):105796
                                                                                                                                                                                                    Entropy (8bit):7.800513595088744
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:1536:anpyTWz5OlgiblUv3f/I4xRjhFzDLxMjkR5OGLBRIcuJ5ZaqEB:aeWYg3/fw4xRjhFPukR5/kjdo
                                                                                                                                                                                                    MD5:C8A1A8D216008D8136C7071CDC5274F0
                                                                                                                                                                                                    SHA1:7E3CCA18022216F309859120B50BE44AFF367C4E
                                                                                                                                                                                                    SHA-256:B0D371E8481C5D9562C08E41743FF818160CEE06F59EAAA4A22F29B16C83B371
                                                                                                                                                                                                    SHA-512:201BDD11D10A9C4866A3BC64E40C0E3C27A117B6AC5ED55AC81DD708D58064B233DBC2D813768FAC97D51A00AC24F5921B06DC6DDD82FBDA2CBA80AE09832307
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK..........:................META-INF/MANIFEST.MF.....Y.r.Z.}.........T.M ...Ah.$..@........%l.k;.)......{.......F..NY.P......w.....N...A.FY.......C.I......";..S.F..d....Q=.......{.T..cS.c...Tz..,M..... ..=..........k.IT...Y..].m........zY...c.A^:OVV\.$....?n....K...y^...6_L._...?..~..]!O@......cn...f.[.....A...C.S.....3....m._w...=.u[....T..dy.......c...:.....?......w..u..?..v~c........7..D}s2..o...zz.?........).}}..k.:..d].......?......^or.V....$G.f.T..['.9..B...H-.V..1..y..5u..7.&qA....D4. .L1;.e#R_...t...,....yv.o...Tm...e."..@.....XIq.).H..i:.c.Mu..jf.Q...<..MPVN....9...U..-.F`.*..g.0`.kh7.>..b-..Os.........:.W.0.....(@!.X..=)ZN~7N...ZIE.In.r.w.q.:K$..Q8;..W...t.}.. PA...6....yk..I...B..q@.%..1.v..9.x.R.....f....].[E....'UFU..p3I.m.V..Vc.B.(.-s.E.(..z..xM.S...z..2.J.l...J..l......^UE`.3|..[...8..d..4....n....]Z..KrV....a-.3...f..p_K._:.0..f.[.v..w..Nc...1.O.q%.]../..;.=.+xK&S....Jc...R/...k.|."...YV.aU....>3P...d!p$R.x6.+eg.L..#.u..

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\is-NVG02.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v1.0 to extract, compression method=deflate
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):199463
                                                                                                                                                                                                    Entropy (8bit):7.885693644124915
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:FS8VvTVKhmlP3cL/PS+RqNl7zSjfg4moi6CO9c/hSBZyAiZuWMGSGefdsLUuFL7c:lvTcLL/fMy2F8BviAWxSGGYL7c
                                                                                                                                                                                                    MD5:F007829B790FB2094A80FD02DC05F55B
                                                                                                                                                                                                    SHA1:F39AC6ACD2CAD905EC1D62C462C25403A8B6FFC5
                                                                                                                                                                                                    SHA-256:C22B0EBA59BBA7D7DCAE29DC4696B2395F2BAC636E3F198449B093CA37C3FC08
                                                                                                                                                                                                    SHA-512:88194059FC92A4E24DFA5ED06CF9E35BC60FB52BA5AB91E07610CAAC451C6315E3143F76BD79AF166584B80BA1791DC0F1B8A57B2D273F56467EEAD42856D2CA
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK........!Q4J.=..d...........META-INF/MANIFEST.MF.XMo.8..... rX$@DKN.u..q}haw.v..z(.....*RN..wFR$.$.)...5|..x#.X.,.T.w..@D.q.=....r...^..*{..+.#..!'K.._...........b..Q.1.<.I.R.;.===Q.3o.HV.0.,G....3kL...p@(.. ..=...K7<Rr....:6..q.....^..g..]..\...O/..^q..8......+zI......3.X.Be..\.....E.[s&.B..2.>.w9...O.]./..gZ.,.......;.........h.$"....l...N..S..`.VHu.zgdl....K."Q... .i..hE..u2W>.Z.Wx...bS';#.4..#_$....E.....=....Zw.{d+-........=......W...a..=s.H`..GD}.CB."...c.6.....y\[%eO..'.j.p..XX.<..l........*.>.7..VP...V!....1Z..~3.....-v..8.......!..c..= .1....h...!.. .%....@c..EW..N.I...}..h..ZP.'.fRj.`.@...pP..5.....@........K....7'........qv...Zq.8i.v5........j....;.....{.,...!V..... CA..pgM.7A.g2.O&.d. .I.#..L.t8.=w.Es.f..\...D..:.i..-}..n...d.8yw..^..1.k.lT.Y#9...4W.Y.....6:z..wV!...~.i....k.t_..H..U.. .NS.2.V.........y6.n.Plx....0........a.k.o..Mz.7..G.tz...hI.<K ..+..F.....>..3%...!.`.....B....M.....6..s.....o@.{..<.1^z...C<O?....e

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\is-O7SCV.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v1.0 to extract, compression method=deflate
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):385600
                                                                                                                                                                                                    Entropy (8bit):7.89042745452337
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:6144:ty0mzAdsTBv38ayNW/26v+DZNzxwf8ZxnsbwutZMFjw6vC/06HZqcM9FVyF3XTFC:suwVyRVbIUcewXWUlOV3nx8G
                                                                                                                                                                                                    MD5:DA5C4A95E68CDEA21CA071658CA2E5D0
                                                                                                                                                                                                    SHA1:87E8DB0900866DCB352BDED740BE06BF7FEF4E93
                                                                                                                                                                                                    SHA-256:B3DFE0F2C22C913D865B26423AFAF3CA0A6AC4A0A8996139FA0DB960489C5B47
                                                                                                                                                                                                    SHA-512:F3F90F49ACB8DDF08B7002E0E78FBD9B2E4F286BD7C5BE6183B367455809FBA245CB61828BE8E0899802ACF5A1420999DB316A686B0E4A71B0BBF823DCDEB7B2
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK........F.kE................META-INF/..PK........F.kE.u..t...........META-INF/MANIFEST.MF.M..LK-...K-*...R0.3..r.JM,IM.u........+h..%&.*8.....%...k.ry......tC2KrR.....2..u.r1T.m2.3.34..r.qu.v......PK........C.kE................org/..PK........C.kE................org/springframework/..PK........C.kE................org/springframework/orm/..PK........C.kE...@........E...org/springframework/orm/ObjectOptimisticLockingFailureException.class.U.o.V..n..dn.nia..l..N...6H...ne. .!m. 7qS.$..gE..=n.m............Qh.^_\.IK.)....|.9.9.........R...$.....|..\P.)_?.b...\..i.^.W.....5~...L..Y.....2.g8......?[.Z-.m...U.Y.j...#....N.<.5.....N..0.....9.j).de.s7..]2.1$g.M..N.^j.Wmo...n..<......P2..].Zl59..g..M..(.^].v..;uJ.)...9.[N...s..6.r..{..v.%SeH..v.....a"Z..../n............j.^Ej.......0.........z......H....^.....p*...!2..n.wb.m{e{...Z..<Nq .Gp.......f.N.b{...4X....e...../...&.........3x.%...t7.F....k..]Q..).0..0.T.ss..7&]....b..?."..~...-.!6..]O[..0L....

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\is-ODRQ6.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v1.0 to extract, compression method=store
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):20235
                                                                                                                                                                                                    Entropy (8bit):7.790842842819005
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:gy7iFlTflpp/HCw5JR9sct3LY3FyEm5cVwmiCqprk/Wur1bw9MqtJ5imo3oEvsXr:gyqtd/iwDR9sctbY3p+tpk+Ow9MqtJ5z
                                                                                                                                                                                                    MD5:51E70AD8FC9D1E9FB19DEBEB55555B75
                                                                                                                                                                                                    SHA1:4ED2B2D4738AED5786CFA64CBA5A332779C4C708
                                                                                                                                                                                                    SHA-256:775003BE577E8806F51B6E442BE1033D83BE2CB2207227B349BE0BF16E6C0843
                                                                                                                                                                                                    SHA-512:E064A477D5B1F8C56B4741BA606EED764B779A5D9870B8C193771BF0D904350AED839AB21602DBF5F376F7208B8CA24F64504D73EC6A0C5C08C5F0ABC7C466D4
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK........v7->................META-INF/PK........u7->m..f............META-INF/MANIFEST.MF.R.n.0....?,|j..#.k.F.Gb8...N.C..-.-..)......C6..-z#.;...3.R..X....J..bM...0....."......:#..b.....5_ZW.a.K..P+S.........s..].+/....W..G...un.3.....o0..7l.pc...,..2...\....[.or.&.7...\.......qS.w.7h5.jT.e..7..(...B%"$m..Y..RI.C.yM.t..5.8.x\N..%.A..v-....`UB..P.e.)dZ.""Y$.l.-....u.4..w.A]......t...U{v<...j-.(#...T..;0Ri.Ka...QY..i..7v."...Q...u....N...3..?....b~.V-.].f..4ddlmf..?.GX.* L......|E..G....d1c1.h.f......n..q.J.ob+....W.}.(`.{b...L<.V..;.J#.I.t.......:u?...V...E..h...|^..,.U..}..<.;...SO.......,v....PK........t7->................org/PK........t7->................org/glassfish/PK........t7->................org/glassfish/hk2/PK........t7->............&...org/glassfish/hk2/osgiresourcelocator/PK........t7->............I...org/glassfish/hk2/osgiresourcelocator/ServiceLoader$ProviderFactory.class.P.J.0.=.........@.L......@.}..c..6.tC_.........U..E..|.;...>=....`/@....

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\is-OFO8K.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v1.0 to extract, compression method=deflate
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):366941
                                                                                                                                                                                                    Entropy (8bit):7.799625108398948
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:6144:ZGdqAvLzEZHl8gSJFsFfj2kOUJI44VwdXGMLffUDlIreJUHeBh0Cl5Arve67:ZsvGFsJFcfVOU+AGM7fUJPJcFClu/
                                                                                                                                                                                                    MD5:C7F15D9647BD568AB8FABE480BF0E50E
                                                                                                                                                                                                    SHA1:D5DB43E696A02186AB7E18F8C9D99AFBDE94BD77
                                                                                                                                                                                                    SHA-256:5F14998003CC4737FF66B8A4044D607009C4B25FAF87564D5165CF5AFA1B275B
                                                                                                                                                                                                    SHA-512:1E804205CB15F1AAD77E7FFD1D5D67A9078A17FAB561AF447BFEF4E34725B24CA23AC17B1080020A695A0109BEC9B26DF1468AB58263B3E8634967427DA3AA7F
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK.........Y.E................META-INF/..PK.........Y.E.......+......META-INF/MANIFEST.MF.ZIo.6.....0|+.....$.C[.P.S..`.s.e.V,..)...{.b..&*E..M....._i.?3Y.|gB._........fG.g.+..DV"/....\..d.Y....,cR>.6._.....3.....b.......,......P^......t[...+.<.5l....`km..8.'.,y.@-|.L.NH.~..M......Me..8=&{..D.0..x.85{.ch..A...T3.p.Bco...q.j..g..(.r....R`]}..!V.y...s.g...r&......../Xh.O..3..,. ...9F1..Z.9-3Fr...X...pL.....m..0...*.'N..T.cj......T..gz.0..|u..1z\....\.r.U.s.nO._.XM.B..'...^.T.N...;m.-%y.Y..e..=><8M.p.........P[.].0..@......UM..y3M.j...2.y..+.....e.*..p$i2|.g....*._......i.C....g..W.ud.j...'c...6EVD=.\/].39b..Q.J.. G...a.y.u.[;..iXgf........d.P......j. W.gj..I.R.Dd.q....@.a....K..<.VPl..N...I...ISW.ae.w]e..9^.VQ..G.+.....L\....J...L..a.>f.67...D8...a.![.Rq...J.E..}.o..M...7.1....h.,.>/a.p...#J...(..Gv...H.3.M..M.3)$..P/..%@....,h....;.>b-G?.h.a.H..~3.S.e.Q.......$.$.*....H.....f'...]..d......_fu..+,T[C.o.8..3.=..a......U....(..+!T.6r.?r.

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\is-OLCKL.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Java archive data (JAR)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):962808
                                                                                                                                                                                                    Entropy (8bit):7.819513341349416
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:12288:JuvOiQnEtrp1F7Sm2Z7UjVfjRZNXPjB2ND3AqYtZPNHCftbMfWFvQzmANJ4dqCbl:EvOXnEHnpfjx94Aq2ZPlCFMSGmAkd7P
                                                                                                                                                                                                    MD5:230BFD0EA66A793BCF57CA7170922C5F
                                                                                                                                                                                                    SHA1:1BB881955553E4FB22904E7FF66B59C6C03A13A9
                                                                                                                                                                                                    SHA-256:8E8A5EF2148C3AC70203DBBFAE5EE08C5426566E3DCA1AF08B12B8BF9F17FCC7
                                                                                                                                                                                                    SHA-512:B673BEFFA5552837C5FC202F7E2BACDC246DF8366032337E7D58B13650154BC82BC100CF32605114D18C7E2F8269991DD22BD91AB22E9770EAE6392D02265BAA
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK........b.lD................META-INF/MANIFEST.MF......_o.0...#.;Xy.V..%.F....U.Vu[_..9..[c#.$.....!.+........j.=R.....q....7&.Ld..........>.\.A.3.yw.-...../....-@.@.oJ...E.wCu.Xf.*wN.ns2'.f$|!1.j...>........b..R..S..[..,.B.J.s.....~.0..t.|.Y........O......1YFP%.^.$)-..T....J..-.IX.PK.......R.|.P...i.TDR..k.]K.A.6..I..F.n]+J........&dN.*...1...2.}a.ll....c).".T...(.T.....+&.HH.g..bF4.#..6S,e..n.f....2!:..Er...\g..@...V....@.t.Q.j...1...4kes..@J...."9..9...w...yr..0.oD.+E.idgebt.$.S....h.....[....(.N.q.6'h.....}Z.?a.,e.].....].3..{.'xy.O1.cu...c../..!6...!..G?.K!.....z..#.36.....V...v'....q.........g{...\....R].n........x...;PK..Q..4s.......PK........b.lD................META-INF/..PK..............PK........b.lD................META-INF/maven/..PK..............PK........b.lD............7...META-INF/maven/org.glassfish.jersey.bundles.repackaged/..PK..............PK........b.lD............D...META-INF/maven/org.glassfish.jersey.bundles.repack

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\is-P1NN1.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v1.0 to extract, compression method=store
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):5968
                                                                                                                                                                                                    Entropy (8bit):7.420202245950754
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:96:ysd3ChF3diMcH7VwompefEaAZUWlAM519A9FqC7m8OeImV/6X:5dcK5dYefjACWlAM5eEW6qV/6X
                                                                                                                                                                                                    MD5:5F45BE14F44B1BF2D1E50E2C494C9315
                                                                                                                                                                                                    SHA1:2A9E23E3D64A93ED7BA5515E6169F65F56965292
                                                                                                                                                                                                    SHA-256:83C4ADF34F487D258CCB123980E8E87DACD63FCD5A0DD5B59837D04E3156014C
                                                                                                                                                                                                    SHA-512:CE2AE77998540CB0CC5B0ED1129C35167B5219EB1770ABBF35E4E4F50A8EB80417C55D51F8984554D1824BC727B3F67CC533BD39A0E247C342BB9C861325291E
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK........@l-D................META-INF/PK........=l-DR..J............META-INF/MANIFEST.MFM.[o.0...#.?.c.U..KK........l...=...l.._.......9.*.E./4Vh.BBza.z..qQN..0.oz.'".72....N.`QV.KT.:...$.&.....[..`...Z.0Q<JH2.p&....?...Ec..0..........W.$`.j/.@-....6.!.@z..A.7._,....Z....u.~....n(..6>s..=.Go|......;.5d....>OF.[j......F/O?G..h8.B..Uw..(.......U6...n.-.<...J+z..z#....Y.c.g.d....w.....2#*.@......Z..[o..:,o.s...}.mv....>..C..$.?A....#k/....G..B..16......r.....A...?PK........=l-D................javax/PK........=l-D................javax/inject/PK........=l-D...............javax/inject/Named.class..MK.@...iS...zR/E/..z*TA..z..e..d.._.......=....af......K.h.h.h..3e<.....j.b..$..B.....6w....x..q...A.o..i.W....j.Q.....R..W.p....k;...O^.=.\.._..&....:..s..I..!. .......].0y.?.._...vZ.BhVm.....xe...._jbu.1......$......a.......)~Kl[.....oPK........=l-D.R..............javax/inject/Qualifier.class...J.@...Tk.j.\....K.n]..P.I.. .d..e.tR.I.......;..M..;..;.

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\is-PTV0I.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Java archive data (JAR)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):283176
                                                                                                                                                                                                    Entropy (8bit):7.763344541543758
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:6144:YkCv/+sAE3j6+AcGCo4XWa2CDrRzZle4bdsYj:Pi7THAcGCo4XWa2YVe4bdb
                                                                                                                                                                                                    MD5:EB1BE701C0C0F73A76C8FD736CEB86EE
                                                                                                                                                                                                    SHA1:F7C5FF1E5F4B8842431E52E0554D4AA79194E892
                                                                                                                                                                                                    SHA-256:84A07846AC4C4D426F95597398C08E3EFB9E55FAEDF2439348C64D3C77028B8D
                                                                                                                                                                                                    SHA-512:16681B1C944CB73846FDAD5245EFC195A7F963EB6C64A6C780C34245B712EB7CEC1A10CAC64E91ED710FEBFBC0CF38A516A3EE03ABD9680E6D3F59F2115752EB
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK........"..:................META-INF/MANIFEST.MF.....}Y.....{G...8....O...... ..."....2#...43+;...*..T.....k...,..K..:....>...F...x...c'..n...I.D...W.Q...s..7..9..,....?h......l~.....?...w....*.>=.I..v...G^..<'..........}.27.O.....}L...{....*_.x....m.4.......7...._................^q!.&:.M^. .e.Wev2....._...eW.U.b;';..}.........$...t.}.....vR.....u.VH.b.......5v...{.7..m..^.l'.7...:.K.(r...[.n.7......"/s....G(~...*/......H....t.u...k..=./.~>/.6.....Ss.....a.7...6.x........>.#)..k.n....5?..V.,...Gb_.7+g....vV......x}.,...Y.<?..o.*..._._.......&dn\~G......:O....S.o^.?.....^>5.mi..b...2......v....%B..<.b9...n......H/..........WI.......|&...-......./..0w....~A.3..'.~....[.._L.....G..!9.]......|..".8...@i........."O...D..A<0..*....Qy...S......?.c...h.v^.9..s..q{0...a..[.Wb.A~|.hc'....S...G.PE......B4...a.S.s....Yc.$'B..h..A....)l.bB...:.a.,...6w.9....(.s?.oa...s..U.!iw.@.....~....../.nt.'r....7.w.......A..........k#M...~.Ry...p.F.

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\is-R1TJN.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Java archive data (JAR)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):2730442
                                                                                                                                                                                                    Entropy (8bit):7.961733032938122
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:49152:EtQNSzfN/D4Ks3S9uUyb+k46Az6bS9H2rwJonYZiSIUB:U7ezrUE+k46U2uIgIe
                                                                                                                                                                                                    MD5:A018D032C21A873225E702B36B171A10
                                                                                                                                                                                                    SHA1:A33C0097F1C70B20FA7DED220EA317EB3500515E
                                                                                                                                                                                                    SHA-256:BF1F065EFD6E3D5CB964DB4130815752015873338999D23DCAFC2DBC89FC7D9B
                                                                                                                                                                                                    SHA-512:29E1125F123FF3F605DE74B866BE800E78A5448609BD62F1F6A3DF13BC7668A37AD35936B7F8F0E87B60821B12EBFC86FA588EE972204BD7772D5BB077B42987
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK........#n.3................META-INF/....PK........"n.3 /.q............META-INF/MANIFEST.MF.M..0........bCW.J.Q.J ...]q[Y......,.C.{..[.@.z..g^..'c...}(..yat.]...>..,.K......c.....u.y...H..{..&.........<.4'..l....y_.q..Z=.a.i..2.....G.UT,,K.................`R.@.>.,.1..<...V.FI...PB.........D..t(....7.....E..../.".(=d/.z.....l<...X....um\.g..&........w..v..*.|J.;9...Orb.a...W..M9)y|.......F.....B....8.c.4.=.k.K......}...?.V.....B. ._....o.FiK..2MF....L./....V..3o,uMD........(kt..........?4U9.9.....xI .."...v._..w..t......zM.'.PG.n.Of-J.L.N.D....../PK.........l.3................META-INF/services/PK.........l.3................java_cup/PK.........l.3................java_cup/runtime/PK.........l.3................org/PK.........l.3................org/apache/PK.........l.3................org/apache/xalan/PK.........l.3................org/apache/xalan/client/PK.........l.3................org/apache/xalan/extensions/PK.........l.3................org/apache/xalan/lib/PK.

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\is-R3M8I.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v1.0 to extract, compression method=store
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):284220
                                                                                                                                                                                                    Entropy (8bit):7.94847674828362
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:6144:0QyyUK6j4lplvLt3UnSXGn1N5YzKrRFOo0mf2KjCciWZMPh:0zol3vLxqSX4vYsI6lCc0h
                                                                                                                                                                                                    MD5:4D5C1693079575B362EDF41500630BBD
                                                                                                                                                                                                    SHA1:0CE1EDB914C94EBC388F086C6827E8BDEEC71AC2
                                                                                                                                                                                                    SHA-256:50F11B09F877C294D56F24463F47D28F929CF5044F648661C0F0CFBAE9A2F49C
                                                                                                                                                                                                    SHA-512:4A5A3DBE4941C645E2CCA068CCA5C1882CFE988B02E7CD981D1E51784900767D1DEAB0E0E0566F559C9FCABB4A180E436D5BB948902D4F4106F37360466AFB42
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK.........->................META-INF/PK.........->.^.VH...........META-INF/MANIFEST.MF.TKo.@..[.....V...M".z..J...B..e=.M.]kw...wl....pA.|.....*FG.3Z....U...;+.j....).u.`W.EA...M.....[M.8.5....m.a.`.e.....J..f..Po.D.0z=.}o.f...I...SE.v.g..h.#..o0.#c;0] .eB........uT.N.A..c.(..@U....d(U.....C..oV..W...J0...J......>.KSa.H.R...K....b...C...&.8D.._.[.o.lxqY....A...#.8_.%.u..H.xF.u.Q...b\..$fIe.:.....i.N...'(..va.-.P.9.>....1I..:..a3l]_.wIG..."}..U....W....Gc.."_..V.K...n.o....19........[.e.Fc.Z.z......A..8..-n.....V..~..%..[.&..X..I%.6 ..X..bq,.7].v.Z..b.J..S..p.Ph.?u.K.9%@...X.-F@.f.........@....;R..p.....X?.w5.3.o.....f`......w......=...PK.........->................org/PK.........->................org/apache/PK.........->................org/apache/commons/PK.........->................org/apache/commons/lang/PK.........->............ ...org/apache/commons/lang/builder/PK.........->................org/apache/commons/lang/enum/PK.........->..............

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\is-R5ICE.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v1.0 to extract, compression method=deflate
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):885239
                                                                                                                                                                                                    Entropy (8bit):7.8983244651944595
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:24576:YeD0sq8eXz7WrwtLhNwZgSoZ6yK/7TXwDdlz:YeDL9guwtlyZMu0Dr
                                                                                                                                                                                                    MD5:C11AB58FB90FC49EFF799B4B87B5CB8F
                                                                                                                                                                                                    SHA1:6BCA909D614F349F18AEC2A924FFC8D28AA9EFAB
                                                                                                                                                                                                    SHA-256:5DC4567DECD59A90E76A46821AD84B0F4494AE899B150D20EF09580D5D8F6070
                                                                                                                                                                                                    SHA-512:BCC4513D9E92659BFE7D2488CC666C7556BCE5B73DA2D8DC4F308180CE2D269A803BA2C87C2043989A10C4BE0F5AAF86F1893F7A9B5E74DBE8197BA54E6A0AAE
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK..........kE................META-INF/..PK..........kE....u...........META-INF/MANIFEST.MF.M..LK-...K-*...R0.3..r.JM,IM.u........+h..%&.*8.....%...k.ry......tC2KrR.....2..u..R1...2.3.34..r.qu.v......PK..........kE................org/..PK..........kE................org/springframework/..PK..........kE................org/springframework/asm/..PK..........kEjT._....o...+...org/springframework/asm/SpringAsmInfo.class.PMK.@..............Y.JQ.....*...[..I.wy.<...Q.f.....f..y._............B....W.I4..("..JV5.u..;.......$8G.)....N..B.YSf\..0.8V9+R.E..E.~...0Vz.Vk-.r.Y._.~.YU...&U..:'..jt.....=].g.`.......F.MX0......B.<.-...44....3....}.....7.........`.c..[6ph].oPK..........kE................org/springframework/asm/util/..PK..........kE0..~%.......4...org/springframework/asm/util/TraceClassVisitor.class.QMO.1.......(..:...g.......H.sw.kq.n.....?..e|./.=.&/.Mg&...w.gh.P..........r.re/...p"...D...x".;X!J...r{g..f........P..j>....8#...Dd.0...o.U....Iy1#.....\h..E1.s.2>

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\is-RC0VA.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v1.0 to extract, compression method=store
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):77682
                                                                                                                                                                                                    Entropy (8bit):7.835396778613255
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:1536:1fVJejQe3ypu8H9PwZvLms7EdcGV/6IFpjp4DPJY:1fHejO9HV+meEVV/6aJp4DPi
                                                                                                                                                                                                    MD5:3614F6D6E3349F0621C96D40C8CD7BF1
                                                                                                                                                                                                    SHA1:D83042685DEA0584905F2157C4BE93F1D34F24B0
                                                                                                                                                                                                    SHA-256:56318CD28BD1900FF0D0E2DD54477898C32D0D243A66CA6A23F4E1FCA87E329B
                                                                                                                                                                                                    SHA-512:3B27CA654607380B273A82C89080FE77EBBFAB3F930CEBBFCEF7E34A42A019127152522A5B4812D3348B652B3C1FF926B152AD0C2F95187F8D15EFE05C869469
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK..........'M................META-INF/PK..........'M................META-INF/MANIFEST.MFm..J.1....y..@.....^U\(R..q36asX...}{c.".2w.|...........d.Z.8;.>`.D@U..ds1..a.&../.:y.h.].8C.G8..2".....o..u...G.H./F8(...FWf....}7.......^.]..C....z.[D=?=VW.~0Z.=..M.9.9.....[s.9.....:?a.....9.....g_PK..KB......]...PK..........'M................com/PK..........'M................com/twelvemonkeys/PK..........'M................com/twelvemonkeys/imageio/PK..........'M............#...com/twelvemonkeys/imageio/metadata/PK..........'M............'...com/twelvemonkeys/imageio/metadata/psd/PK..........'M............'...com/twelvemonkeys/imageio/metadata/xmp/PK..........'M............(...com/twelvemonkeys/imageio/metadata/iptc/PK..........'M............(...com/twelvemonkeys/imageio/metadata/exif/PK..........'M............(...com/twelvemonkeys/imageio/metadata/jpeg/PK..........'M............(...com/twelvemonkeys/imageio/metadata/tiff/PK..........'M............6...com/twelvemonkeys/imageio/metadata/A

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\is-RD8TC.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v1.0 to extract, compression method=store
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):575389
                                                                                                                                                                                                    Entropy (8bit):7.869228657414263
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:12288:qUcq8DW8VFxPcJdP9YtFtpoBZJmsbgp+TJprWIkPT:ncq8DWiPcJl9u/oBfmXntPT
                                                                                                                                                                                                    MD5:13BC641AFD7FD95E09B260F69C1E4C91
                                                                                                                                                                                                    SHA1:761EA405B9B37CED573D2DF0D1E3A4E0F9EDC668
                                                                                                                                                                                                    SHA-256:87363A4C94EAABEEFD8B930CB059F66B64C9F7D632862F23DE3012DA7660047B
                                                                                                                                                                                                    SHA-512:8D0AA0E4E328C2E391D4D972F361A19FF085F508CB0478F5967280953ABD3520EE92CC1D19B21CB4E29E4A7BC557487DDBAEE9807B751824241269367B9E92CB
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK.........|.8................META-INF/PK.........|.8....~...........META-INF/MANIFEST.MF.VKo.0......z..q.mm]..'.6..%+v.T.N..!.y....N.'.!P@....)zD...6..(.e......b........d..)l.N.5.:.......y...4K.3%.V..5.$..j[......s*..@....T..S.|.A...!1.{g.....8...S.`.F.2}.$.* .....2<.22k..<.,.....3.."....UU.s.w..5M...Q.[...#j.._.].\.3..b.<.?.E...Us05.-.|..$..].....z...v..=Q.uo8.{.O....\.1EI.2..%.C.\.+3.s.......Y.....H..}..&.g..T(....,."P.+...|....yZ..*j.j*..4..,aG.{...5(7p.m.O.Y.vEE.]..k.. OK.....|...|Da.'.3..d...8.}..........<l..tShyL-Z.d...t.a....mf..D..jn1.9...#O.{?.h.<.&.....H;..:2..z.|.?.J|..)..B5...YPC`cp.....y..P.....".Q...R-....%....d.~.wK.-..b.%...F.g.....`.UY.O....U.z.>lk&..H.<x....K...PK.........|.8................org/PK.........|.8................org/apache/PK.........|.8................org/apache/commons/PK.........|.8................org/apache/commons/collections/PK.........|.8............#...org/apache/commons/collections/bag/PK.........|.8.........

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\is-S4CH3.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v1.0 to extract, compression method=store
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):121090
                                                                                                                                                                                                    Entropy (8bit):7.843174503783093
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:UAc9ivlkvwRxlXyoP+GBuEuf0Dq5O5ie1v3X:UAuiNkv6j2sWs+5O5dv3X
                                                                                                                                                                                                    MD5:A1898977D7A567EFDEDCE5AB2D157A74
                                                                                                                                                                                                    SHA1:294A093960AA1169A849544F83EE4A4686BFD408
                                                                                                                                                                                                    SHA-256:8AEF005944E1F3F0FCAE297B3868F7EFFE5AC4583369B51FC9F599B7CBB8D453
                                                                                                                                                                                                    SHA-512:D4DFBF886B4C5B33DBDDF6E9168070084C70D04DE211F6E06829AEEE44D4AD0850AE9A7FE4AB1490D9385CC4872C402EB37379C29363DBB08B1729D124C61A27
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK........s.'M................META-INF/PK........s.'M................META-INF/MANIFEST.MFm..j.!...........%=.t!...b..*..n...4.........V6.w((_ ..'#.j..."t..".i.\..8}@...S..rC..F0./P7C..;z.hSs'..s..j..n....l...F....y..k..6j.!.!.Ep.z;.........T=..(.q(F.&.......W?.4].....\.0A..?D....]p...PK..P.|.....R...PK........q.'M................com/PK........q.'M................com/twelvemonkeys/PK........q.'M................com/twelvemonkeys/util/PK........q.'M................com/twelvemonkeys/util/regex/PK........q.'M................com/twelvemonkeys/util/service/PK........q.'M................com/twelvemonkeys/util/convert/PK........q.'M................com/twelvemonkeys/lang/PK........q.'M............*...com/twelvemonkeys/util/TimeFormatter.class}..J.@...ibbc4U_..H.A<V...B.C..M.......... ......g.....f..........%.#.H..0.q...,U..@3n..Q....G....^JB.)#o[..f!..n....aV.:.O..H].G..N[..t..........L.Q....y.6..*GJ.o...7F...;......W.l....w.J..?..}~.8....`V.\.q.f...4...{........{...~.8.

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\is-S4ETP.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Java archive data (JAR)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):29130
                                                                                                                                                                                                    Entropy (8bit):7.8024696790865535
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:768:R3P140mJQ1IVyzJHAAe/+MUQeLulefnt7:Rf147qIVyzRDe/bUQ0DnR
                                                                                                                                                                                                    MD5:45C1EF0811855157025215F92D55CBCE
                                                                                                                                                                                                    SHA1:87B38C12A0EA645791EAD9D3E74AE5268D1D6C34
                                                                                                                                                                                                    SHA-256:C0DE2BBC4CB8297419659813ECD4ED1D077ED1DD5C1F5544CC5143E493E84C10
                                                                                                                                                                                                    SHA-512:44B1F06FC040AC026F203243ABC859295858CCBF7DBA7C811F359F04B75C82F432FACC05AF888BB0D04E620411B04506DAA2AEA18D16109ADBFAD76425C24569
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK.........teHo.7.J...o.......META-INF/MANIFEST.MF....}..O.0...K.?4;.M..E,. 8..S....P..V......\.D.=....}....s06..6\I..(...d...+....{.I7..v..J2.....Fo..q.EL...;P...H.E..;.F...H..]OrTh.D.1....V....g.5.l....C&W\+Y....'Y.D..>.3%8..vF.l.&.Sj.)H.4F..H....T.h|r...l.Q.{C......z\.(F...P.h..RiR.<.l..6|".,.........Ao...=...r.{w.R@..G#,..G...>........:../..;..l.....$J.z...PK.........teH................org/..PK.........teH................org/objectweb/..PK.........teH................org/objectweb/asm/..PK.........teH................org/objectweb/asm/tree/..PK.........teHf.3.........-...org/objectweb/asm/tree/AbstractInsnNode.class.V]W.W......A>4.*.TC....+.m.PF&..$...C2..8I...~>...../}.D....].O....m.L....C....s......g..\.On.`..\.n...........ehd.1H.M...g...}..P.O..W...5-c...j.^.,jZ8.\2.j.....g.!kOZ@G@.S...5.S..p..J.".....\C2.U.Usu.s.,....o.;.ZuG.#o...7.zI7.E..r..Zk..Q+qA..=.n....!........,T.e-g{7.8......'......|....V..)4u...'...^.-.....dc4!.qB.*.Kr|6..nb&..

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\is-S8T2B.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:XML 1.0 document, ASCII text
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):17716
                                                                                                                                                                                                    Entropy (8bit):4.2329642854000795
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:byS8wnfNsQsEs6sqsls5sisws4sTsRshfgs+sDfCszsZf1s0sOsSsCs3sksFswsu:b+AfNsQsEs6sqsls5sisws4sTsRshfgd
                                                                                                                                                                                                    MD5:473C9107ED5E43BD984680ED5B49DE0B
                                                                                                                                                                                                    SHA1:32427AFF464390A8A1FAC69B06A7E13FDAFDCF0D
                                                                                                                                                                                                    SHA-256:4F52DE806796AE88653AEDF38DC9B51C986C25D4BD7BC17D128052B88D35F0D8
                                                                                                                                                                                                    SHA-512:6F1379CFFD44BFFB45D624A29D75E97EEEEB5992C71610E9A58AFDEA345987201A02B1CD9D6A1AE2F307DBDD4A7EA0D286CA710CB341223CBC038AE59C7F72A3
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:<?xml version="1.0" encoding="UTF-8"?>. .. DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS HEADER... Copyright (c) 2013 Oracle and/or its affiliates. All rights reserved... The contents of this file are subject to the terms of either the GNU. General Public License Version 2 only ("GPL") or the Common Development. and Distribution License("CDDL") (collectively, the "License"). You. may not use this file except in compliance with the License. You can. obtain a copy of the License at. https://glassfish.dev.java.net/public/CDDL+GPL_1_1.html. or packager/legal/LICENSE.txt. See the License for the specific. language governing permissions and limitations under the License... When distributing the software, include this License Header Notice in each. file and include the License file at packager/legal/LICENSE.txt... GPL Classpath Exception:. Oracle designates this particular file as subject to the "Classpath". exception as provided by Oracle

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\is-U5G3C.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Java archive data (JAR)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):99430
                                                                                                                                                                                                    Entropy (8bit):7.879651872042793
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:1536:fVuMQH0l5o7AqfthPtSGjVGzgCt0MUMNxqZ5Wb1cLDS27sxKGSMkaILxZHY4wAY:dK0FstAgfnZw1ca2IwrMkzxZHY4BY
                                                                                                                                                                                                    MD5:2382BFA4BC9166A253357E690B8AB2DB
                                                                                                                                                                                                    SHA1:16016DED351D74151131E7525BD7731F10D66082
                                                                                                                                                                                                    SHA-256:3B155B06D1CA933907B30FA3A9AB282C5ACA775A96074D3B47E4B7B8690AEBA1
                                                                                                                                                                                                    SHA-512:F0D1692D2865504CD7220D2E3ED0C9714E7FDF7803D9DEC4AC621ED03D6E2CD6A3196BA9665BA89557A99C2B9AA3230E2BAA51D5E44D680486FDC9A546C9E564
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK........t|.:................META-INF/MANIFEST.MF.....Y[w...}...?.f}..".-..A.(.7.....A..4(.....I.:.;O&.rWw..]U...:.H.......J.F|..OC..ORdh.s...J..^.e.O..L........Q...=W..yj..u>../..?ER.....E..=..c....A.....P+...X3. .._...m. .......7.l.$i.\A..^....=.9.."... .9!.0...LC...v1..8..i...f.{_...:>Y....<...........$J........#.8F..;(.`...................I..~.Z.........xc.g@#.!By.~V>..t..\-..T... ....[@`;..9^.8..Q.<T...\.Z...<A ....3....K.........P5.F......B.K&Q.f..e$At.&I<5:.qMNl8+.?W|L.w .Y..?1.2......9Y.sN....7./.i.4l.\.GhW..!.....T4X.....p,...+.......J.....v.D...,..u..W.#......1^....Xi...2.V@O......6N.}L...|1..........c}9.5..."".....8.<..5..2.......48..]....zA..[.....|......4..0X3|-.DV.........2^.....N}?.Hy...?q)......$..3..X.q.:..>.&.NXr".U....z....q.Q..q...Fi<{.{....(_...9Bk.....SQ........k....K..rW.6G......L.1...sh5~.U/.|@..j...Ag..3M.....;?.b.....X....5..(Q.N..d...9..w.|a.0]..C..d.....Eb.0..o.&......n.tf....gU.....JI.G.......-.......y..z.

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\is-UCO66.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Java archive data (JAR)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):197084
                                                                                                                                                                                                    Entropy (8bit):7.829422071552972
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:wAvUxJUhimFEPRAL80RgAM9OekB1PPkBd/oJCKtgWE/XCuFK/HDGVK9eEcDi4pKA:nsxyipinRzMMnRPkBd/WZz/LyKVS0E
                                                                                                                                                                                                    MD5:0FF923B9946F02547B127152D8CD7211
                                                                                                                                                                                                    SHA1:5766C2788BBF64AE8A2C14D938F9966832CF415B
                                                                                                                                                                                                    SHA-256:1D4106385611B2DEC486C43424E55485B81D83965E22559035EE2B47E27E4F70
                                                                                                                                                                                                    SHA-512:12B5083236D1AC47A7CF6CD8BF02A8C273F8592036C2F78F837638A6B4D5BA774D9144315480732487D68BE8A869255AF4DCF28703A16D9E39DD674D8B620CDE
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK...........:................META-INF/MANIFEST.MF.....[..X......:.......(...< .; ..}..*.*.._..Z..AK.z.:,...'...6b.u...d.....O.........2B.5..4,w~..Pp...9..v...I\.Y.GN\|.B..W............8..@..Md&.o.F.|..d.'...4w..$s..W..m?...........Q...[Q.......U.....>...?.'....@..?o.zJ...*....R...g:O...*?.M?......i....Y.:Y..wtz.....2.$.Q...N...;.o/....,.W..c.......y.k%...__9...5.........}/...{..|'.....s....q....wt^..nm/l~.w..y*:../YuL::wm...2.....f...{......h.!_.?:..G.{.......|."...G?.....o....s.(.o_.~...'.r....h..yb.d....m';y...g...s.y~.^.o_:.}...U>E..2'O.sd..w..>...._.N}....&...r...1.......N.4O.wt.$.g.S.uB9.;*...T......}'.S....>..Ms...........p..l x28...........<....9.u.b\.......:m..3..J..../.-..=....!.0...Ydd...... .....Rt...k..^F..J4./..F{..I&...tce.o1.].w?..22.LJ...v,.[qd...y.b.$%.&.....w.....#.3Q..l.]...eX./zO..V.........p..7.+m.3.....w...GJD..3...n.zHG".L5..X......<.W.....<.|:.Mt..#7L...........Gy..[e.h.s.?.JF.s..%...x..?0.....%..e".Mw

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\is-UGNPC.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v1.0 to extract, compression method=deflate
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):158355
                                                                                                                                                                                                    Entropy (8bit):7.937503752211515
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:6egWuhWN31cM6sOs/Ol6W48nTFkP9AXSAHOWTsw1:6qzhHOzl6W4WxkPaX/5TsQ
                                                                                                                                                                                                    MD5:BD3625B528BB28D2AEC742157ACDDCC0
                                                                                                                                                                                                    SHA1:C9C9D5B15B3BB41AE9AE588B7AEDE301B42186F6
                                                                                                                                                                                                    SHA-256:2DCA0E609CACA67D72BD3F27C2981FB47C1EC60A6148515FE7AF6F8A2F43E021
                                                                                                                                                                                                    SHA-512:67E635F69B64FB2FAB5EA757785733E54517A13DAC0B57153D673E541F698CCE6481DD145B7E875D98FBC014EA25731EAFEAA2D6A369557181AC02F38E197D68
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK........3N4J".......^.......META-INF/MANIFEST.MF.U]o.0.}...`.0.DL.v-M..!..t.]....M.........:.....""d..u.7c&.....@..dB"...e!3..w0......,TV. S.W.IB~X..{...ec;.)H....m...P..t.T.YO..7...o.AL.......T...x..TZ,@Z.\..(..<o...G.no..."...r.R..........e..c..e.F.a.W.pa..2!O`.....3v.2>.!U........'M............_!-\..\r.....fK.DD....T^j>..m.......d.XiK.Y..i.a.....KF6s$.......V?6..Hj.. 3..2...^O.z..V,b.`..g6..m..5......]..;.n....<.!.[l.).R.>..%..8UX.D....s.B............S.[.#..<V......S.#.....^.].....t:.O..>.R.1N.G4....5<...(>.`J.........DUr.(...f!...[5.d. I.*2..B}o.zH>..5O.M........F.7...Y...u....]....!g.?../..:.U5.Y.[..........o...G0c\......Yp.=..G....(.=.{.PK..".......^...PK........3N4J................META-INF/PK.........N4J................org/PK.........N4J................org/eclipse/PK.........N4J................org/eclipse/jetty/PK........2N4J................org/eclipse/jetty/http/PK........2N4J................org/eclipse/jetty/http/pathmap/PK........

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\is-UN6D1.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Java archive data (JAR)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):449505
                                                                                                                                                                                                    Entropy (8bit):7.9143813255747695
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:12288:DGSGMz/KkE9oPpYGAynsuwRz0qS9qEdhSz:aSUkEcpYGcenv8
                                                                                                                                                                                                    MD5:3692DD72F8367CB35FB6280DC2916725
                                                                                                                                                                                                    SHA1:2CEB567B8F3F21118ECDEC129FE1271DBC09AA7A
                                                                                                                                                                                                    SHA-256:EC92DAE810034F4B46DBB16EF4364A4013B0EFB24A8C5DD67435CAE46A290D8E
                                                                                                                                                                                                    SHA-512:E521785D947CAE1A02070B26A43D235B6319439A6364C58266D3F9C458F9A099406C10AAB5F51C5DB5BA541E88322CB35203C6758B4B8BB65F9539A345DA9A04
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK.........as=................META-INF/....PK.........as=..*.....<.......META-INF/MANIFEST.MF.X.n.7.}...X.Y". h..yH..H...\...wG2-...r...;..P+.l.I.fxx....s%....=.VhuS.c..W......P.oh.H...p....k].........xo`'....y....Y.UG...{.._...........]....[..-.D..h.D[...?...o.*,.DR...P.\~...ff{....7P..;U....WD.........u@.}.\...88Y.H..J.......~6.....;........s...(..@:GP.".....B(u.~.9.b...[.....u.I7......xf..B...zU....I..-.]....pf.......Z..)%.....{..7>/.w.w.@e....u.p......|...qz..%..........W.[w..,.:..8..OI...>^.........l.W.B.y......mx.S..p.B..n.La'.9...L..C<.u...|.xLX...C........V.)+j`D.3%l.TI.G..Q....=.#...\...Z..C.pX4.G.D..........f.7T.R......+...#bp..b.&....'.b..m3hsM..8..&.3'Fjf~..8..S....zC8H./.[.I+........".B..8.JL..p...S..D...]..~..O`.1..A'k.~&#..gC.FW..8..!0..^..un.J."vJN.D..D.....^^F.'.s...^..'.q.x.8$>9'^R(..l9#..q.e.:...4U...m.JhbK.^..p..Pc.J.?..J%$#D.O*'....i.%.....8...x.S.....2J..L........7GF..i/l....<b....q^..O..Wg.......%&...g.;.|...

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\is-UQ5FU.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Java archive data (JAR)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):1922621
                                                                                                                                                                                                    Entropy (8bit):7.944207559304236
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:49152:94JjduwZP2LSMOgqdPi5pmPRZ2eR5lVXMpS:6JjVN2LSV5Z2elBMc
                                                                                                                                                                                                    MD5:02C558B5E1EFCCB88F88609E9E7E9208
                                                                                                                                                                                                    SHA1:A5D40EF3582CB71631D493CF71D5DD559390F640
                                                                                                                                                                                                    SHA-256:BE0CDC13C30DCCF963644AB6A60DE77ADBE5A87B8863416032D7184F94604B73
                                                                                                                                                                                                    SHA-512:A96F732BA06E36763FD1269BC8AD005496C80F15A971FCD93748E7E35558200E80263821844FAFA9938C39363C83360151E4581FA7A7B0CB87124A8A4A9B2BA3
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK........"..B................META-INF/....PK........!..B.s.`w...........META-INF/MANIFEST.MF.M..LK-...K-*...R0.3..r.C.q,HL.HU...%-.x...R.KRSt.*A.......u....4....sR......K..5y...Ct.....3. .pT.cQr..B..././..PK..........BX...U..........swt-awt-win32-4332.dll..\..8>..0.....7.......$ ,bduqa.( .5.".e.?.(d.2..m...M...6}I.I.....IL.15&.$.\..`...2.s...Gc..y}........=..{.9..?3Z.......e.9.(O2....n..?.f..y....7o.v.T.*]....6.....Wp.{..._n()7....6V.;..F.ph_.{:....~Wqo..U..;.|.Sw/._zj..)L.n...[E...K.....S.e.:'...j53L.*..t..Y...&.Q*.a*!.VI...?zp54..a..?.3.Ca.>}.....R.A_....a....0.,..&.c..t.Q................r.-...GP%3H..1@....".a....}}0.@..s.0f[$.<....5pMs]U...........s9.*.p...}@..[..M...xn<7.....s...xn<7...xr.....\..Xe.5.mf.fT...]...9v..C..sV...".}R....J..`......9..R[a.A-"..Z._e....'..F...._.U0.[...rD8$ N>....3...w..zH.o..2.(.....C)]/m.f.....z).........3.Ek...j...d..?.4.....c.*1..R.w..F.7.4..?....)OWW%.2...1>..@r.ZL.b,...B%.....O.a.....Q.\.L>.d....W=..

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\is-USSVU.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Java archive data (JAR)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):644786
                                                                                                                                                                                                    Entropy (8bit):7.863056343477929
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:12288:wQ4mD2FtBTGR6M7CSAMKt/vpVZ645KiAJAE7A6p9oNE/ym2tSR9uoIocxDJpPacq:LJ8TGR6M7CSAt/RVZ640A8AtqyjtSR9z
                                                                                                                                                                                                    MD5:F4E43E7FA0514A9BC88968D64A6322D8
                                                                                                                                                                                                    SHA1:C878E2AA82DE748474A624EC3933E4604E446DEC
                                                                                                                                                                                                    SHA-256:FB2C9953AB2F8A4AEE38B768C0615E2917DB65106FD6466133EA12AC05BE7F69
                                                                                                                                                                                                    SHA-512:AFE9D231FBF5FE16A387FC29F678C0B474D733E7D9945344786B3A7AA617C24F14B6A06B26B069A493A5BDE8A9C5AE8A226E2BA02244484000024D3887C1D1C2
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK..........FA................META-INF/MANIFEST.MF.....ZKs.6..{....[g,..'i...q|P.v=...C."!.6E......HJ ...t.........BO4.S&.......-...OO.d..J..'|.Y.....q..........%O....?..].s..|.F_....,.S.m.a..l...X.B.=.....y.?....%.S.\..Z.).)."SA.L?].y<?=!d..B...]I.V,..2.9)...bA....%.a.%2.)...).$.[H...6"d.H!..O....:.J.X..$S.Dp.K..f.\.Y....eL@R.b........d..%.\.s........h.~~...8%......?y...[2W....X..FT.)...b...,.l.p.^....x..?<...].p..>U....z...|..}......b...r.lT.....X..).E.,V.Z..2....F.K4t..(z.\O^..g.'..t...otfQ.B..Fs.......L..O..y...^.q..rn3-.....@..$.v..Y*.v....+..$Y_...+..L.7.v1...M..m..T....C..}Z.n.|..~.0v......I{.5V.Z._...$..y..lf...z..z.T.=n....KX.%l......$.0%..,.S&.-xj.k..KWM.4..n.!.,.3b....H........XAS`..5....$.,.la.Zp.<..b,V.vX........$...5...u2.......l..q.;.5.IN.....Y.B..^tc:..]...... ...0..i.TN.J...e...3....B...}.TeT......h.sR..h...........mX.T...33.....$5qv0..u....,c...l..N...s......F3CL...l..!.iT..k.~.....?F....`...B.eb..'.Z7..Z.=Q..........#.....

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\is-V3I59.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Java archive data (JAR)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):923051
                                                                                                                                                                                                    Entropy (8bit):7.833376891937756
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:12288:t+9n8UzjW1ZobzyUsp6Lfzp+w0Pcv6EVuUbYR7lzllbac63TfDDk9O3wzjc:tELWwb2Usw+w0dUbc7Ltf63Tb49uw3c
                                                                                                                                                                                                    MD5:45A0E5EF9EAF0E00F578176E8A7F497D
                                                                                                                                                                                                    SHA1:443DFE312ADCBC4B88A87841021F358CF8D12676
                                                                                                                                                                                                    SHA-256:0539D49BC757335F6426567AAF6C04CCD914075316636A8FDC3B657F2BF79E4C
                                                                                                                                                                                                    SHA-512:56CF5D8A950891EDD06DC15F1C9DC1780C94E109065E8BB8ED07768E9959C9B0D0089ED0FE7C841D22FE574F41D94F6ED756CC3C10F603920D2B043C74C80287
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK..........lD................META-INF/......PK..............PK..........lD................META-INF/MANIFEST.MF.[Ks.6..g..a.Nwe..4Sgrh.N......K..ZK...#i.../@I.E.$..%+..A......ev/.v.E.MV..ur~..}.Y....6.}&7....W?]]]........,.>m..7.......v...z....K].U-.\nr..(...v.Z...H.Z..Y.d..]..Y.......n...m..>;{zzJ.Z..L.8..n.T....h...yH..A$.l.v..<K.>|.x..o.o.....................V....Z......@|7............./..T...O......&'v..B{...PK..2./;.>..8.r._|...........g.~.[J.N.$+[Y."O......m.X<..7.9y..~w..=NZ..j....a%....$......\..2 5..%.*/...&..ei.D..}......^B!JP..0.t...%. ..^..yz....q.Hb....C...N.;N.5@.)...T..T.H.].....lkj...y!....gng..c.$.7.q...........++.). .2....A........=....SE.'...H..p.....A+..|..1... ...]]..^....1Z....E. .$... ...N....UE.....b..w....I..L.3z..f.B..G...5H.6..e.F..,.L..0..A..z<.I%.^...6...s"CI....XW.<..?.$....~...7..%;.-...|..U..@R?..Wn.sL`.)...W..y...>.1.. .;.......A....9.a=.H.B...C{.7C.v........,...IGpJ_N.}|p 6.[x.....\.....P. ]..r5O.S^

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\is-V7MUA.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v1.0 to extract, compression method=store
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):313898
                                                                                                                                                                                                    Entropy (8bit):7.924530998596858
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:6144:A/iLiO9MdO+3sBy0uxWi84FLOUDvryzEDT:AJO9MdJ3GuxWihyU/T
                                                                                                                                                                                                    MD5:4D8F51D3FE3900EFC6E395BE48030D6D
                                                                                                                                                                                                    SHA1:5D3CCC056B6F056DBF0DDDFDF43894B9065A8F94
                                                                                                                                                                                                    SHA-256:593552FFEA3C5823C6602478B5002A7C525FD904A3C44F1ABE4065C22EDFAC73
                                                                                                                                                                                                    SHA-512:E3737EF4A1551E46410916FCDA298A629B2681D7469CEAAFFFD668E6055D9C0E795BC9D12EA3300D218981D5AA5B2F38BB2E641211997C962E6086068F62AD67
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK........gr.2................META-INF/PK........fr.2................META-INF/MANIFEST.MF...n.0.........k.....D.JT..Z...&.#.Px{...8q..vf..:kh....z.B_.....2n0..D-..j.RL.!.N&..........g..[.....J..Bi_....N.l.Gj.....:F..L.....]6.[cs....\.=Ha.-.....P....x...9.C.D.K.....J.Y.TT.........3?U_.).PK.....'....h...PK........4r.2................org/PK........5r.2................org/dom4j/PK........5r.2................org/dom4j/bean/PK........5r.2................org/dom4j/datatype/PK........5r.2................org/dom4j/dom/PK........5r.2................org/dom4j/dtd/PK........5r.2................org/dom4j/io/PK........5r.2................org/dom4j/jaxb/PK........5r.2................org/dom4j/rule/PK........5r.2................org/dom4j/rule/pattern/PK........5r.2................org/dom4j/swing/PK........5r.2................org/dom4j/tree/PK........5r.2................org/dom4j/util/PK........5r.2................org/dom4j/xpath/PK........5r.2................org/dom4j/xpp/PK........4r.2.......

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\is-VQFQI.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v1.0 to extract, compression method=deflate
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):264785
                                                                                                                                                                                                    Entropy (8bit):7.897696883855234
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:6144:0a0D6hXyP/8pJ8tnugoTyJfRGUVSRjwD2uxGJTkhe4YgXRo:0hDN/8pGu/TyTGUVSP4he4o
                                                                                                                                                                                                    MD5:7293316EA767B28CB92C1B3914CF6C7D
                                                                                                                                                                                                    SHA1:BF348043CA72015C4C6EE2B8C28B07B87A61AC3F
                                                                                                                                                                                                    SHA-256:53C78CD7EA3D41013F2CFE6750448CEAA29102EDF0034A2C2515BD9A4492EEEB
                                                                                                                                                                                                    SHA-512:383F2C29B832D97B15D464E7B107588FE097F9B13E2B4BFFE7C4CFFD106F977736FAA166F75CE73FE2FB07F6361932B4AD1D14BECBA1066E468D2AC5ABD5FD66
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK.........O4JT'......6.......META-INF/MANIFEST.MF.V.n.0.}G..,.&......T}h..ZA../{...$n....-...$K...&.B.=.^..{...lA...h....r..n]."...F...Xg..T.5Z. ..-dR<.<t....)d.....9.sF..y..BQ.EZ.^.....IL..b..}./...f<.{.X..O6b.-...Y..x.....!...[+..q......g..wd.Y!....._.w..954...C...`..\.9..7..qm].=.B...@..(=..[0..p..`......dV.\R...=......w.&.D...h...............#X-....C.m.-S,..D.k....R.....6..:02~.....O.NdS.L.2...@&.........B.\EHk..J.../V...._..'...uN2..W..>a..]......q@..s...x....1.l!.<..&.RYI.......p.D`"....Q}....%4.8x..r...B.M...B.(.$...*&...9=3.4.T!.^,..h.]v._...|F{...0.=.&..d=J.1.EN........S....... +..v.......5..i.d>u..+....(.c4.)..[..c.6..s..K..y<.^=....i.x.1.l.=gY..xv.x_...Z..<./eX.|...g...J..{..*iL..'..%..x.2............y..5..X6.}&.@.r..sh..m..y.n.|.........K~u.D....3w..>an=.u...k.....l....PK..T'......6...PK.........O4J................META-INF/PK.........O4J................org/PK.........O4J................org/eclipse/PK.........O4J................org/eclipse/jet

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\jackson-annotations-2.6.0.jar (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Java archive data (JAR)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):46968
                                                                                                                                                                                                    Entropy (8bit):7.595755124084132
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:768:QjCGDsHftDENRY1ZX6sUfHhUimsjayK7ND24wplH+Khu:QT4/yN1P/hUiPU1
                                                                                                                                                                                                    MD5:B82283550745B69DD95E7D835714E971
                                                                                                                                                                                                    SHA1:A0990E2E812AC6639B6CE955C91B13228500476E
                                                                                                                                                                                                    SHA-256:03348C047D981376CC444FC466CD80BDA8D7EB0698DC6A99DD52C5AA15EFF5AD
                                                                                                                                                                                                    SHA-512:F3D8E800CCDC56D805068D6644FA3D4316A933E49CAEDEF0918925330906C9097664DCB8C4150F3726CE37BAE6B5DD459AA2A2CAFBF5CF85BC67CDCB0D21C081
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK........t..F................META-INF/MANIFEST.MF.....SMs.0..3...p.i%d .:..:..L&.Ln.a-F.-........)i}...}o.w.B.%..>.M..>...V......j.@b....^..o<....$.......N..:z......ZF@...V%n.o,...A..R.. ..X..Q....H.....E.V+.h"..d..T:$..E....?.&>Y9...F..*[....8....+oftY3Q.....f..v^.36lDE:mLF...lH..3.ue..`^.].L=.....Bz2o....A...B.r/t.G. ..[8>.6y.-..I9.I.u.?. ........L..4)..1.B.......>..~$.M.. ...D.je.'...<-6e..{.w..%....n>s..*.+.}..;....".H....U..>..LY.}....C#M.*.p.....j.O.C.7.k1.^..x.su........z..0.{...1.O.Kn..n...........B.&NT..&.....>...ij.l..$..PK.....B..../...PK........t..F................META-INF/..PK..............PK........q..F................META-INF/LICENSEM.1O.@.....O.Z.$...B...2...8....N#.=G)...?..C2D.. .v.O&....Q%..((gq.$.P...9...r...8<......gR^a.[Z..je.O.#..R....*4...+.....@G..m2.t.~....n..P{...1u)..(..m.}9..B.EOV..!.>.X.....w..oB...M]..\.U.........>....PK..e.'....=...PK........t..F................META-INF/maven/..PK..............PK........t..F.

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\jackson-core-2.6.3.jar (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Java archive data (JAR)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):258875
                                                                                                                                                                                                    Entropy (8bit):7.947801994952566
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:6144:TKDTD6A2ES+HaRzz+ZIHWV8dDw/p5JTAhzYGuFl4F1w:TKw3Q0fEIVDs5JMhz6Fl4F+
                                                                                                                                                                                                    MD5:A9F7504E534420911FF6AFDC1019CF5E
                                                                                                                                                                                                    SHA1:0142CE64DCD709A4B5F6E7D71305A31D3893D077
                                                                                                                                                                                                    SHA-256:6184DC12A30BE189D7417CB619A2143762FB9A6FECC35707F2A31FB2B280C1E6
                                                                                                                                                                                                    SHA-512:7E1FC3B402E2ECD9E3D3C2E1BCA50C6287BDDA76F45F0C110FF80BF10CDD439B867E959AB8A9F6D0EE81F17764E460CF3D8FF27CFFBFD72DDE0057BDC8E4931E
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK.........PLG................META-INF/MANIFEST.MF.....TMs.0..3...p..4.6..1.!.:....i&....Qb[.$....b.............)...T\D62.Q..G..S.'..K.<..Z-...v......<.xo).C._..,....F..$..y....\.c./...!..oJD.....M3..-...r.?....<...l..%..8`!..0........VZ...}.W.."....L.L....v...9.......l6...]1"._.....G..t>..b...G..`...15.!.u...w.B@...2.r/s... ...R...E..6:..$.X.Y...>..]..O.&t."...,H|.6......../*....E.&.......%._..0.....$!C.?k...H\\.....P.....v.J.....2+.<u..R..r..g.t....a.ml..l .c.....j.........a.....G..*`.....N.d../s...a...9a..M..T.T...C.t>.U.1.U../.....'.C..x..+}.".Q.6......n.m.0,.S....c....H.ag..N.4.D...I..PK..Ba.m=.......PK.........PLG................META-INF/..PK..............PK.........PLG................META-INF/LICENSEM.1o.1.......$..:.U.C...u..K|w..D..S.}.........9.B...r.;.G..v.....@.Y@M...((J...H.T.O.()E.R$.....#....(.......$.5..?.rQ........F..H.|R..O..k..&.z.....0.[....s.. 4..k.Z./h.s..z...g..]uO../x.G.87..M.........Z......n.*...PK..........L...PK.........

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\jackson-databind-2.6.3.jar (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Java archive data (JAR)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):1170801
                                                                                                                                                                                                    Entropy (8bit):7.925893185663666
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:24576:fdEpJhbhgR0gbFxlo/W1dtxRKqzk9fmb0Pxz1mGfCMvaZRq:fdcfq0gBxDDRKqzk9S0PVdfCwGRq
                                                                                                                                                                                                    MD5:39499F57D90A208FBE67A3E91F5AC058
                                                                                                                                                                                                    SHA1:5C4FCAE53DD82E2C549B8322D78C6FF47C94C8A8
                                                                                                                                                                                                    SHA-256:593FFBC1EA15E200D734CBCA1829EB8680AD301C058A9F9E7714CF9FD9E731FB
                                                                                                                                                                                                    SHA-512:ADDA3F3DFA83AE36CCD350DA8B7C176D21FD3AF6B684C62054F2EC466918AD4B60BFA5C603F142DC77BF139A522A113658811D3BB7D56F7C5B2A844FBCB37CC1
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK.........[LG................META-INF/MANIFEST.MF.......S.0.......p.s6.....A.o..q.s......m.^...M...E.....M..!.lB....TLp.9.V..o...C...>.7..V..:o..u0HX.[}...ml.m....u.p.&:1...R.*O.X..?)....'.Xc.}..4I.g.I...M.D}.)c?..ZA...<!)RZR......Cx....z.:vk...d.=..na.T>....L3g..\....f...{.X..f.6.u.w..U.6.s...e.....;....e.j..O...X.~f.Q.I..<....f..T.r_H..[.YE.[.Q.t ]...\..CC2..e..>L..I..c!.u..IP..*..i...(ust...f...p..\.T.o.....$....**3....0...#(..+.#AK...X:..]#..)(.F1..P1...?P..~...NQDv.k.T.........B./...EL.M.(.....G.O..)H..\.e...2,?.{y.......[s..!.....D..AV+=..F.g......`P.l..rl.#..m8.s.......n....B.......f...=JkQ}........4.....)c.....M.e_?.9c...,....J....S.I(v..=(.l..b'...m....~.......Y.....c,......F8T..dJ.9.......A...31..H....../a.Z.h^..P..*`..l....o...>...'.e8.ur.Wo./.t{.'.h...m.l^.G!B.......Q..n.g.m..v..luD.3.#.Dz....2-fk}....PK...m.r;.......PK.........[LG................META-INF/..PK..............PK.........[LG................META-INF/LICENSE

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\javassist-3.15.0-GA.jar (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v1.0 to extract, compression method=store
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):648253
                                                                                                                                                                                                    Entropy (8bit):7.946545767180688
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:12288:z4ziuYTgkeAYxmAe80a7f5ZPKJT32wzMr5H//WRlzsDM0U0Ao2Fei7e1xIIh:eijTgkeAYxmhi5aT32wQ2RlzKPA6r
                                                                                                                                                                                                    MD5:2FCAE06EEDCDDD3E5B0FE32416F99C1C
                                                                                                                                                                                                    SHA1:79907309CA4BB4E5E51D4086CC4179B2611358D7
                                                                                                                                                                                                    SHA-256:EEEC97D5987DC8D525285FAB888BAB4C68A2EF1412335F73ABA2B804F88A6CB5
                                                                                                                                                                                                    SHA-512:CF9907EF316EE01A61F7736B20C5549B29785B7C801B1F8DB693B9A7D5478C9037719369534CC2B36C16457AE28C3F976E06C6137BA9E6B708808AF0BED7BAEA
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK........o..>................META-INF/PK........n..>V..1............META-INF/MANIFEST.MFe....0...M..}.V.x...LH0&..f...b1m!...?..uf3.f`.B.e..QkB.....5.h.x..s.#8K,.G-.{(.h;..t..........2..1.R.}..,.bI......#.`(R..9r~..4...S...K..3j.q....4C5..O]%..8.l...Q..=.PK........a..>................javassist/PK........a..>................javassist/bytecode/PK........a..>................javassist/bytecode/analysis/PK........a..>................javassist/bytecode/annotation/PK........a..>................javassist/bytecode/stackmap/PK........a..>................javassist/compiler/PK........`..>................javassist/compiler/ast/PK........a..>................javassist/convert/PK........`..>................javassist/tools/PK........a..>................javassist/tools/reflect/PK........a..>................javassist/tools/rmi/PK........`..>................javassist/tools/web/PK........`..>................javassist/expr/PK........a..>................javassist/scopedpool/PK........a..>............

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\javax-websocket-client-impl-9.4.1.v20170120.jar (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v1.0 to extract, compression method=deflate
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):159466
                                                                                                                                                                                                    Entropy (8bit):7.836744062657023
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:Ik/GZmHTRUTAjeOjGsmhzGmxDEgZtmKh9XZQgOOd:IR85zjv6imxDEgZt/rXZQM
                                                                                                                                                                                                    MD5:CA3787D5C84695976559A211BC6FC12F
                                                                                                                                                                                                    SHA1:4E7F2EB46A22E8E23C18502E0D9AFC667961FEF1
                                                                                                                                                                                                    SHA-256:1EECEF8E88247FF3BCD41693F7B40A0DCE6BFE7671980E18B962F0B0E1812EDF
                                                                                                                                                                                                    SHA-512:DCB57E8546BE15418C1251CBD4DB99EB65765A7DCFE179BC93B6D77CC4DBE2E28BBCDDD9531CC04338B668F9013DBC7B831E16E802AF19F9E3B98C3A2F5A9288
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK.........Q4J..~.M...........META-INF/MANIFEST.MF.X]o.8.}G.?X}X..1.mY...[...`...y......6.......$..!qRU.hr......3..g.....J..%.....U.......H'/^...7.....5...CM>/../..CXn:....w.B.......(....T..~..V.......5.vo.....a.H.x.....T.G..vl.-.|.o..../l...>...Zo..?.H.S..N..zE......3Hd....7 .W....L....>.w5....F.+.vr.f..9. ....Y....w.p.I.......<....CG..XF.X...6.H..2.....5.g...j.h...#h@..Gew.,.._..C.W=Q..../c.LR.y...1./.KU.e.G.y...y.N..;........^...r<...[....F.!..nj.......X)e.$...."..o.a...!.Ds...w...<`.Z.l....}Z9.KcX6.>.L.SK .K....x..)_c%j..'H(.C...W.....>.P.j|..j..$.k.9A..((....yZ.<...e.#.?G$.....O.%T|y=l..h.<.........(...\....>0...&.9.0.....H..,.....C4..2.iv..`n......D..5sk......QA.9.]~.........gwi{.8.RA..@.U..5...... ...h........a.HSh..C...w;...!B...k.M..P2...Lkd.H.t. .........*.S+...v...Q...%.%..[^...@..o.."ht...3<.....e.....de.6hs.c......V.SH.y/g..5J.,.j{Y./....I..xjC.D2..3.l...4..r......@.*...F.].}]<o.]..L.l.l.....;..N.g!.B0.,#Zx.c....]R..S...i

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\javax-websocket-server-impl-9.4.1.v20170120.jar (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v1.0 to extract, compression method=deflate
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):36145
                                                                                                                                                                                                    Entropy (8bit):7.837112308649389
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:768:856da1kcDKbHUltjxTgiZRt/B5FSiq4q0frElma6aSaJuTTAwIlK:1da1klb0XjxTgiZD55FSz0QlnSaJuTkC
                                                                                                                                                                                                    MD5:2A9B4C10AA92EA650B8DF3CEA990BEF5
                                                                                                                                                                                                    SHA1:D44BF488435FD0D0355FBBFB63592188922F3907
                                                                                                                                                                                                    SHA-256:602A1B57FC53F301D3533D0A5A3FE29325F23974ADD955C88616154649A52A51
                                                                                                                                                                                                    SHA-512:F3EE1F2ED54BDE6F7E1A49B02161657F7374438B44C24B5BD9F00AC56C9830AEADE20F032CEDADEEDB5CC9323F206A9697E50FCC541333D6B82C41EB0068E856
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK.........Q4J\.i.@...3.......META-INF/MANIFEST.MF.W]o.8.}G.?Dh5*.1.........V...yX..-.5q.6....8....Q..{...........v..TL.....[...w.B....\.$.v....Mh8."...k..._..n.x..m....9K..7........B...d.....g.._....}...........@.W....g.r..P...{...WP....#wB.....0.0...m.....>....K&!..@..X.q.bR.&..y@...O.9`$..d.9...u.........TH...5..j.5.g.#f.Ltd.s.)...&.R.k...l./.$t.i.FgX"[..<.=X.E..~.....%.[....q,..&.Z..Q.!.t.........q......(..'E..(.a..2...r.<.a.E..fa.A...~|.. ...3.J!z..F..<....@.V..yjA.|h...V.a#O....2.~......r7.\.&.2Js.z. I..n..j...dDT(....f_.dO...3z)."O..I....dB.R....8.."O...(....Y.....l.......Eh.:.>......c..Wp.c..ga...).m6...p.?3.4.L.f......d0l]....O..........3......HP..S4...|R.$P.......y.......m.|.b..8......W.Va..j<.*.8.. .c....?..N-R....?d..r.u4:ya.?..RR-$f3.(.....f...,.....(.A.N.3..4...*...lV..L.......y6.].fe...yv..(..Zs..G.VKOr#OQ3....-.T.Pe..iTA.R.;.$..X..w.w3..y.......]]....r...mF.[...^H.........<T.5...s.@....G..l...B.Ru<.G........

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\javax.annotation-api-1.2.jar (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v1.0 to extract, compression method=store
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):26366
                                                                                                                                                                                                    Entropy (8bit):7.842351935385798
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:768:/y9sH2UybW4C0kHr0PneJElcriWIC6I6iHW:/UsWDbrAr0PnEEl0nICy
                                                                                                                                                                                                    MD5:75FE320D2B3763BD6883AE1EDE35E987
                                                                                                                                                                                                    SHA1:479C1E06DB31C432330183F5CAE684163F186146
                                                                                                                                                                                                    SHA-256:5909B396CA3A2BE10D0EEA32C74EF78D816E1B4EAD21DE1D78DE1F890D033E04
                                                                                                                                                                                                    SHA-512:2453330B27A0822BBA440C28B98AE1D83D60D97DFA2D040562DD5126B3548E0CAA040FEA3B886AC6FEB0A858E6C1BC45B6C5472B180F1F14792E5CA33E355959
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK.........B................META-INF/PK.........BvJ.Y............META-INF/MANIFEST.MF.Qo.0...-.?X}j.....T}(.UTaCk.../..3.A..gS..E.....s.....i9...`.4. =.a.iU..)./l....lE...3.d..W..I..'....o....?......U.....8.-.h.H... .TL...j.r&.N.....j.W@..(..F.....H2....".i. .....v:.hh.y..7{.f?.>9....u..p..s..[.YU5Z.uG...&cQ.c.t.[f....cT"../.....d.O... X..//......y.ZM...Z.K..]..vE...P.K.)R.>.F.eZ7.J.t8....%]..T.6.......{.89.@..hw.b......\.........Y..ox...........Z......B....R...;..1..|!.,{.S...].#.~.PK.........B................javax/PK.........B................javax/annotation/PK.........B................javax/annotation/security/PK.........B................javax/annotation/sql/PK.........B........... ...javax/annotation/Generated.class.RMO.@..U...........I.zZJAb.M)$..Y.JJJk.._....G.gc".4..7....Lv.......PQ.L......K.E..a.z....=.O.=....@b..........@0..~.?...............^...o...d...!.Nn........p.._...rm .m...Io>.......d`...?.3.\......T.@9^a.p.........

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\javax.inject-2.2.0.jar (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v1.0 to extract, compression method=store
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):5968
                                                                                                                                                                                                    Entropy (8bit):7.420202245950754
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:96:ysd3ChF3diMcH7VwompefEaAZUWlAM519A9FqC7m8OeImV/6X:5dcK5dYefjACWlAM5eEW6qV/6X
                                                                                                                                                                                                    MD5:5F45BE14F44B1BF2D1E50E2C494C9315
                                                                                                                                                                                                    SHA1:2A9E23E3D64A93ED7BA5515E6169F65F56965292
                                                                                                                                                                                                    SHA-256:83C4ADF34F487D258CCB123980E8E87DACD63FCD5A0DD5B59837D04E3156014C
                                                                                                                                                                                                    SHA-512:CE2AE77998540CB0CC5B0ED1129C35167B5219EB1770ABBF35E4E4F50A8EB80417C55D51F8984554D1824BC727B3F67CC533BD39A0E247C342BB9C861325291E
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK........@l-D................META-INF/PK........=l-DR..J............META-INF/MANIFEST.MFM.[o.0...#.?.c.U..KK........l...=...l.._.......9.*.E./4Vh.BBza.z..qQN..0.oz.'".72....N.`QV.KT.:...$.&.....[..`...Z.0Q<JH2.p&....?...Ec..0..........W.$`.j/.@-....6.!.@z..A.7._,....Z....u.~....n(..6>s..=.Go|......;.5d....>OF.[j......F/O?G..h8.B..Uw..(.......U6...n.-.<...J+z..z#....Y.c.g.d....w.....2#*.@......Z..[o..:,o.s...}.mv....>..C..$.?A....#k/....G..B..16......r.....A...?PK........=l-D................javax/PK........=l-D................javax/inject/PK........=l-D...............javax/inject/Named.class..MK.@...iS...zR/E/..z*TA..z..e..d.._.......=....af......K.h.h.h..3e<.....j.b..$..B.....6w....x..q...A.o..i.W....j.Q.....R..W.p....k;...O^.=.\.._..&....:..s..I..!. .......].0y.?.._...vZ.BhVm.....xe...._jbu.1......$......a.......)~Kl[.....oPK........=l-D.R..............javax/inject/Qualifier.class...J.@...Tk.j.\....K.n]..P.I.. .d..e.tR.I.......;..M..;..;.

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\javax.servlet-api-3.1.0.jar (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v1.0 to extract, compression method=store
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):95806
                                                                                                                                                                                                    Entropy (8bit):7.852873716063267
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:1536:mtzeg5uZYCaY0D2oRqwaO/pgnKqG5JQrHnr0PnEEl0qDx+HD:mtzu70D2oSORgQ5OrAck02xWD
                                                                                                                                                                                                    MD5:79DE69E9F5ED8C7FCB8342585732BBF7
                                                                                                                                                                                                    SHA1:3CD63D075497751784B2FA84BE59432F4905BF7C
                                                                                                                                                                                                    SHA-256:AF456B2DD41C4E82CF54F3E743BC678973D9FE35BD4D3071FA05C7E5333B8482
                                                                                                                                                                                                    SHA-512:32F7E3565C6CDF3D9A562F8FD597FE5059AF0CF6B05B772A144A74BBC95927AC275EB38374538EC1C72ADCCE4C8E1E2C9F774A7B545DB56B8085AF0065E4A1E5
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK...........B................META-INF/PK...........B..{.............META-INF/MANIFEST.MF.TMs.0..kF.A.S2..8m....m...z....Q..#....].@<...U.....Z2)6.X.;.F(....1.....E/l...lG..e..ma...FG.4.&.".J_...H.cR*.,..n..n.S..]...U"....QO*.R..1Bbm.w..-.<....c.W..hZ..:.}@L"..I..9..FDm...........`q...I.4 S.;c:...I.'.;.Y..?.6.n..........&..{:....l.}.!...)3.0..eY!..h._s.E....t[.l......y._z.........2.`..}}..7W.....[......B...4.V5U..n'.....|...J....TD.l>..=.B.z....m~X.....iy...Z..@ Kl%9..p.}..{o\..../<...C.$.N{...?...g...j6..a...S.......c..9......Zz.V)......0..PK...........B................javax/PK...........B................javax/servlet/PK...........B................javax/servlet/annotation/PK...........B................javax/servlet/descriptor/PK...........B................javax/servlet/http/PK...........B.b.a........+...javax/servlet/annotation/HandlesTypes.class..OK.@..........."X..s.."....6...6.a.v#.M._....%N<.....}..........p..........\..ZG...X.2..........*6.e)#[%....S.

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\javax.websocket-api-1.0.jar (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Java archive data (JAR)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):36611
                                                                                                                                                                                                    Entropy (8bit):7.580265692066697
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:768:v03vilnIEjwkPyHdX0NPFarrL6IIqIvta+xXUf:v8inIwwkPy9ENPF8rL6Iqta4X2
                                                                                                                                                                                                    MD5:510563AC69503BE2D6CBB6D492A8027B
                                                                                                                                                                                                    SHA1:FC843B649D4A1DCB0497669D262BEFA3918C7BA8
                                                                                                                                                                                                    SHA-256:DD93009FB5AA3798BCD9AB0492A292DDAE0F0B1ED2E45A75867A9925C90E747A
                                                                                                                                                                                                    SHA-512:63832BDFCE55C1014D0EC6C7B8019FBFF5E8503FDCB19E93AA6F21D2609EBE50EA9A8C1C36132EDB9E5064B909C669EAF02C91624B54D9E9504DEFEA808E5DC7
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK........(i.B................META-INF/MANIFEST.MF....m..n.0.E.H...m.....b...@.E..%2....m.....&U@.]t....O.`.06\.6L...V..D......A..F..w.q....80...l....j....s..9....8.#0T3e/.'.9j........h#5...B.=.k....4A;kU.E...KM(.Le^R). ...q..c6......H...h8..O..t..b...u.._.e....Fr7.....G.~..Y..t...].........Jr.".:A.;n........c_...4ui.T.h..[&....%..g.....1.6.......U..0.......+......>..Z..C......Z(..!.G..)y....q.._PK...uQ.p.......PK........(i.B................META-INF/..PK..............PK........(i.B................META-INF/maven/..PK..............PK........(i.B................META-INF/maven/javax.websocket/..PK..............PK........(i.B............3...META-INF/maven/javax.websocket/javax.websocket-api/..PK..............PK........(i.B............A...META-INF/maven/javax.websocket/javax.websocket-api/pom.propertiese.A.. ...;..g....&=.5.<.....*.B......u.+E*X.. ./1.}..(.*M..P..s..0.q..@..:.......{.{.P.9.QK%|I-.....W.%3'..*.T.....af..PK..R.=.z.......PK.........B............:...M

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\javax.ws.rs-api-2.0.jar (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Java archive data (JAR)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):112758
                                                                                                                                                                                                    Entropy (8bit):7.770520014653803
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:1536:RplFldF8ftppehYWOD4NoiZvI5Sv3dAVgS8b+9wA9puRYi0DjgkUSqFD:ZFzF8tEO5iRIs1d5GNHeB038
                                                                                                                                                                                                    MD5:3BC8176D36BECB7746E1F2594346ED66
                                                                                                                                                                                                    SHA1:61F0983EB190954CCDEDE31E786A9E0BD9767C4A
                                                                                                                                                                                                    SHA-256:CA88FCB9CE85AAC4F77E42EAC486AA7FDE6EAD6A545D74CCEF6089241C84DB53
                                                                                                                                                                                                    SHA-512:D31A783488CD7A0E7FE96A5ACE4B4B7E5833EE0E942EAC0533B5CF8B21AAB83D32CBC72C13B43A1DD2C3AAD4921238740A12408495E99E832090F129C77295D4
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK.........B................META-INF/MANIFEST.MF.....TMs.0..3...p.G,.@1...L..Z..7F....%.$..}.P..Mo..{OO...2%.`......"..\.W.7`..u,..b,W.ZX.~.\o6...2.z..j~p...a.....$....3....ac_t...".4.Ns.LVU.........C...i.zd...?L..+I~..L....K...?..........,.K#..l6T..%P..... [Y8...Y;.vI..T....L..w..../..4..t..y.s.%.......>N........Im..Rc=..cw.Kf.....@..D.[~k..&..d.,@.'g.w.0.q.H;e|.d....MFr..H...K..%.....l.>>.K.........*...a.X.....K@2_w..Uy..R.r....Ske..J.D.|IV+..sI..B.k|......3*.m".L..2...S.,f...*...b.P..h..1.....e..t.........:.K.......l..j..r~.L...6.ri...?.?......G.eD..]HkAVy.PK..............PK.........B................META-INF/..PK..............PK.........B................META-INF/maven/..PK..............PK.........B................META-INF/maven/javax.ws.rs/..PK..............PK.........B............+...META-INF/maven/javax.ws.rs/javax.ws.rs-api/..PK..............PK.........B............9...META-INF/maven/javax.ws.rs/javax.ws.rs-api/pom.propertiesU... .......q.&

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\jboss-logging-3.1.0.CR2.jar (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v1.0 to extract, compression method=store
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):60539
                                                                                                                                                                                                    Entropy (8bit):7.888122896079115
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:1536:q1DQIG0KGzFfM4/TClQOofclslqC1lkM32qOEkjwMwtlk5lyl3lD:iPxROoGLqOZi
                                                                                                                                                                                                    MD5:319DBAB9B6EC1AEA0BF790A55133386C
                                                                                                                                                                                                    SHA1:28725380C07F917ACE4E511DB21CC45E9AE5A72B
                                                                                                                                                                                                    SHA-256:5BFC8DAF909D332F622CB0F42E425EC7CDFF55A3C2F4D855E2CD82566B0E776D
                                                                                                                                                                                                    SHA-512:AAA9CBF63B273160E72BAE342B8BB30611D21C5DCD21743F4FB42544C013DC6CC7E7E5E2C4EE2046B9D8742AC5F4DF6336983373EFCF6DE239637A7F8C24CBC7
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK..........v?................META-INF/PK..........v?.qq.[...........META-INF/MANIFEST.MF.T..0.}......Jd!,..!.L[...........cG.....$..dFj...{r.2...Di...........W..tG.....!W..GI.&.........=.a.s0.H.uT....9.>..(.L....(.....%...A4..jS.]R.H.&#....$.<....a.3..yx....'......-r....`...VI..i.HJ.~..MX......;...2.6+......b.<.F`.u...~.?.2%m..!.R.O.maB.x.rET4t..).&Z..#. .-.&...)m....2zy9.]%...qlk)....c70.N.S1..3...i..'.Q..7.(<.J..6.AL#.0...~x..u...5FX..........y}V............F..4.%.rMn~..4......R..Y.$J..D......m/M....8.....V6r`..4D\...:.c..908W9.0.c..F.j..F.z.......A.....1c.....a[..i..............4.P.%T.....D.....\..Y?7..g"......7...e...n........./.n.S......o.z.PK..........v?................org/PK..........v?................org/jboss/PK..........v?................org/jboss/logging/PK..........v?o.....-...+...org/jboss/logging/Slf4jLoggerProvider.class.UmS.U.=..pe......T....6.....T|K..D.q..ti.2.......+~..3....&..{wK.N&.w.{.s....._..P.c...{./1+1g".y....&$.M

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\jboss-transaction-api_1.1_spec-1.0.0.Final.jar (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v1.0 to extract, compression method=store
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):11209
                                                                                                                                                                                                    Entropy (8bit):7.378195233199305
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:192:Rkon5uePZuVfsZUCWZ25Zfw2NuH3H5cQf8/coof3YQJHE/d6iZv5faV9U+2AV8Wo:RPn5uAZuVfsZUCW0TYiA3H5cv/Qo6HEl
                                                                                                                                                                                                    MD5:1DF800392C432E449D9A19ED7A8F54A8
                                                                                                                                                                                                    SHA1:2AB6236535E085D86F37FD97DDFDD35C88C1A419
                                                                                                                                                                                                    SHA-256:AC2126DFBCD8D398E4B64CD0FDCA21D2D64FF46E59326004DE2D636B37036C35
                                                                                                                                                                                                    SHA-512:A0F9DA4A2B13B3DE31F3ABA124A81D3CC6BA19CD243759A396F507E7F4E8ED18A0CB874EE3721555386A74D5F6BD4213BD846DBB21DDE420D7E1E995D0BD2F75
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK.........fU=................META-INF/PK.........fU=w.E.............META-INF/MANIFEST.MF...j.1....<..j.=...JW*....4.uc...]...E.B.%....7st......`..`".M..lG../j:..|.8{.....?.L[....;r..{[.c.vz..x.....p/...g/-i[Z.1!.....<..z.Ru..Eq.tM..:.o;.4^.,oB........)aI..0..pZrV..v..."W.MnJ..(...o..=..l..;<.x.....3^.....[.e}... ;...V`k....`..g_PK.........fU=................javax/PK.........fU=................javax/transaction/PK.........fU=................javax/transaction/xa/PK.........fU=.(.g.......#...javax/transaction/Transaction.class..YK.@...d.^.}...b.O>(.....o.8..i".TZ.......x'.m4A....~.Lr......1.8.8....6..a.<..2....z1~...+...k......(..A.g.M..X..T..t.a...g.i.IZ.aR.....V$....EC...k"..B..p.N.L.rO.G.....f.....QE^'.OQ..o...E...j......-...#.gX..d ...EPw...JR.;yK..^...<u.Z...//..z.......o.$.t2..b..f...'.Vu..M...00..>|...C4..4No..%.`.6c..C.x.M.h..J5..J..R.|'.f0...a.7I....X..PK.........fU=:.9.........0...javax/transaction/HeuristicCommitException.class.PMK.@..m.Dc..Zo..

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\jersey-client-2.7.jar (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Java archive data (JAR)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):151688
                                                                                                                                                                                                    Entropy (8bit):7.864915233624376
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:cDxN8qyGsubdxJ3ws4HLn1iY77mGMtB7mX/SpmTSc/Y6xwc:cNFyPubdLg311nEtE/S8TLY6xZ
                                                                                                                                                                                                    MD5:ACA89047D46700B3A1C94BF5357FCE6F
                                                                                                                                                                                                    SHA1:FB973800C0329E5FD51B1B3EA8D5DD8835EC191D
                                                                                                                                                                                                    SHA-256:F3E68C5041AC7B86A80953229DAF68BC6699F2F68CA923A95CB1C4F72BD25B4D
                                                                                                                                                                                                    SHA-512:C55E1038F7B97F91446678D5FE40BD8957EE0938130458091CD7EA67179006AE82E1FFE35D61F4D513E65A60AAD24D848999FEADBEF1522AE3E9204D20B80831
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK..........lD................META-INF/MANIFEST.MF.....W.r.0..3.?x.u..#$...I:.v....M..a_@.,y$...._X.....s./..`K.......SoD.......f.C.d.....drv>...@.......X.%.>....}.z...J....E.....(..$....R..p..x,.9DxE-dG.......6&.....HE..$....X.BC.[q....5y....0.x..,.....>~y.=..Fdm"^h.b....?}...i.........D..(...$4bi$.p. B...$3.N...t.3e....)....b.....W.^....f.......@...j....h.......j.t..w;^......c....KJI......dc.K.7.}g...S..J;...~v. N......t^")..x-..R.t..JUK...&.K.Mu.2&.CV..JnF....FS.#..._'...a.............;a....U..J.2..T g..C.R.i.....S.k.v....f.x...y..5]..^.T=T:...5~. Y.C.b=...<..7(n.'dz&..=hv..1..IT:....lg...v.K.H=.H.`m....OZ....$;o{....f~.F.i.w1o..wD...s..?........]...=+.%.d..0.#.<..Q...rw.}T.l....(.mv.r.....8{.t\@.....J.......n.3....7..V..$Vi{.vL>.....R..:5.....].A[..JM...ST.>..R..ju....W..zW}.9!..u;...S......}S..PK..`..7....d...PK..........lD................META-INF/..PK..............PK..........lD................META-INF/maven/..PK..........

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\jersey-common-2.7.jar (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Java archive data (JAR)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):708636
                                                                                                                                                                                                    Entropy (8bit):7.8681654916385275
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:12288:esKFn5+YGgC5JQy788Ad1cTXX0+/Q9QBNs5NzEt6k7GvTzp:7YGgCjQiMd1cbE+YSLsXz60l
                                                                                                                                                                                                    MD5:057585707B9AC791CCDF4AD20AF5E306
                                                                                                                                                                                                    SHA1:4F6BDF547F1A7F4F140CBFAC42379AD898F36216
                                                                                                                                                                                                    SHA-256:EF9A328928F9C8A63513DB197B858A1CA8C50266F8B4CA4D721F53E3397D799B
                                                                                                                                                                                                    SHA-512:C34863CF1C95A67B0443B18478F0FE18396DD4C5274E6228DA26F025A4882CD27EB490600294427A109E9235108CC6E20E06361B1C395964EEC52A8CA6389232
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK........{.lD................META-INF/MANIFEST.MF.....YKo.6......r+j3q..[.9t..."i.>..C@K..D..R~....%Q.DJr...4.8.~..h.Ds.d..~gRq....8=..'.G..'..%g.<.........../`..i2........fV>,._...+..w)....y....S..B..M.D.....2.G.....S.......<Z..f~~...4N.......,W..R...5y.;JrV.o.........?....2{..u........y.'.X}.).;-.5...g....+by...\F....;..!.._.d...8$..2...H...KF...@..Q[...X....s.]qX......s..k.S.....L.4..*..wg...9d)Y..D<O..sQh.&.."RM..5.mI....I...8If=X.>....w.@2..m.S0MS.k.z]......`Q.E.E.~.*X..B.\-..`. .|.....y...7{......I..dU.$..d%.....YPU.F!.;.,@..d.vI(Bz.JD...W.......;W..Gm+.....w.Y.n.].3..........F....Xy..;.......u..C...t../0.?....O.A..N.w4..5..H......R......3...`..\...0...4x..S.e...R....)..Q.3.!.6........l.X.#O.f....cV...+.>>6....5f.7.l.....A.m. 3.._n.q...n.H+"....J.../q{x.hA&..v.c."4D..1b="...b.{.G&.8...(....qN.w...l...m..".rt...r.Q..h..........O..Z.O..Xy7Q.d\.....aM.4.K... Uy......T.a..X_..= y..Dx3.!..9.Zc.k..}o.(.....p...*.%{.|.l*.......k.1..H..9...

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\jersey-container-servlet-core-2.7.jar (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Java archive data (JAR)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):53866
                                                                                                                                                                                                    Entropy (8bit):7.7778453938519805
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:768:TlvIIwip2Rql6eMZei10S3IlfaJ1GkQzyY6ooWqKoPdg+h6+cySVUHsNeSZOX7rm:Tl8qfM0i1hsfajgeooW/B+cySVxZ2uJ
                                                                                                                                                                                                    MD5:3CC0F2967701C5388D3DA8E6DC7AAD8B
                                                                                                                                                                                                    SHA1:154B384E478CE7D57252A0F1622959EE15C47142
                                                                                                                                                                                                    SHA-256:BCE20C810BB086B101DFBADD708D3F3CC923DC08BB130BE41F0943EDA0C8FE8F
                                                                                                                                                                                                    SHA-512:B731875B657745F9E8DE5727C3EA85823A9494F1ADC0A2298AE1955596E6E157850D94EA7F4506C801442A366B66E163359345FB02F7431B508780BE43BC949B
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK.........lD................META-INF/MANIFEST.MF.....W.n.0....?.....%N.:.I.....M.K..#Ml&.)....}..b.Z...Xz.f.'fE9{...{....p.d2.\..[R.W"`O..||.q.a>...... aa.}.^L...<.N..z[8...oR<.m.. ..../Y.m.o...B.s.r..vf..aQ.B.\S..........h./...nG..~.....-..\A.[.T.'.6.n)..q..2.|}s.|..v.0}.....c.M...x..F......d.....=.L..{...fJc.\.R1.....4p..N..=.@...v.\... *...n.f8..@5..\>.....[.N.wn.d.0..+Ri../t.Vs.+a\..4.H..........G..U......l^sf7...Sd.....Z.uz....'...nk. 3b..0.....|...CCA.f!...yd<`|}.A.J.....Q...)..Tn..sS...H...]!Si..?.u....(....[S[C.*-7...gt.M.v9.z.e..t$.I..*..elNW.(2.`.<r|E.e.2....4.Na....S.k>952.....m..L..d:TS.]6mdyN.e.l.Q>.~fNU....#..,.q.......P{.L..#..K.R-S0{.&....Y.H..fN}w.u..#Sm...Q.+Q.....o....b.......|!A.0...Kao....+.....;'... .)/..i%^y?qO.o.?..hB...F...7....e S....Z.x.C.B...j....5.`.+...4.C]L.W...%...R.,..]..W.....,...7.H.nS{E..V......]........'.o....._...~........N../PK.."..`l.......PK.........lD................META-INF/..PK...........

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\jersey-guava-2.7.jar (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Java archive data (JAR)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):962808
                                                                                                                                                                                                    Entropy (8bit):7.819513341349416
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:12288:JuvOiQnEtrp1F7Sm2Z7UjVfjRZNXPjB2ND3AqYtZPNHCftbMfWFvQzmANJ4dqCbl:EvOXnEHnpfjx94Aq2ZPlCFMSGmAkd7P
                                                                                                                                                                                                    MD5:230BFD0EA66A793BCF57CA7170922C5F
                                                                                                                                                                                                    SHA1:1BB881955553E4FB22904E7FF66B59C6C03A13A9
                                                                                                                                                                                                    SHA-256:8E8A5EF2148C3AC70203DBBFAE5EE08C5426566E3DCA1AF08B12B8BF9F17FCC7
                                                                                                                                                                                                    SHA-512:B673BEFFA5552837C5FC202F7E2BACDC246DF8366032337E7D58B13650154BC82BC100CF32605114D18C7E2F8269991DD22BD91AB22E9770EAE6392D02265BAA
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK........b.lD................META-INF/MANIFEST.MF......_o.0...#.;Xy.V..%.F....U.Vu[_..9..[c#.$.....!.+........j.=R.....q....7&.Ld..........>.\.A.3.yw.-...../....-@.@.oJ...E.wCu.Xf.*wN.ns2'.f$|!1.j...>........b..R..S..[..,.B.J.s.....~.0..t.|.Y........O......1YFP%.^.$)-..T....J..-.IX.PK.......R.|.P...i.TDR..k.]K.A.6..I..F.n]+J........&dN.*...1...2.}a.ll....c).".T...(.T.....+&.HH.g..bF4.#..6S,e..n.f....2!:..Er...\g..@...V....@.t.Q.j...1...4kes..@J...."9..9...w...yr..0.oD.+E.idgebt.$.S....h.....[....(.N.q.6'h.....}Z.?a.,e.].....].3..{.'xy.O1.cu...c../..!6...!..G?.K!.....z..#.36.....V...v'....q.........g{...\....R].n........x...;PK..Q..4s.......PK........b.lD................META-INF/..PK..............PK........b.lD................META-INF/maven/..PK..............PK........b.lD............7...META-INF/maven/org.glassfish.jersey.bundles.repackaged/..PK..............PK........b.lD............D...META-INF/maven/org.glassfish.jersey.bundles.repack

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\jersey-server-2.7.jar (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Java archive data (JAR)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):923051
                                                                                                                                                                                                    Entropy (8bit):7.833376891937756
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:12288:t+9n8UzjW1ZobzyUsp6Lfzp+w0Pcv6EVuUbYR7lzllbac63TfDDk9O3wzjc:tELWwb2Usw+w0dUbc7Ltf63Tb49uw3c
                                                                                                                                                                                                    MD5:45A0E5EF9EAF0E00F578176E8A7F497D
                                                                                                                                                                                                    SHA1:443DFE312ADCBC4B88A87841021F358CF8D12676
                                                                                                                                                                                                    SHA-256:0539D49BC757335F6426567AAF6C04CCD914075316636A8FDC3B657F2BF79E4C
                                                                                                                                                                                                    SHA-512:56CF5D8A950891EDD06DC15F1C9DC1780C94E109065E8BB8ED07768E9959C9B0D0089ED0FE7C841D22FE574F41D94F6ED756CC3C10F603920D2B043C74C80287
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK..........lD................META-INF/......PK..............PK..........lD................META-INF/MANIFEST.MF.[Ks.6..g..a.Nwe..4Sgrh.N......K..ZK...#i.../@I.E.$..%+..A......ev/.v.E.MV..ur~..}.Y....6.}&7....W?]]]........,.>m..7.......v...z....K].U-.\nr..(...v.Z...H.Z..Y.d..]..Y.......n...m..>;{zzJ.Z..L.8..n.T....h...yH..A$.l.v..<K.>|.x..o.o.....................V....Z......@|7............./..T...O......&'v..B{...PK..2./;.>..8.r._|...........g.~.[J.N.$+[Y."O......m.X<..7.9y..~w..=NZ..j....a%....$......\..2 5..%.*/...&..ei.D..}......^B!JP..0.t...%. ..^..yz....q.Hb....C...N.;N.5@.)...T..T.H.].....lkj...y!....gng..c.$.7.q...........++.). .2....A........=....SE.'...H..p.....A+..|..1... ...]]..^....1Z....E. .$... ...N....UE.....b..w....I..L.3z..f.B..G...5H.6..e.F..,.L..0..A..z<.I%.^...6...s"CI....XW.<..?.$....~...7..%;.-...|..U..@R?..Wn.sL`.)...W..y...>.1.. .;.......A....9.a=.H.B...C{.7C.v........,...IGpJ_N.}|p 6.[x.....\.....P. ]..r5O.S^

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\jetty-annotations-9.4.1.v20170120.jar (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v1.0 to extract, compression method=deflate
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):77746
                                                                                                                                                                                                    Entropy (8bit):7.902573422135426
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:1536:3cqR1r0Vn/8c1I02d43LeWmTMRCFpEMzYDDm:3cqIlL1wSCWmY07ESODm
                                                                                                                                                                                                    MD5:23B6F7D0C025B570694E41718922A600
                                                                                                                                                                                                    SHA1:F50423490AAC638555F4EA6192F8E53C30D04EEA
                                                                                                                                                                                                    SHA-256:B4599F95CFD545300AB5CCB4E3383D3BA4A75506242D4E826865ADB882264E05
                                                                                                                                                                                                    SHA-512:EBE33338A6B6637F0158CEE4059A24C161314C208DF05C78C71558FFBC91FEC99B8B616EC7D9E60898BEF5141E2AD1E61FCEE30264A8485538F85D62B0F130DB
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK.........N4J.._W............META-INF/MANIFEST.MF.V]O.:.}G.?X}XQ.q..B......U..-...}X...:v.v.....8%M .E...93..8.3..#.....Z%$....u.2...F.._|..I..Rr... I.=7+.....v..m.b*R.,O..".....(+X..T..PV.v8...|...1.....#By*Ea+{..tZ.\9;..VQH.EQ.._....~g9D.....|)k&y..../..-.%=..].at.F./....^'d..p..`...L<..A..Fg...y4.//.tf........S...3OK.?Q+a..|..l......].../.....}...(.d.L.G.....-..jN....eX.mku..i.-.:.Z..?..I...t...%O.."...X....KH...j*.V..{.....{J.~o..M...6.........m....-r...F../.h...G.....9..E......,...n...~v............]>.....v{..`.e.9......R..{Ba>..R.?. 5X..K..B..?...pY'.1qmwb..p..M..l.O..../B.k.C.a>..kr...b90.O......R.....g....y...(........?P..Y.s....M2.../..j2.F.. ....[%.`R..M.we...q2.^...J...?..0.YA9.>..v..o.x9......)-.NAK...y{...i.+!.......)..G..k.6(U.4......e.F..y...H.......@l..B....6.3/._....[qE*. w..c.&.mU.)....A.]..(.: {6y.C7*.......d...a.NU....X.r.G.....K....I;l......e.Z...Ao.]..a"..(...0...|Se...7>:G4..E@..G..PK...._W........PK.........N4J....

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\jetty-client-9.4.1.v20170120.jar (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v1.0 to extract, compression method=deflate
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):264785
                                                                                                                                                                                                    Entropy (8bit):7.897696883855234
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:6144:0a0D6hXyP/8pJ8tnugoTyJfRGUVSRjwD2uxGJTkhe4YgXRo:0hDN/8pGu/TyTGUVSP4he4o
                                                                                                                                                                                                    MD5:7293316EA767B28CB92C1B3914CF6C7D
                                                                                                                                                                                                    SHA1:BF348043CA72015C4C6EE2B8C28B07B87A61AC3F
                                                                                                                                                                                                    SHA-256:53C78CD7EA3D41013F2CFE6750448CEAA29102EDF0034A2C2515BD9A4492EEEB
                                                                                                                                                                                                    SHA-512:383F2C29B832D97B15D464E7B107588FE097F9B13E2B4BFFE7C4CFFD106F977736FAA166F75CE73FE2FB07F6361932B4AD1D14BECBA1066E468D2AC5ABD5FD66
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK.........O4JT'......6.......META-INF/MANIFEST.MF.V.n.0.}G..,.&......T}h..ZA../{...$n....-...$K...&.B.=.^..{...lA...h....r..n]."...F...Xg..T.5Z. ..-dR<.<t....)d.....9.sF..y..BQ.EZ.^.....IL..b..}./...f<.{.X..O6b.-...Y..x.....!...[+..q......g..wd.Y!....._.w..954...C...`..\.9..7..qm].=.B...@..(=..[0..p..`......dV.\R...=......w.&.D...h...............#X-....C.m.-S,..D.k....R.....6..:02~.....O.NdS.L.2...@&.........B.\EHk..J.../V...._..'...uN2..W..>a..]......q@..s...x....1.l!.<..&.RYI.......p.D`"....Q}....%4.8x..r...B.M...B.(.$...*&...9=3.4.T!.^,..h.]v._...|F{...0.=.&..d=J.1.EN........S....... +..v.......5..i.d>u..+....(.c4.)..[..c.6..s..K..y<.^=....i.x.1.l.=gY..xv.x_...Z..<./eX.|...g...J..{..*iL..'..%..x.2............y..5..X6.}&.@.r..sh..m..y.n.|.........K~u.D....3w..>an=.u...k.....l....PK..T'......6...PK.........O4J................META-INF/PK.........O4J................org/PK.........O4J................org/eclipse/PK.........O4J................org/eclipse/jet

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\jetty-continuation-9.4.46.v20220331.jar (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v2.0 to extract, compression method=deflate
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):25381
                                                                                                                                                                                                    Entropy (8bit):7.879666469310294
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:rt7B1+6JAPYKV61qv6u2vCrKDIt4cbViJm4Bh77ua1y0icMNh7G4a5EJnOre:BH+6KwKo+rKDI6Yip7ugDXm7G4RJOK
                                                                                                                                                                                                    MD5:DDBE532DF264AC014C9F99E81FE76C06
                                                                                                                                                                                                    SHA1:BD47B54064DD2C1879F8ED3DA02E3CFE54778590
                                                                                                                                                                                                    SHA-256:F7397EF23FDCBCD36223A82DEE8FF726F8D1F7EB26693956F0F44DEF0A1F7C5A
                                                                                                                                                                                                    SHA-512:ACB010BEC6BFD5D5D88D05FA7D1C6A7EC2E823A1B0B14E0FBBD7AAEA657A7532CC96D169CABC5DCD2519B61D42153F2241879573BC3B0DE7B2A643182A99930B
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK........D].T...2K...........META-INF/MANIFEST.MF.S.n.0..#.....H.IB..T=..C+.vw/{r..L.;k;..}..MYi...)..y.yf.X.u...+.JH.ngf.;......[ K^.".Re..J.....i)dFo.'.P@..a.s]:.s'R..Y).......A*Ea.....K.rB.....&/$.\....L....r.K........#...Y|.(..`4B:....:W.d8|%.d.5...2...!Y......x|..."....^..X........O"..o..Inm..6!.-......KH.I..DA0..,Yj.....l)..Y....G.HF.......F..V......6.@.'...Z......i......@......w...&m......aN#...m=...v..L...=;.B.*.X.-...R.....f..v..Ja .?CZ..\U.h..b-.8...-x8..u|nQ.E.,h...b..|r.....|8..j:]..N...MO.z;..%=3....z.q..yw..k.{.p.....|...Ky......t...(.p..v#............cW....||....Ck.P..#...+..`.M.q<.v...PK........D].T................META-INF/PK........C].T................org/PK........C].T................org/eclipse/PK........C].T................org/eclipse/jetty/PK........D].T................org/eclipse/jetty/continuation/PK........D].T................META-INF/maven/PK........D].T............!...META-INF/maven/org.eclipse.jetty/PK........D].T............4...M

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\jetty-http-9.4.1.v20170120.jar (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v1.0 to extract, compression method=deflate
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):158355
                                                                                                                                                                                                    Entropy (8bit):7.937503752211515
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:6egWuhWN31cM6sOs/Ol6W48nTFkP9AXSAHOWTsw1:6qzhHOzl6W4WxkPaX/5TsQ
                                                                                                                                                                                                    MD5:BD3625B528BB28D2AEC742157ACDDCC0
                                                                                                                                                                                                    SHA1:C9C9D5B15B3BB41AE9AE588B7AEDE301B42186F6
                                                                                                                                                                                                    SHA-256:2DCA0E609CACA67D72BD3F27C2981FB47C1EC60A6148515FE7AF6F8A2F43E021
                                                                                                                                                                                                    SHA-512:67E635F69B64FB2FAB5EA757785733E54517A13DAC0B57153D673E541F698CCE6481DD145B7E875D98FBC014EA25731EAFEAA2D6A369557181AC02F38E197D68
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK........3N4J".......^.......META-INF/MANIFEST.MF.U]o.0.}...`.0.DL.v-M..!..t.]....M.........:.....""d..u.7c&.....@..dB"...e!3..w0......,TV. S.W.IB~X..{...ec;.)H....m...P..t.T.YO..7...o.AL.......T...x..TZ,@Z.\..(..<o...G.no..."...r.R..........e..c..e.F.a.W.pa..2!O`.....3v.2>.!U........'M............_!-\..\r.....fK.DD....T^j>..m.......d.XiK.Y..i.a.....KF6s$.......V?6..Hj.. 3..2...^O.z..V,b.`..g6..m..5......]..;.n....<.!.[l.).R.>..%..8UX.D....s.B............S.[.#..<V......S.#.....^.].....t:.O..>.R.1N.G4....5<...(>.`J.........DUr.(...f!...[5.d. I.*2..B}o.zH>..5O.M........F.7...Y...u....]....!g.?../..:.U5.Y.[..........o...G0c\......Yp.=..G....(.=.{.PK..".......^...PK........3N4J................META-INF/PK.........N4J................org/PK.........N4J................org/eclipse/PK.........N4J................org/eclipse/jetty/PK........2N4J................org/eclipse/jetty/http/PK........2N4J................org/eclipse/jetty/http/pathmap/PK........

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\jetty-io-9.4.1.v20170120.jar (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v1.0 to extract, compression method=deflate
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):130954
                                                                                                                                                                                                    Entropy (8bit):7.898474046836281
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:7ytUILD+yKqJuT0GXVEFCcgPcGXJuiO7R9XSMfhYv:cvLWqJuYNCfPcoAN9Xhyv
                                                                                                                                                                                                    MD5:0FBEB5C1D9085A06EE99D4C6D0C0052C
                                                                                                                                                                                                    SHA1:6D2D7C82A4B5306EC7BF2D6EB4B67460FCE77240
                                                                                                                                                                                                    SHA-256:BC53F547390F90DBA3C12ADEC771FF6035C69156E265DCDB49D635A0C7F7D2EA
                                                                                                                                                                                                    SHA-512:266477348456F1F57C645FC14DBD20126B70771BC0C4B85522CFEA52F483BF9A863A622D480AEEE51F70BBE04985F52573C1726B245B80FDCB01448720728256
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK........#N4J...L....$.......META-INF/MANIFEST.MF.U.n.0..G.?X.V 5&I...a.rh.-j...a.&C05v6vh...'l.-.".B...7o&c&....!.\...w..B&.....g.:..cJ.PI!.LU.z.E..<...)....Aj...,.v...(.X<...+.c.....w.C/.....u..X.L.x.MT\,@..Lx....,k.>....i...."....kR.\.f...).e..|A{4...... ..sa..2"s....L...f..>.L.~."<?.gAs..J.&u..=.....!.l..\.\I{...-....~.0PY..t..._.;$...g/K.*7.......L.,...J.n....F[......?.LT..a.X.y..9.R..z....t...Z....J....vZ'.....Q..y...2)..#.Q...X!....1..b.J...t.F..G2.<.e.j..c..Y.,.QV...p....!}.h.w*.Xr...7.1....ZC...\Nq. ..Z.o........h.N........B...S...g.....ix.c..l........Tq.(...7.TS...Td. I=.d"........W.....uH.-.m..{...l..g......#k......W...I....`...j.O....\.-.zu..u..,.;..[?.n.W...S.O..fw..PK.....L....$...PK........#N4J................META-INF/PK.........N4J................org/PK.........N4J................org/eclipse/PK.........N4J................org/eclipse/jetty/PK........#N4J................org/eclipse/jetty/io/PK........#N4J................org/eclipse/

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\jetty-jndi-9.4.1.v20170120.jar (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v1.0 to extract, compression method=deflate
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):41278
                                                                                                                                                                                                    Entropy (8bit):7.8930625402346335
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:768:wfBbxRONKWDdCosdTWmL1wkM12Wyj0mBfwdmwUYjMxAx3Jnk:a1bOjDdCos71wfuQ1jUgtk
                                                                                                                                                                                                    MD5:3719D04CA1D8B71146046838680443DB
                                                                                                                                                                                                    SHA1:43A3EA4DB0451C949807896DE4A76EBDFC28D71A
                                                                                                                                                                                                    SHA-256:3B4F46BB6ECEC04139999C598BCC9650E2B8D8DF47C820CA7AFF29A5381B4157
                                                                                                                                                                                                    SHA-512:34FB8E11D443DC7793998B3D52077B64B8D38FE4B73EEF0BCC3EB650CA17AA922703DAACEF3F92153EB9C75441DD9F7008DE9AD466A66AEAEBE37AD1AFB46971
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK.........N4J........7.......META-INF/MANIFEST.MF.UMo.0..G...8.@"&IiK.z.R......^..r....Nm'....$..Ka+.....7o&c".j.=S.......:7.H8.n...KMqqO.Y..L2N.T.. ....;.@.L.j.....4Bsc..Y.V..$.S,...k......OC/.~{..u..1g....7.q.....M...>N.i..i.|...y@T....6O...s..e..!..M.W.....~p..a....YGhA..p .oD...M.M..n.{.^._../zu....:....[..M..4.l.......,......`.d.Vl6....5...}...d.X*.n...........F&.$nz)._...~l.\.T.?S.H..aiQ.z...`..z.....l........[.ve...y`.c.O.m9i.r..RxNl.......c...._.|....p.s.KC..3.O3]....Z.6...7.....?X..:.o.n%7o.s..8.N......n...F.[.:....j~..%.Z....?%..R....3....y._.~p.^....qY...s.. r&..ko.(14)..{.:..T.R.h.30u.....X...g.~..........Pa.8..rH...$6R1.wR...%......A...cmO.p...uY.Ok...`....0F..F.J?..9...U..)1.......}.$.}.j.=.....u\./PK..........7...PK.........N4J................META-INF/PK.........N4J................org/PK.........N4J................org/eclipse/PK.........N4J................org/eclipse/jetty/PK.........N4J................org/eclipse/jetty/jndi/PK.........N4J

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\jetty-plus-9.4.1.v20170120.jar (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v1.0 to extract, compression method=deflate
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):55005
                                                                                                                                                                                                    Entropy (8bit):7.910636409186194
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:1536:AvahKxEWfQG0DKTDkr1ERoIlkv7c/RZ8pedpf1gZd9:AvahKxhTMERoVvwPdpf1g5
                                                                                                                                                                                                    MD5:D0902FF811DFF1CEB7261E2A2C85AFF7
                                                                                                                                                                                                    SHA1:9C40873BBE63EE495365E4344C323B991BF7173E
                                                                                                                                                                                                    SHA-256:570B8F97D6A909C59794AA92B322B12CF1C07D63CCFD4AC510DBE7637F203F9B
                                                                                                                                                                                                    SHA-512:1ACFDE864BFD8C1CE5F2CE826ABE0BC64BB1A28158E56FA0B343EF953E4F5DE252CDE67CAED969EE83501B10FFE8CC27C1BE49FEB68812233BFE4A321B097BEF
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK.........N4J... ...4.......META-INF/MANIFEST.MF.VMo.0..#..,.+..I.m!..-..tQ....Vnb.......w.@.%i.P...=...<gL..Rm...4."@.v...DD.:?....M..@.....N.T.. @....3b!...hnL..Z......s....x..[.....y...m..V+...Xg../.a.........\...|....U..#Y.....6A..../cN-...9...;..+..n\.O..q..ZP.)<..3".e..F Q....7W=....y.wR..~..D...h4..0....))l> ,Y......0..V...V..6..].&..R.tG.. t...34......"........."../TDR.h.E.j<QrAC....:.........7XS....W..ok.||.emc.Qkf1F..Ih.........nC.y.."bG.i....O..........?.xl.`"........%.<..4t.bf[..-_.JA....O..sb.|1v.L...sA{.J.<%.(....>)JQ-.../.*.....B.K.k.J...<e.......d.....<0L.Z...3..|e....M....?...*....w.n3.i..[..4...../)!.\....s.r{......<.....$...`SL...@Qbh.........@.....B.....OJ.h0S-k.......8.37...>].}~(.'.^..>..'y.._).!.,......R.l..l.....g5.>..x........s6V.S./..v/~...2.SN......^..9.@.<Do.......U+..?PK..... ...4...PK.........N4J................META-INF/PK.........N4J................org/PK.........N4J................org/eclipse/PK.........N4J.....

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\jetty-security-9.4.1.v20170120.jar (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v1.0 to extract, compression method=deflate
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):91036
                                                                                                                                                                                                    Entropy (8bit):7.904373333079498
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:1536:hDrGCAQgcH5h1nbXGoo9lnZ8EtbC8OlFdiyNTpmQyD+sL:hu1Qx5nn5eZ8gG/iy9eL
                                                                                                                                                                                                    MD5:BA329876B118A3D3B473176A3BA5AC23
                                                                                                                                                                                                    SHA1:677AA94298F42D322E2F19045693A233613537B6
                                                                                                                                                                                                    SHA-256:39925C822FAAC60E7239BD0C283737B2E65657931151358D4A18F643B3E16C16
                                                                                                                                                                                                    SHA-512:868A274AFB60F2A4BA3EE445179E77F4C5B32A4D2AFBEAF99441A2EDC71198B61AE62A7DF0607298534479A2766728334E3A49B722BBE6B0520D070213F22C42
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK........tN4J..1.............META-INF/MANIFEST.MF.VMo.0..#..,.+*......z..ZA.....a.&...8k;....'...B.@(3.<.f.9C..1h..\...[..q$...:T<1....Y...R.d,..A..g.S......b..........;e...@...En...}....w|.|.5B!.<...F2L....D8...4).|^._%.>.9...E..&Iu...<.`...jS.5...]..w.z~F...[.d.Z.>.#g.....9DH.E....n.....W...~az..)W..?0.{~?^p%c........h....d..d.../i.g.w.c.%C...cKt.u*..'d.%...,..f....`.'.$gD../.GR...{.z=Rr...X.c........a...Z.07.......^bk...h..P......pR....qZ.=........tD.'...Ee!..f.].!..8;5..Q.|.`..y..2....@.).....+..|pl..J..4.8.1...D..c..T.gy..R.e.B8-S...;Z.....gp..l.t6.z.)..[.Z...Z....P..S..1.......\=.........N{..5.%%.X.:..~P*:..z..e...,..!N....O...3!.NO.3.e..=.s2d..I..d$Rt......P.6..3..7).%.`.C6.i....A...3 ..r......q......9.)...*.u..8.....V.i....J.r....k..H~!W.)|v..7.`Z'.L.{..:.......t....z.^..PK....1.........PK........tN4J................META-INF/PK........pN4J................org/PK........pN4J................org/eclipse/PK........pN4J................org/ecli

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\jetty-server-9.4.1.v20170120.jar (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v1.0 to extract, compression method=deflate
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):568427
                                                                                                                                                                                                    Entropy (8bit):7.945408914505869
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:12288:22b5pXFRhzZOd4FI1Ue58Ci+u3Kq4kNGXgzWIN0ue:221f/zZal1ULXKq46GwCIaue
                                                                                                                                                                                                    MD5:703E37FFB3CDFCB7FEBD97D9C55B6839
                                                                                                                                                                                                    SHA1:4CF4BEA26592DE98B9126AC60BC91FB669176A63
                                                                                                                                                                                                    SHA-256:86007D0247A32310D823814320BC1EE9F10C5A9D3B9B5C78649CE0C9412C0560
                                                                                                                                                                                                    SHA-512:BE122CF20014330623983445B5390AF0C01F807FF9D5BA65FB109F3A971871CF564CE2C53FA68A8DD8A6D81E7DD95D36488986EA873D1A6A8EABC4A9C0B7DE17
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK........eN4J.4..............META-INF/MANIFEST.MF.W.o.8.~G...x8..1..4U..,....j{./.p.&..5q.vh.~g..I..rBE4.......{."..u.qm..|.Q..{L.Pr.#7...M_|....F....E....'.\o.&S.y.:...........^__).Y..T..Hf..h.i:..<s....l.=By El2{..U.lxd....z..Wq...n.]A./l...}..<.I...>mb.1..m..}G..G.c.u.q....y..d...E.3g..T(^..............Q[.1.C..W_..Dh...x....h+..0.@.m.@..I.0U.N.....?.EpI.;q0Y.P.G....$.hI.`.dnC..XM...u^.H........B.}2.,..~.j......:O,......R.K1...o..?.....(..._..%..BoAz.^J..yW.B..i......7..4.81..]mX.O...C.f{j.<c..s.Yo....57J...?...L...8E.t.Z.@W....C......m....9. .S.,.TF..y&Xwp..4u.L....R-3..s..V-...X..4...=..g^...".?.g.9.k.3.Fl..s....y......@L.....O...E..|.... ..,.....4.k.ap.....C&....d@//Q..-...o.............\.j|S1.J..q...a...H....3.h,..Q.!.qd..<"...'..i.7{+kf.c.(. .....@.A..VA...L2+.4.1j]I*+..V....U.......k.#.., NN....r.\.e_-SR....U......8......6T6...f9.l.A[..RW...u..4x.8`K..D...=......."..:P....Z...Vb.g.....E..Sw0...>.B{...=..?r.8...*.J.F.c][..>..W..o..]NV5.a..c...g

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\jetty-servlet-9.4.1.v20170120.jar (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v1.0 to extract, compression method=deflate
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):110391
                                                                                                                                                                                                    Entropy (8bit):7.940398532595281
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:u8E4bjK2i/vEbOYy8I2v16N40t4ZdfMKANMC:uSK5/vjY22tf/EMC
                                                                                                                                                                                                    MD5:6B9BD77D7052109DA1A0522A202014FA
                                                                                                                                                                                                    SHA1:406A6EDC22311629B41E98AB26901574D243D408
                                                                                                                                                                                                    SHA-256:5740DE237892CF919C3E679FB6818038D9A1C54FAB3AB72295BAF712A5E21503
                                                                                                                                                                                                    SHA-512:07721D8FBDA672C7FA212D059DD5A530C34233191258E53522EF669DA606BC106A1C5DB43A60DF77E88AA0356C367BE6E96FC985D99FD641A203FC310427E76B
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK.........N4J..<N...........META-INF/MANIFEST.MF.V]O.0.}...`.a..q.....`.6.2../{.Lri].8......:IC.M)CU.*9....{.=d)..m.;P..4"..].<O......)^\.1.2.I..<HU=."r.j&.....x:...<.TCD..dQ....DY..1P.F=Q.......m......u.B!.<.%.~...SH..A&.Y..l........i...WE|.?..R]f.:.......w.B.i@g....AX(.............0m.2....Tl.x.$<:.1.NeX)[S......s.I..qn..3.dj.A.....=...d.P|4.._..wI...M...2.-...\.,......I...5...A.$...:..;H.."./.U...@\...z.,~d#.|..."....u~...+.G.ng...,M%.W.a....I.^.gm..i....A0.........OY3.y6Gr..2.S.'.y[...-E.L.,&...KZ....s....[.JB.7.l.C...@.[..6.t..o*......f_m...e...U.].....Y...QM..|..5c.<..5Ew.H..Xr.9......*..U...s..C..<O..~F..#N.N..AEg..O;...U.;.U.^....J..?.D...=........^x..$i8..!^.....c.b.](`...d.\..d.f...y....:.y.b[.g...:.9v?jPx.....j.k\.UK!O....o./.s.qd.....vmk....o...c.Y7..#....#...6...7.}.l...C.&:...t.l.V..e@.>.......M..."..7"{....%+...G{.<... .\.u..PK....<N.......PK.........N4J................META-INF/PK........zN4J................org/PK........zN4J.

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\jetty-servlets-9.4.46.v20220331.jar (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v2.0 to extract, compression method=deflate
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):107784
                                                                                                                                                                                                    Entropy (8bit):7.944760279138607
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:pKEhy92fjfYLwe+svK+WMIBsTsdqoLLneKKD5o57:pH092fjfmvK+wKTJMrKFoB
                                                                                                                                                                                                    MD5:BCD2E795091B51CA6DD2C7D53A9B0EE7
                                                                                                                                                                                                    SHA1:4D0438A4F729890766F6612085712F40805CFD30
                                                                                                                                                                                                    SHA-256:1AD2875321895D757875D91C1F25BA6542909C4D76ED2CD34B6D451F55A6B83B
                                                                                                                                                                                                    SHA-512:A557FCE1C4042A4423418C6BFCA2F8B8E40322B736AADB8E8EE3BAD04C4882625BF982A0AEA06E8DCD14F611EA6345B55FC4F991DFC5C938AD7C452327F8083A
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK........I].TT.............META-INF/MANIFEST.MF.UMo.0..#..,.+..IB......J[A...^..&.L.;k;i..;NB.~.= ..7.g.9.lE.q~S...!..lL.%...x...D...$...3.s..<[3.l.3.c.&~t.). .k6.3#.bX..e.q....H.5..g..xK..aMU....$.4..@...E.R.hZ......[..7..!.pp.s..}...)..!........!.B....3#.P.b4.....2........Yk..^...)z...%6b..L8.:%f."|..t..zcBT?.v.A....+..2hLv..:.5Z....6..I.....oTG...p^6().VRU.0D..q....@... .....:....>nV.....MK( ...0)F......~L....c.[.Z0.>f..XF.=P.)wr...&.+....._.....GV...).O.i...ME..V.p...j.....y.....W.g.F.;....&.Y..?.9.K..V...e........=.[....=..kZ...D.Y....L. ..+"n..x....A.>.......J,.Vx.|-p..........Z<.....yu............i.?-.....R.\.S....)...f.'\aL..w.g....9..)......k.)......m.iW..r.;..X.-.KJ....._.>.]....Co....f..PK........I].T................META-INF/PK........F].T................org/PK........F].T................org/eclipse/PK........F].T................org/eclipse/jetty/PK........I].T................org/eclipse/jetty/servlets/PK........I].T..............

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\jetty-util-9.4.1.v20170120.jar (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v1.0 to extract, compression method=deflate
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):452498
                                                                                                                                                                                                    Entropy (8bit):7.9313659465678
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:12288:NwQyOP++d1nf36ogEilByq39N/FMZxL9fVRHk5SgL:NwQVDPrwlAq39Lox1rk5fL
                                                                                                                                                                                                    MD5:17887CB40224DDFC3249AEDFB7358560
                                                                                                                                                                                                    SHA1:810C4E4275E399FEAF6E8BC51AA72645BDC06205
                                                                                                                                                                                                    SHA-256:5538741F52C7764EDBC31CC890FFF2F9B99A1A740A9288C43BFCD5C87B871E68
                                                                                                                                                                                                    SHA-512:FA2469BD15B4481E7111DFD3EA976A084BEC6D1D97F15C0A8AF93D4E3DC147BF32121A900FF55915093B7B12121F6FCC7FEBC89A6711B92020438FD1C0B6D110
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK.........N4J.5..............META-INF/MANIFEST.MF.VMO.0..W...8.@"n....qX..X.,....V&...n.......'%4..A....=...x.b>.m.'P..8 .u...4..8?@..'&[...l.RF..2.j. ........y.....I.^.......s.R.z"_......a...=..v..P.D.../.a.....$.Yy.M.I...f.,...-qW./...%M1.n.f...$.....C:..]..w.z~v~..s......|.G.i3...r.P...`..}w.?).l.,..b....\A4ZC...G.+..|P].b(.G....L6...Z.K..#..c.%....b...u*..g...K.&.".WR....R=v..D*.. ....(....N...&S..u.X..f...S_S.j%.\.._....)..O....R..Y`z5.......ul.1.yj....K]..A"O..J<f..i.-w..B.....LU...yZB5...fS.%..C.\..Z.<..T....j.....(\f..gMc..V..?..X...{DkQtM~>.R3......k..S.X:.V..`...GO.1..+.......1....b..D../a3.N..!O.\..........&...3N....:....o..g..1.....qd.>Ub.8...c.u.......w.^.?.0...[......B...8.Xx.Qf..3K'......A.D....h]v.}S....E......jf.......Lw...p....Nk.\..C}.go.%..U...N.l{%i.Z.r....1*Q..aJ...yZ..S..l.{D..y.}[5k.........aC.}q.U|..F.}}..E~...m...a......+..........w..T..Z....:..).n.M...&'...3..^..:...F....^.....n....PK...5..........PK.........N4J...

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\jetty-webapp-9.4.1.v20170120.jar (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v1.0 to extract, compression method=deflate
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):120502
                                                                                                                                                                                                    Entropy (8bit):7.955600727128229
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:ZNDKulvJuInMneain0Sw48Ueqyhmy2dvYETyMu60zuV2J:PO0Jpmtin048UeqyoxC4VE
                                                                                                                                                                                                    MD5:A403D02DE3D22D2DDEB5CE859723FEAA
                                                                                                                                                                                                    SHA1:21BBEAD8B56E21A2B4263A3449BC70FD4097F8FA
                                                                                                                                                                                                    SHA-256:833D33FACE1C4E56F87C196D99D76881630980C1AA2CB7E8FE9431C192E17DE6
                                                                                                                                                                                                    SHA-512:3D73B267F122E331BF72268F820D9BFED3DD84CA75463455A19F4C46C69EBF8FBB68C4AFCBD00FCB0678E658BA60D392B5FBB556625293796FE6B56BE519358F
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK.........N4J................META-INF/MANIFEST.MF.VMo.0..#.?X.V .....T=.,.......a.+71`jl.....w...[. TT..'of.0 .......I....^.>.)..Wj.....QkWh&.S4.z. ../.J.BwJq.....3..WA.d}.Pah.&...\,..(.L(.z...i..........d.&.)S..T&..k.Tq...XMTy..j.*.....V./.S.9^.i{.......o......<... .rU....*FSj..."....L....k.[....uy.u.L.k.K.<z..3.i.[.$s...i)\>.9..."....j..x.....Q..m.%..R[tOV. L.-.c4..F}.:.7.....NE.%.e*._.H..Q..X....&6W....$y#c.{../..z....o~[...+(......N.N..\.@.I}...?.x..+._|^...v.{.GaE.dF.A.(.fvUB..........>...W...m .X.:.9.....u"......x.#0.B..yJ.........0Jg.\......452......4.......rvXR.....WY....}e...G4c.)....Q..Vk_j.g....k...@u7U.....)!.Y......t.t. ......8.....U...1A8_.]M..in.w..@.2....<.P..[..!....V..`.@.._@.u......9.y...A..4.......h.C.U.....zw..U.5Pl.Ow...?.P...1.dc..N-....-}s.Y.8....W.*..PK..............PK.........N4J................META-INF/PK.........N4J................org/PK.........N4J................org/eclipse/PK.........N4J................org/eclip

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\jetty-xml-9.4.1.v20170120.jar (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v1.0 to extract, compression method=deflate
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):50242
                                                                                                                                                                                                    Entropy (8bit):7.942977620125212
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:768:ZdMPyMnpalnGd27bjuGEfrDYWMOGxUtTZj5hTIgwzx8Opq5sPqC4gsPxdLmKEyYr:ZdMa2alGpDBMktt51Ifzx9odLBVYmN4H
                                                                                                                                                                                                    MD5:70D32F37864D71B43F85D2B81067435C
                                                                                                                                                                                                    SHA1:689941E2658C888E529A52F77268868F4282518C
                                                                                                                                                                                                    SHA-256:81AD18A0B9CC5856C1CAD3DE01742AA75F2F86E3C0FD89B0385360EA9A0D90D1
                                                                                                                                                                                                    SHA-512:A2031ED1708D70CB1E339315DC380D5F4DD7F83FD4FBF5AFCD7480F70334CBAB122F9EEFDC26517CD447083C89C27A6C5D9DA009DEA67B6899B84953AE8E450D
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK........<N4J.MV.n...'.......META-INF/MANIFEST.MF.T.o.0.~.....a..1I.....`<....[5i....`j..v(..=',.....(...|..w.3.`l...p%...................UY!.,.>.$..>...r.-.S.g<.i !kk..~yy.,g.......=..L...AL.................vQH.u^_.p.>)L{.x+.k..UJ.[.{7.\...\Wom.h.Ft..Q/..R..l0>$d.....,.1c.*.K..J..w.q.z..v.u..u.....k.{H.w.T.V.....C.".....4_.1Z?.f."q...W,.+m... M!,.+..n..fN.a......8N.-5... 3..2...Y/..@jK...`..g.:+...pWI0j.(.r.q.qu.cy.0h.0.D9.qO...q.Z...Q4.U..*..9C..X..<4g. .L....?}.k.9.}.8.`.~.r{..Rf.).p............|...z.@...B.K....b.7.i.....p...u.=..wSuyHP.......dB....f!+...\Y2g;..r.Y....7._..J.6.R......k.Pv.o.......o{[m.`........[.,...{.O.Q.....PK...MV.n...'...PK........<N4J................META-INF/PK........9N4J................org/PK........9N4J................org/eclipse/PK........9N4J................org/eclipse/jetty/PK........<N4J................org/eclipse/jetty/xml/PK........<N4J................META-INF/maven/PK........<N4J............!...META-INF/maven/org.ecl

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\jface-3.5.0.jar (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Java archive data (JAR)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):1058001
                                                                                                                                                                                                    Entropy (8bit):7.8741160125377165
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:24576:4MOQBbn2oyP7dzFIzBnRA2Ftmks5ErULTpM+zp+lmG:PlByb7P6rFeEWMMp+lmG
                                                                                                                                                                                                    MD5:76A903C2538EADED77650967D556FB0B
                                                                                                                                                                                                    SHA1:20FEE24BA2EEB55C2A71ED662239923191F237CA
                                                                                                                                                                                                    SHA-256:0A9CAEEFE6EA695BCD77B78FAD5560393A7FE43A8D5B809D02767C12BFFC1089
                                                                                                                                                                                                    SHA-512:F4F54F175FD30E32FC52EB2CE7E40AA70EDD42E1E66BA281E518AB70D69BF8A2F3692D96CA023D8C9D266E48BFEC58B63D8AA5CC4F39275A8C64E317E58180C7
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK..........:................META-INF/MANIFEST.MF......W...6z?...&&...f. @../..o.p..\..{....T....!z...U..Tf.\.Y.....[7.P.....c.7...............S$..f?...+.z.n..Ae...........,.F.. ...%@..?{{....O.o..'.}4S...#...];....;.L............].....\.?.......................&..o..6.....u."......;......9..........||.,...gcO.?....?V....j6y5....Y.V......o.........!.vl.c.._.?..[....G......z.o.0s......9o.......~{.o/.R.i.?..W....e.Av~_...{...$......|~^.&.Y.a.}[......?....u.......B.>........m.w.W..fv.c....y.......?^.o..=....ON.[.6#C..u;6.p...?'.y..\....I.._.u...V.u.V.O.k.d..........x.o.1.]...Jw.........?z..1..g..f..^.;....\A..._|.Z"..`6........_...y...H.......yW...M...z(...k........Ed^...>..Y....~..W...!+o?.`.o'O.^.....Em.?.:|X..S.......~.t.c...e.>...\~`...|.`.C.I.k... ..o2.-.A......RV.........V|....ba..L..)?..zw.Q.......o.....E.-...[nvU.0A.`....8S.......}...}...(....Y._....8.+.e.......|.T..?..o?.......|.5i..4....^..z.R.09..d......~.]...<.....8S.r}.

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\jna-4.0.0.jar (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Java archive data (JAR)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):914639
                                                                                                                                                                                                    Entropy (8bit):7.99052113322922
                                                                                                                                                                                                    Encrypted:true
                                                                                                                                                                                                    SSDEEP:12288:yl9FVbkvc1E3s88cSS+aBjZ+bfKlaVx9q7DAgTa64wmVuQaarjaUI/cc/p:oHb6cybjBcjK8T9q7DusQfrj1c/p
                                                                                                                                                                                                    MD5:A1E20E48A367063023DB9137CEB7C63C
                                                                                                                                                                                                    SHA1:9B3A11C613EC3FD3440AF4103B12C3DE82D38B6E
                                                                                                                                                                                                    SHA-256:DAC270B6441CE24D93A96DDB6E8F93D8DF099192738799A6F6FCFC2B2416CA19
                                                                                                                                                                                                    SHA-512:D59D542518FA3E9AEA162531C2836ABF2374430E962771F9B051C6F7CD2CE19438841A5787CE47E15E24759C6321F823ED06131E556E5660963A728ECEE8123D
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK.........b.B................META-INF/....PK.........b.B...4............META-INF/MANIFEST.MF...r.0.....;h..X.'......H.d2M&...D.-....O.+....n....~:...k".339~b.p).h...`!*+.E.+C..//.Q.,5#9K...........xt......E....J........5../Sb..Q..f+.7A.;..........9<K..y.2Oy"yb".z.n....X*.}......e3......f.......So.[.#.p...2c..lq".....=..."I.^B./RC.o..V..q....Ww$cVL.+..P.U...7..D......F....^.....w.k.5KV{F....;.....6......+.R..........S..|..J...........\{..8.&c.k). XD.d=...../....n...k....)-..J=.........D..<.u..S..X.C.0.Y..8sPT(.E~c.+.k,.*..#.8..5W.5slkm(..Ay..\.&.p.a9..X..O...hI.Mj<.H..+U5...TI ..@E..G...!....\l.f....qEQ3.w...(.,......u2T.Duq.......OT+.^.@..m.u..r8q...zg..j$......Z.N...*....._w.!......b.0.yweM....4Xa..;..N..zN../Z...ae...Pi...n..vOv....0a..PK........:S.B................com/PK........:S.B................com/sun/PK........;S.B................com/sun/jna/PK........;S.B................com/sun/jna/ptr/PK........;S.B................com/sun/jna/win32/PK.........b.B

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\jnativehook-2.1.0.jar (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Java archive data (JAR)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):208804
                                                                                                                                                                                                    Entropy (8bit):7.981418646532165
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:AZ7A0CdNBlFsR96PxFLhOsDFRGNG7Xq/YV2dETNQyl4fh74luYtPBmQR0ncvqoX2:ASNBz9BxZRG2Xq/YYETNHOfRUtPRRznG
                                                                                                                                                                                                    MD5:DE6CF300C801226D4B19E4FDC258975E
                                                                                                                                                                                                    SHA1:49E72DDEE45CA9CF332C50B4C716781AC0DF07FD
                                                                                                                                                                                                    SHA-256:41565E543A043EE2073A0B3D93082B78614D2241AA2C6669E05385D94511851C
                                                                                                                                                                                                    SHA-512:1A152EFE851BD1FB029924F4854A9374F0FBB8A78B5A73EFD49B5807F45E7FFCCAC7CA780CC1BDF3090EDA6E491B2E4AFB57162EFAFBA274196D92CB972FC05C
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK..........9J................META-INF/....PK..........9JeZ..............META-INF/MANIFEST.MF...N.1..{K~...8c.A."..A".....&1..im!...].....J3.vf....s...Kq..6R,.HYv.P...R.P..V.......m.7F.....N.%...n...U.!.Jt....O<.t.....w..ai.!I!..........\3<.^].L......t...=.~..m"..Nl.....g..<..!G..c....c.Q`2..vM7.X.....PK.........9J................org/PK........!.9J................org/jnativehook/PK.........9J................org/jnativehook/dispatcher/PK.........9J................org/jnativehook/example/PK.........9J................org/jnativehook/keyboard/PK........!.9J................org/jnativehook/lib/PK........!.9J................org/jnativehook/lib/darwin/PK........!.9J................org/jnativehook/lib/darwin/x86/PK........!.9J............"...org/jnativehook/lib/darwin/x86_64/PK........!.9J................org/jnativehook/lib/linux/PK........!.9J................org/jnativehook/lib/linux/arm6/PK........!.9J................org/jnativehook/lib/linux/x86/PK........!.9J............

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\log4j-1.2.16.jar (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Java archive data (JAR)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):481535
                                                                                                                                                                                                    Entropy (8bit):7.892871329463679
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:12288:bvmaYhW47H/IPPlWHzPor26I7xSjjJApPdst:bv+hW47fIgEU1st
                                                                                                                                                                                                    MD5:363678F015902BCC040308136F845A3F
                                                                                                                                                                                                    SHA1:7999A63BFCCBC7C247A9AEA10D83D4272BD492C6
                                                                                                                                                                                                    SHA-256:7AE3FDDE7AB0CAE4735A2AEC04381AD9B6E25C93D24205F3ED315D9866F12FE1
                                                                                                                                                                                                    SHA-512:04E6A76176FF0A84AE12516B301ED5C88F33184B2175BF8A65F65A2CDBB41FB5874FFC41E5E6624BA9D4E6C97D62A2B8E9026EDC7CBB3027C46025965C087CBA
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK........1.~<................META-INF/MANIFEST.MF.......o.0......<.Iam5.>.]'u..Z..N&1.il#.@....'.|8d.......|_K..(=~#RQ........t+..?....d...#...;A...l.'.f.....u....^a..t..{."....A|'..|.6L.rR.......rM$..}v..(...E\.#......:.Q.9....G.`H.8..&b...3.E...._...:.....tb..".|Mc....|........M..k.Z.#*h.......0..TuB6.m.Z.-..F..p:#..G...g.,...^..../...%.........gj......._./...S.t..n.6.%.s.q...3..U..a.....p..l....+U.-.V.(.EZ..8...k....=...bg...8=.....M...s.;..._..............(!.'.`.|.8..>.$X.(..%....o..d.S^"....,M_.Z..$...z....h.3.0.......N./'..er.s..^...).@3.......2.f..|...i..NT(.Vg...CJ....Wp.w.....p8.!..N..V........x...>."...........0gNN.|.d+.d..<..Yu..T.)..I.Hv.}nEv/...2....^..3[6f...~.].f9h..Ns..f.....p.v..B.C......Z...y...>...NK.W.9...&ig@r.$]8.>..U.Y\...r.a.D.HY.....E.....V.....qL..m.W..M.u.8GE.O....p0..bn...:..9k.e....o|.JuR..Ub.w....PK....H.7...r...PK........1.~<................META-INF/..PK..............PK.........~<................META-INF/LICENSE.Z[.

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\mina-core-2.0.7.jar (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Java archive data (JAR)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):644786
                                                                                                                                                                                                    Entropy (8bit):7.863056343477929
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:12288:wQ4mD2FtBTGR6M7CSAMKt/vpVZ645KiAJAE7A6p9oNE/ym2tSR9uoIocxDJpPacq:LJ8TGR6M7CSAt/RVZ640A8AtqyjtSR9z
                                                                                                                                                                                                    MD5:F4E43E7FA0514A9BC88968D64A6322D8
                                                                                                                                                                                                    SHA1:C878E2AA82DE748474A624EC3933E4604E446DEC
                                                                                                                                                                                                    SHA-256:FB2C9953AB2F8A4AEE38B768C0615E2917DB65106FD6466133EA12AC05BE7F69
                                                                                                                                                                                                    SHA-512:AFE9D231FBF5FE16A387FC29F678C0B474D733E7D9945344786B3A7AA617C24F14B6A06B26B069A493A5BDE8A9C5AE8A226E2BA02244484000024D3887C1D1C2
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK..........FA................META-INF/MANIFEST.MF.....ZKs.6..{....[g,..'i...q|P.v=...C."!.6E......HJ ...t.........BO4.S&.......-...OO.d..J..'|.Y.....q..........%O....?..].s..|.F_....,.S.m.a..l...X.B.=.....y.?....%.S.\..Z.).)."SA.L?].y<?=!d..B...]I.V,..2.9)...bA....%.a.%2.)...).$.[H...6"d.H!..O....:.J.X..$S.Dp.K..f.\.Y....eL@R.b........d..%.\.s........h.~~...8%......?y...[2W....X..FT.)...b...,.l.p.^....x..?<...].p..>U....z...|..}......b...r.lT.....X..).E.,V.Z..2....F.K4t..(z.\O^..g.'..t...otfQ.B..Fs.......L..O..y...^.q..rn3-.....@..$.v..Y*.v....+..$Y_...+..L.7.v1...M..m..T....C..}Z.n.|..~.0v......I{.5V.Z._...$..y..lf...z..z.T.=n....KX.%l......$.0%..,.S&.-xj.k..KWM.4..n.!.,.3b....H........XAS`..5....$.,.la.Zp.<..b,V.vX........$...5...u2.......l..q.;.5.IN.....Y.B..^tc:..]...... ...0..i.TN.J...e...3....B...}.TeT......h.sR..h...........mX.T...33.....$5qv0..u....,c...l..N...s......F3CL...l..!.iT..k.~.....?F....`...B.eb..'.Z7..Z.=Q..........#.....

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\observable-1.2.0.jar (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Java archive data (JAR)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):283176
                                                                                                                                                                                                    Entropy (8bit):7.763344541543758
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:6144:YkCv/+sAE3j6+AcGCo4XWa2CDrRzZle4bdsYj:Pi7THAcGCo4XWa2YVe4bdb
                                                                                                                                                                                                    MD5:EB1BE701C0C0F73A76C8FD736CEB86EE
                                                                                                                                                                                                    SHA1:F7C5FF1E5F4B8842431E52E0554D4AA79194E892
                                                                                                                                                                                                    SHA-256:84A07846AC4C4D426F95597398C08E3EFB9E55FAEDF2439348C64D3C77028B8D
                                                                                                                                                                                                    SHA-512:16681B1C944CB73846FDAD5245EFC195A7F963EB6C64A6C780C34245B712EB7CEC1A10CAC64E91ED710FEBFBC0CF38A516A3EE03ABD9680E6D3F59F2115752EB
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK........"..:................META-INF/MANIFEST.MF.....}Y.....{G...8....O...... ..."....2#...43+;...*..T.....k...,..K..:....>...F...x...c'..n...I.D...W.Q...s..7..9..,....?h......l~.....?...w....*.>=.I..v...G^..<'..........}.27.O.....}L...{....*_.x....m.4.......7...._................^q!.&:.M^. .e.Wev2....._...eW.U.b;';..}.........$...t.}.....vR.....u.VH.b.......5v...{.7..m..^.l'.7...:.K.(r...[.n.7......"/s....G(~...*/......H....t.u...k..=./.~>/.6.....Ss.....a.7...6.x........>.#)..k.n....5?..V.,...Gb_.7+g....vV......x}.,...Y.<?..o.*..._._.......&dn\~G......:O....S.o^.?.....^>5.mi..b...2......v....%B..<.b9...n......H/..........WI.......|&...-......./..0w....~A.3..'.~....[.._L.....G..!9.]......|..".8...@i........."O...D..A<0..*....Qy...S......?.c...h.v^.9..s..q{0...a..[.Wb.A~|.hc'....S...G.PE......B4...a.S.s....Yc.$'B..h..A....)l.bB...:.a.,...6w.9....(.s?.oa...s..U.!iw.@.....~....../.nt.'r....7.w.......A..........k#M...~.Ry...p.F.

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\org.eclipse.swt.win32.win32.x86-4.3.jar (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Java archive data (JAR)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):1922621
                                                                                                                                                                                                    Entropy (8bit):7.944207559304236
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:49152:94JjduwZP2LSMOgqdPi5pmPRZ2eR5lVXMpS:6JjVN2LSV5Z2elBMc
                                                                                                                                                                                                    MD5:02C558B5E1EFCCB88F88609E9E7E9208
                                                                                                                                                                                                    SHA1:A5D40EF3582CB71631D493CF71D5DD559390F640
                                                                                                                                                                                                    SHA-256:BE0CDC13C30DCCF963644AB6A60DE77ADBE5A87B8863416032D7184F94604B73
                                                                                                                                                                                                    SHA-512:A96F732BA06E36763FD1269BC8AD005496C80F15A971FCD93748E7E35558200E80263821844FAFA9938C39363C83360151E4581FA7A7B0CB87124A8A4A9B2BA3
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK........"..B................META-INF/....PK........!..B.s.`w...........META-INF/MANIFEST.MF.M..LK-...K-*...R0.3..r.C.q,HL.HU...%-.x...R.KRSt.*A.......u....4....sR......K..5y...Ct.....3. .pT.cQr..B..././..PK..........BX...U..........swt-awt-win32-4332.dll..\..8>..0.....7.......$ ,bduqa.( .5.".e.?.(d.2..m...M...6}I.I.....IL.15&.$.\..`...2.s...Gc..y}........=..{.9..?3Z.......e.9.(O2....n..?.f..y....7o.v.T.*]....6.....Wp.{..._n()7....6V.;..F.ph_.{:....~Wqo..U..;.|.Sw/._zj..)L.n...[E...K.....S.e.:'...j53L.*..t..Y...&.Q*.a*!.VI...?zp54..a..?.3.Ca.>}.....R.A_....a....0.,..&.c..t.Q................r.-...GP%3H..1@....".a....}}0.@..s.0f[$.<....5pMs]U...........s9.*.p...}@..[..M...xn<7.....s...xn<7...xr.....\..Xe.5.mf.fT...]...9v..C..sV...".}R....J..`......9..R[a.A-"..Z._e....'..F...._.U0.[...rD8$ N>....3...w..zH.o..2.(.....C)]/m.f.....z).........3.Ek...j...d..?.4.....c.*1..R.w..F.7.4..?....)OWW%.2...1>..@r.ZL.b,...B%.....O.a.....Q.\.L>.d....W=..

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\osgi-resource-locator-1.0.1.jar (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v1.0 to extract, compression method=store
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):20235
                                                                                                                                                                                                    Entropy (8bit):7.790842842819005
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:gy7iFlTflpp/HCw5JR9sct3LY3FyEm5cVwmiCqprk/Wur1bw9MqtJ5imo3oEvsXr:gyqtd/iwDR9sctbY3p+tpk+Ow9MqtJ5z
                                                                                                                                                                                                    MD5:51E70AD8FC9D1E9FB19DEBEB55555B75
                                                                                                                                                                                                    SHA1:4ED2B2D4738AED5786CFA64CBA5A332779C4C708
                                                                                                                                                                                                    SHA-256:775003BE577E8806F51B6E442BE1033D83BE2CB2207227B349BE0BF16E6C0843
                                                                                                                                                                                                    SHA-512:E064A477D5B1F8C56B4741BA606EED764B779A5D9870B8C193771BF0D904350AED839AB21602DBF5F376F7208B8CA24F64504D73EC6A0C5C08C5F0ABC7C466D4
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK........v7->................META-INF/PK........u7->m..f............META-INF/MANIFEST.MF.R.n.0....?,|j..#.k.F.Gb8...N.C..-.-..)......C6..-z#.;...3.R..X....J..bM...0....."......:#..b.....5_ZW.a.K..P+S.........s..].+/....W..G...un.3.....o0..7l.pc...,..2...\....[.or.&.7...\.......qS.w.7h5.jT.e..7..(...B%"$m..Y..RI.C.yM.t..5.8.x\N..%.A..v-....`UB..P.e.)dZ.""Y$.l.-....u.4..w.A]......t...U{v<...j-.(#...T..;0Ri.Ka...QY..i..7v."...Q...u....N...3..?....b~.V-.].f..4ddlmf..?.GX.* L......|E..G....d1c1.h.f......n..q.J.ob+....W.}.(`.{b...L<.V..;.J#.I.t.......:u?...V...E..h...|^..,.U..}..<.;...SO.......,v....PK........t7->................org/PK........t7->................org/glassfish/PK........t7->................org/glassfish/hk2/PK........t7->............&...org/glassfish/hk2/osgiresourcelocator/PK........t7->............I...org/glassfish/hk2/osgiresourcelocator/ServiceLoader$ProviderFactory.class.P.J.0.=.........@.L......@.}..c..6.tC_.........U..E..|.;...>=....`/@....

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\platform-3.5.2.jar (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Java archive data (JAR)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):1192357
                                                                                                                                                                                                    Entropy (8bit):5.873549735513331
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:12288:/UG36wdw3/ji64NzK2gclfUA6f5h+XZTH8+hoJBU:/ypitK2/Tf
                                                                                                                                                                                                    MD5:43CCE16A28F282ABA113F262A2A55288
                                                                                                                                                                                                    SHA1:BEAC07D13858EF3697CEEAB43897D70AEB5113C9
                                                                                                                                                                                                    SHA-256:F8E0682AAAC407B6E039C66C22F45CFCA12EF00038F4A319045037461F19B714
                                                                                                                                                                                                    SHA-512:0ADB76CFD649F885E693C8C6BC5FC030507EEB0556AA3CB2CB60B4DC2D1BCECF236F714BDB83B4893F7BCA33E1EDE222CFFB1E3BE267D888FB6B686C4785E27E
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK........P6.B................META-INF/....PK........O6.B'..k...k.......META-INF/MANIFEST.MFManifest-Version: 1.0..Ant-Version: Apache Ant 1.8.4..Created-By: 1.6.0_43-b01-447-10M4203 (Apple Inc.)....PK........N6.B................com/PK........N6.B................com/sun/PK........N6.B................com/sun/jna/PK........O6.B................com/sun/jna/platform/PK........O6.B................com/sun/jna/platform/dnd/PK........O6.B................com/sun/jna/platform/mac/PK........O6.B................com/sun/jna/platform/unix/PK........O6.B................com/sun/jna/platform/win32/PK........O6.B................com/sun/jna/platform/win32/COM/PK........O6.B................com/sun/jna/platform/wince/PK........N6.B..U........0...com/sun/jna/platform/FileMonitor$FileEvent.class.......1.<....&....'....(....)..*....+..,....-......./....0....1..3..4...file...Ljava/io/File;...type...I...this$0.."Lcom/sun/jna/platform/FileMonitor;...<init>..4(Lcom/sun/jna/platform/FileMonitor;Ljava/io/File;I)V.

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\pretty-tools-JDDE-2.0.1.jar (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):18136
                                                                                                                                                                                                    Entropy (8bit):7.824179157484512
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:rK3M89MrgQl9OiKYbWWlCWiFRApPZ8MSuBaKYFjeydt8qWH4TUJ0nx353rzJDRt+:+QNbkR/oLOew8POn7Nby
                                                                                                                                                                                                    MD5:ED71B8A4C3EEDCD52038F2A8370057CB
                                                                                                                                                                                                    SHA1:202BEBE1F47D6FDACA439FA5806313888D1D04A9
                                                                                                                                                                                                    SHA-256:2B11118807E710E65412E0D3D1309D83209256A3838AE618A6FF6F5CD1F64422
                                                                                                                                                                                                    SHA-512:923E5D05CBA756E1C9243369F776AACA2B0E8505E9AFEE6E57726D60F33E68BBF72F46883B89728386DC382F28EBB3986BD2131C9675F63FB9B4069EBA7942C3
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK.........y.B................com/pretty_tools/PK.........y.B................com/pretty_tools/dde/PK.........y.B................com/pretty_tools/dde/client/PK.........x.B....Y.......9...com/pretty_tools/dde/client/DDEClientConversation$1.class.UmO.W.~..2.0.]^.k...u@.k.j]..........uw`.Cff....K...lS...&5....1.;.(qI.M.s..9...o_..0..m8.S-.tt...C......F..J......:.qM.T.u._i...&!.p..tb.!&&JE..2^..9.En .p.)gcC.@...E.a.....F(..... .#.R....X.P.@6D.1~ o..MOz.-.........bP..N.b..."..g.gI..\._tBO.i./...>G..}'..K...~n.#H.u.k^...(..J.;.\......h..z.U..X.#..B-.~V......q...F...KF..z.IOEw......g.$]?.<Y-...T4|m....d.m.....Q......w1@.n."&4..L.)..0m.[...10.4G.....%t..7.....|/..K.U.C.sf.{.HR>.A?...[..x~.h..rx-..`.?..".g5...4{.$..{....*W..&.N49...../-..J..f....g.`>.YB..1.dzK.7N.g.....b~_.....z;;1....2..x...4..O..~.h..R..0.^.i.._.z.....H!..`>...<GK.O..%.O...52..$.........g...A.I.l...h.i...m.K.#<.i......,...|g..E./...7.m.mO~....|......._..<K..r .0....n.......Y.J"..d...

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\property-1.2.0.jar (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Java archive data (JAR)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):156881
                                                                                                                                                                                                    Entropy (8bit):7.762969978142032
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:tiEEx/OjKJSNrtBCiYsXM0omY7UKVzyAcbvOi674laSyjQb:tVxI0DYs0uefcTL6BMb
                                                                                                                                                                                                    MD5:36E56C9B13E6A768187FC1A9EE68ECFF
                                                                                                                                                                                                    SHA1:4A2D03D3AB2D0ECB2771320A35764A8205C006BE
                                                                                                                                                                                                    SHA-256:3E4C789AAD32BDA167DD6BB3764CA6DD4726A515B0D2AAA1A4205F585E77CF7C
                                                                                                                                                                                                    SHA-512:800267BDE6467D9682153CA0241B3DE320536552996C97CCFF16F685E4F3E101F0FC777A736F91CDC2CFA26AE3B02C7E2A2F3AB85DEC0EF1EA0486889479F6DE
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK........)..:................META-INF/MANIFEST.MF.....[Y...~...?t...p..."....2.L.......(...U.........Q-.i._.k!.i..e...2..._.w......K.od..V../wO...*n..X.x.}.......^V|..?y.5...........M......:.........../+..,..i...I...wc....7.../.........y...{.$\.....+."..7I....&+....:N.8.....~Q...R.....k.Giv<.}.......4.....or....w..z_...._7ef../.w../w......sw....v^q.A ...4.v...H..gE.Mu7;7|.~..Yj..$...?.i....:....s..>..7nR./..i.....J......y..%..S........>g.<ls...9..q......f.>O...9..z.....SP....0..0..0..0.^. .........'.S$..}..m.<...:K..Qqx......b.*A..8^3..5%\.....>....f.'_.J..Ek.O.ho.76.,3...}\......<.sV.J.x~....g..]IF...l..)x'...0m....y...^}N......9...z.*+.9.....-..~.+.q.36bM-5.8Y.E4.]W.....=@.....L.^..(....r.$.>.z..<(5.Q..x.uOJ:.H.......G_..q...=8.#f....$...$.-d!h!..,.W.w[..Y.D...W.Wb'7..-k..K=1.(.f...P.~H".Ld.@QD...QxE.ViSx~..w.x5..F...).:......M..f#.W.P..Q...S.uYp..."..X.A...."Y.k.)..r....G...K..-..O...k.^5..U.V}..........@y.UG7..W.H.

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\quickfixj-core-1.3.1.jar (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Java archive data (JAR)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):788046
                                                                                                                                                                                                    Entropy (8bit):7.786417691497363
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:12288:/4GnZF04sK8CzwT1L1OqBdKSQtbKOgBzFU0M0AylRtVdZovkJcslL0:/jn/01CkRhK+9Bze0MD0Rt/ZpcslL0
                                                                                                                                                                                                    MD5:F318F3A9A707966A92FAE3389436B7F9
                                                                                                                                                                                                    SHA1:EFE8ACD5C71A67CF46FB7D23685F8939BCFE15C9
                                                                                                                                                                                                    SHA-256:9E9FF0266D17721AB12FAF601C4581D304CD92014EDB76E0ECE94F61C50207AA
                                                                                                                                                                                                    SHA-512:39DC6FBC85D5E3A725B6015EFC6FD0438D0BF5571B7FA69059C85737674D09E9FC8E5D6707FEC01B220B4AE4C6905859F4C5C0C2EB919F00601A071A73C60B76
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK.........,8................META-INF/....PK.........,8................META-INF/MANIFEST.MFe.=..0.E.@...u..k.V.B.........6.I....C..{..B.]...D.kk..1.,5#.6R=.z.k\q.9..nb.....K<..h..Ck...Y..@...(.rVHmDVI.....V.W.?O..p..ME5. C..Q......6?.v.YG.....c.8..PK.........,8................org/PK.........,8................org/quickfixj/PK.........,8................org/quickfixj/jmx/PK.........,8................org/quickfixj/jmx/mbean/PK.........,8............"...org/quickfixj/jmx/mbean/connector/PK.........,8............ ...org/quickfixj/jmx/mbean/session/PK.........,8................org/quickfixj/jmx/openmbean/PK.........,8................quickfix/PK........Q.,8................quickfix/codegen/PK.........,8................quickfix/field/PK.........,8................quickfix/field/converter/PK.........,8................quickfix/mina/PK.........,8................quickfix/mina/acceptor/PK.........,8................quickfix/mina/initiator/PK.........,8................quickfix/mina/

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\slf4j-api-1.6.4.jar (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v1.0 to extract, compression method=store
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):25962
                                                                                                                                                                                                    Entropy (8bit):7.811650269231441
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:768:wKfj67H7aOHXoGORsNn+rhf0kAzID3GegmzDQ:TW7+O3oGOunghpwmY
                                                                                                                                                                                                    MD5:75E1A2A3B84C59BF9D4F42DE57A533B1
                                                                                                                                                                                                    SHA1:2396D74B12B905F780ED7966738BB78438E8371A
                                                                                                                                                                                                    SHA-256:367B909030F714EE1176AB096B681E06348F03385E98D1BCE0ED801B5452357E
                                                                                                                                                                                                    SHA-512:ABA86178858B4EB876788A1D1BFA83FFD2EDF7A08AF45EECDC3A42ACC157C68D45CB6B578303CB7C93A941FF065624C623D877B279E3CC47BCF37724DB4612D6
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK.........._?................META-INF/PK.........._?..[....).......META-INF/MANIFEST.MF.R]O.0.}o....`.@.....N."J..jjw.+]W.n...6d.c.c....t&.n..|....l(..DN..w....e...%.....O.!..T;`3Y..dR..-.`..w.t..b.>.....#...m..(.f......5...if5d`.lT..+...-..;....~.Q.c..kT.2;KE_..,.`..l..4N...c..U..4>.*.^.......d...P.R..l.<.K...:#w[...U....7.B........h[..3..N.X..j....|.PK.........._?................org/PK.........._?................org/slf4j/PK.........._?................org/slf4j/helpers/PK.........._?................org/slf4j/spi/PK.........._?..1.....&...#...org/slf4j/helpers/BasicMarker.class.VYs.U..z..d.a..@"..ff.h.......'.L...:...;..D.wq_.5...FiQ..$F\P...7.*...'....N.0..|.{O.>...;.9......@;fB.c4.5...<.T".. ...*.1!V....!..*LB..!...u..&r...x... .......+a...a...xqX...x8.&d...8.Qa=V......kG..x.t....l....|./H....d.T3....=.%H.$T'.=g).5.d.!...g..I...*!..P.....g.S...[%.:..jZMj9...>yK...z.....$....T..o.{@B.FM....5_.5:.].c.g^..t./?9....H.Fa..]!.>;.>k\.IX.4.L{.;.9.>.f.

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\slf4j-log4j12-1.6.4.jar (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v1.0 to extract, compression method=store
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):9748
                                                                                                                                                                                                    Entropy (8bit):7.72059449707443
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:192:GZ4Wb2IT3VzVLZgkCGBX7h5sd4G671u/zot4ONraWLQqKQDAbWmU4:iPb2YzV3zs2Uw4OdJKhvB
                                                                                                                                                                                                    MD5:4EA379002969E41FEAB169D33815ED45
                                                                                                                                                                                                    SHA1:6B4973E0320E220EC6534478D60233FD1CC51C9B
                                                                                                                                                                                                    SHA-256:62382D95633A91AA7CE2976F1C6469164418DAC4FCF231021D8C11938E219343
                                                                                                                                                                                                    SHA-512:DA0674FA1D7526021F356629036E76022847B48F4FE9EE5554D8F242A9F9ED9F0AF5F1074AB8C18B4A7E8202F7F8C86C3E81E5BA97D96334A69109099CE417D5
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK.........._?................META-INF/PK.........._?].rG8...n.......META-INF/MANIFEST.MF..Mn.0....|......X.........b[.d...v.'..7?.R....f.)Wb...+...* ..a4..V.`/.C....... ..c@..G[ S^..h....z.{.c:...|.z_.*.X.}.,...cY22..wD...Q.O.B.B%m.'.....FB......NB.x......i.-."-..ZK.}..|.]_.h..+P...Y...........sa!....U.P..jUe.......1..F[Gg<....6aM.Q..P4../c....x..dF\..u.-HS...~.f!..-O...Ug.,n.....PK.........._?................org/PK.........._?................org/slf4j/PK.........._?................org/slf4j/impl/PK.........._?+$.*....N...'...org/slf4j/impl/Log4jLoggerAdapter.class..kp.....w-Y.,ccc.62....C.....0~..a.;..x-.e.,..W...I.4...I........`($.13......I;..v...dz...Z.V.p<.{w..{....gW...7n.....8....N.....98.B=..C.....8..q..Y~...;...y.<.y!........{..=..7...r...[..5~z..y..~.....o..8.]....z<..[....N....P......x...!....9.c.~..O...Z<.F..x".......>...X4..Q._.Lk......O?.....H,....e.X<.S........x. .......8pT=.."j4.....h.......Zi.hD#g....#j"QM.........Hu..4L...S:w.2.b+.D..

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\spring-aop-3.2.12.RELEASE.jar (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v1.0 to extract, compression method=deflate
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):338499
                                                                                                                                                                                                    Entropy (8bit):7.867668225211464
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:6144:FvaEXic0OGG11Vl/8rByv2hMSylan1ep5ew2ji5E59vV2G4r29DAiTq+:PXt0Or3lE8ep8a1Usw8i5Er4r29soq+
                                                                                                                                                                                                    MD5:B5A6EE3B858D3ADA7616CC3D7656AE68
                                                                                                                                                                                                    SHA1:216CB56450E9132C2AA5E31B40417BB5EA778F3D
                                                                                                                                                                                                    SHA-256:883D486DA80DFC68AD309BCC54B023F596A1516FB47675CA93E828E721E9FF0F
                                                                                                                                                                                                    SHA-512:C62575BE2F94739C13574D3679ED2BC1F630E2ED1B90AE365AECF3C97EFDAE06FEDE69B929833284A399596A5852388308FE3BB445ED93690D55DF88A2D5AF60
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK........!.kE................META-INF/..PK........!.kE..^.t...........META-INF/MANIFEST.MF.M..LK-...K-*...R0.3..r.JM,IM.u........+h..%&.*8.....%...k.ry......tC2KrR.....2..u...0T.m2.3.34..r.qu.v......PK........ .kE................org/..PK........ .kE................org/springframework/..PK........!.kE................org/springframework/aop/..PK........ .kE}...........*...org/springframework/aop/ThrowsAdvice.class;.o.>...C.Nv.6v.vv..F......T..TF.......b....T...DF....t............l....}d.... ..9.y...IY..%...t:....A4.12020.13..02..I&.V.PK........ .kE..i.Y.......+...org/springframework/aop/MethodMatcher.class.RMO.@.}.... ~.G<.A.........&P=..,e.bi....<...Q.i5.5$...yo.M^v.....@.{..c#.(6Ul..1(z......N.i.....#.4.L....N..=c(d.A....P.7F..k.....}K..W{y.R........9...K.P.C\9.~.M...9&}4.0.y,.L1.....SO.t2cL.bX.mz.....l...t.E..w..y."&.q|i.33....[.F..Na..), .p.a....P.%./~...^k.i..g...]..F..v1....).m...$.E.$.....~._..42.W...........pd.b,,.R\.ek.PK........ .kE...N...\...4.

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\spring-beans-3.2.12.RELEASE.jar (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v1.0 to extract, compression method=deflate
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):613679
                                                                                                                                                                                                    Entropy (8bit):7.910040172253245
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:12288:qKfbWQ57+JcsxLzBtKhH4yN0yDd3qydKY1q1cWZM2cihF:qKZh+J8hH4mqydKYYrZp
                                                                                                                                                                                                    MD5:3EEB562E2D6CF906F5AC1674BBBF1595
                                                                                                                                                                                                    SHA1:A1D13F4C8909986E1D40B81CD3BC8EF19A856616
                                                                                                                                                                                                    SHA-256:C79C3F5F5F62BFBC6A8637293DFFD3C7AF932755A2916393C232648492F01E2F
                                                                                                                                                                                                    SHA-512:4EB8E29569CA8242F4148AEBFFA5FE7972CD84D529514ED918A2E46FE0046F2EF31E67A038B628F0DB99550CBFD49703730A89D8057AB968F41823D682181785
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK..........kE................META-INF/..PK..........kE...v...........META-INF/MANIFEST.MF.M..LK-...K-*...R0.3..r.JM,IM.u........+h..%&.*8.....%...k.ry......tC2KrR.....2..u.R..1...2.3.34..r.qu.v......PK..........kE................org/..PK..........kE................org/springframework/..PK..........kE................org/springframework/beans/..PK..........kE..L.S.......3...org/springframework/beans/SimpleTypeConverter.class.QMO.1.}.te]...?.. ..../...1bH<.(X.....<..&....q... .6y...{.~~.}.(c..5.)......M.......X..4'...Q.!VS....KW\....7..J.....Z....3w.g(..|OK...| ..~(..w.RC.<..y....F....P.n.s...f.....;XB...W..9.}..F....Ml9.....u=....6..S.0T.s......YG...EO.F...Jhz..z.Cy.....Y=...<..T.......h...6e..Q.d..`.wDn).>#Vx....D.L..6`.p.I. .C8Tq&d.`u,..3..PK..........kE(.........../...org/springframework/beans/PropertyMatches.class.W.W...~fwvgXF...b].+...bC[5Z.LI.5 F1.awXF.....i.A>l.4m...4..6=.'9m..s..=....?......m.{ga.0..0s.{..>..s.;....z..n.....h8+.f..b...l.9XB6).y.S1.`B.

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\spring-context-3.2.12.RELEASE.jar (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v1.0 to extract, compression method=deflate
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):867531
                                                                                                                                                                                                    Entropy (8bit):7.865365062135231
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:12288:ejWovawIGmhHK1nvQ+MMgnv0aESYlLc9zwpR5pi7H9dYdo0HLSbxkLdk329G+lv:ejXvaav+Mgnv0/LizmjpCH9deTioqP+9
                                                                                                                                                                                                    MD5:C346A369CF96D1F04A70A65FED340D52
                                                                                                                                                                                                    SHA1:2FEAEA75B4A188129BABCE4B149197FE10DCE6B6
                                                                                                                                                                                                    SHA-256:4FA5673825EC6982736982C71418DCE4AE83CBB689BCA653493209DC1309780E
                                                                                                                                                                                                    SHA-512:2E02E9EC7B253DB9BF4CF7B15FA8080B06A74D5CF2CCF0D87EC26AC5220BA579759BFCB922A5741CB5C7916E6FEEDCE11E7E8C3A9117B30DC898342A12E991EC
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK........+.kE................META-INF/..PK........+.kE.^.x...........META-INF/MANIFEST.MF.M..LK-...K-*...R0.3..r.JM,IM.u........+h..%&.*8.....%...k.ry......tC2KrR.....2..u...JR+J0T.m3.3.34..r.qu.v......PK........*.kE................org/..PK........+.kE................org/springframework/..PK........*.kE................org/springframework/cache/..PK........*.kE..[R........%...org/springframework/cache/Cache.class...J.@...i...Z..z."...<{. .E..z^.1..$l...<..>.8.'..qa.g......z..p.........Rek~4.,.Hz..lf..*..A...zc.8..W.Qq..$^.&.k....../[.....Z|...7.vm:/L.W..>...).k.--v...ZT...y....$..I.tL...X..^d.pQ....4.cB...m#...'a..O...q>..}~..#.Dw.w.b...{N..w:.ttp..#.DC!y.]...PK........*.kEU..>........2...org/springframework/cache/Cache$ValueWrapper.class.....@.DgcLL.`aoc. ...A.,.....x..D......\J........<_.......:1W..t.M.].L.X.N)G....ZG.N2nB(../.." .s......Z.....#Zrr.Y.G-..5!....X..,K.........`......Y...l..q.9..PK........*.kE..A.....D...,...org/springframework/cache/Cache

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\spring-context-support-3.2.12.RELEASE.jar (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v1.0 to extract, compression method=deflate
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):128645
                                                                                                                                                                                                    Entropy (8bit):7.898525132436497
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:8huClo5mgiMo0neO8tXRGBxaSZhRoXR+e3yijs:8huSgiMo0e/exa7XVyio
                                                                                                                                                                                                    MD5:A396DBFAC39E458225803F946F7537EA
                                                                                                                                                                                                    SHA1:9EC51A7DD751F4049D28C91E4E65326060922F6C
                                                                                                                                                                                                    SHA-256:A531BED14D5501F99C0DDD5FD4DE07C095F8F24A9AE652E949BA2215AB6709E5
                                                                                                                                                                                                    SHA-512:CB8D54EB5257CDCFC1BE289D06E9773EA237C96EE8B07659F22D1815E3EE62CF01CB10CDC1E244FFCB4381778B2C8AD9CA476ED72269B5B759B0B71C9CBD2CCF
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK........2.kE................META-INF/..PK........2.kEEj..............META-INF/MANIFEST.MF.M..LK-...K-*...R0.3..r.JM,IM.u........+h..%&.*8.....%...k.ry......tC2KrR.....2..u...JR+Jt.K..ZJ0T.m5.3.34..r.qu.v......PK........2.kE................org/..PK........2.kE................org/springframework/..PK........2.kE................org/springframework/cache/..PK........2.kE............"...org/springframework/cache/ehcache/..PK........2.kE}..gq....#..:...org/springframework/cache/ehcache/EhCacheFactoryBean.class.Xy|..../.d6....B8...I`.p......@d...c.;I.vw.......j/AE..ZE-..&....b....Cm........fg7...L._...7..}.....{.<....`.....d2..p2....LNe..7^.__.G.4.=.....<...&_c.u&g.<...L.b.4.o2...g..m.|...g.<..y&............^..E'...x.........'...W..x...?._../.WL~-.....o..7.[^.;...<..&.d.'..3...g.*........M........?....V........mf{G@p.A.1..0....0W@A@..y....b...$M.i.?..WR.RgPF....A..[.".[.h.G.H....WC!5...........D?O.JaI....5O..#.....iZ.....B.Uq...W..%..iQ..%!..9(....[...KRy...f.

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\spring-core-3.2.12.RELEASE.jar (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v1.0 to extract, compression method=deflate
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):885239
                                                                                                                                                                                                    Entropy (8bit):7.8983244651944595
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:24576:YeD0sq8eXz7WrwtLhNwZgSoZ6yK/7TXwDdlz:YeDL9guwtlyZMu0Dr
                                                                                                                                                                                                    MD5:C11AB58FB90FC49EFF799B4B87B5CB8F
                                                                                                                                                                                                    SHA1:6BCA909D614F349F18AEC2A924FFC8D28AA9EFAB
                                                                                                                                                                                                    SHA-256:5DC4567DECD59A90E76A46821AD84B0F4494AE899B150D20EF09580D5D8F6070
                                                                                                                                                                                                    SHA-512:BCC4513D9E92659BFE7D2488CC666C7556BCE5B73DA2D8DC4F308180CE2D269A803BA2C87C2043989A10C4BE0F5AAF86F1893F7A9B5E74DBE8197BA54E6A0AAE
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK..........kE................META-INF/..PK..........kE....u...........META-INF/MANIFEST.MF.M..LK-...K-*...R0.3..r.JM,IM.u........+h..%&.*8.....%...k.ry......tC2KrR.....2..u..R1...2.3.34..r.qu.v......PK..........kE................org/..PK..........kE................org/springframework/..PK..........kE................org/springframework/asm/..PK..........kEjT._....o...+...org/springframework/asm/SpringAsmInfo.class.PMK.@..............Y.JQ.....*...[..I.wy.<...Q.f.....f..y._............B....W.I4..("..JV5.u..;.......$8G.)....N..B.YSf\..0.8V9+R.E..E.~...0Vz.Vk-.r.Y._.~.YU...&U..:'..jt.....=].g.`.......F.MX0......B.<.-...44....3....}.....7.........`.c..[6ph].oPK..........kE................org/springframework/asm/util/..PK..........kE0..~%.......4...org/springframework/asm/util/TraceClassVisitor.class.QMO.1.......(..:...g.......H.sw.kq.n.....?..e|./.=.&/.Mg&...w.gh.P..........r.re/...p"...D...x".;X!J...r{g..f........P..j>....8#...Dd.0...o.U....Iy1#.....\h..E1.s.2>

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\spring-expression-3.2.12.RELEASE.jar (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v1.0 to extract, compression method=deflate
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):196425
                                                                                                                                                                                                    Entropy (8bit):7.9016252417898
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:OXzk2q9kw/Zz5CwzJhF6z32qH3r9Tr1rbsxOxFaz9hYJsPkHU:OXzk2otC6bF6trp18xOk9hLz
                                                                                                                                                                                                    MD5:DDE18B2DE9E0586381145805B8082774
                                                                                                                                                                                                    SHA1:6FCBF13701C2DFA6EDDCA2F54165ACA2A1FF4903
                                                                                                                                                                                                    SHA-256:296B818CC516F16D48D831037C40002CD9C3972F3AF130EFD675B7C5B44D7F3C
                                                                                                                                                                                                    SHA-512:81E0275D339462ABB97735B48F56AB63EE30F3CC52CA8ABC64E3DF1D497F02A3B01B03B556212153DFEFCCFFDBA9CC6BFDBF63BB0B3C90C8934BEF9716DB0C5D
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK........!.kE................META-INF/..PK........!.kEq?..y...........META-INF/MANIFEST.MF.M..LK-...K-*...R0.3..r.JM,IM.u........+h..%&.*8.....%...k.ry......tC2KrR.....2..uS+..R.A.c(.[h.g.gh..............PK........!.kE................org/..PK........!.kE................org/springframework/..PK........!.kE................org/springframework/expression/..PK........!.kE....P.......2...org/springframework/expression/ParserContext.class.QMO.@.}.H.R...=.A.C...1.&$.....b...bi.(..x0.....2.....{.7;.........6.5l....G.;.v54.(Q....=.".1....2............-3.......tg.)..:_.%.".....T. ...P...gs.9C..yK......K.X2....}tu..<.U......$.\w.@.'...C...S..).>X.F\:..L...r..zT.L.R...*...%.RB.y..UJ.*....).S*.Mld.....P..e24<...j....B./.B.M....:.w..W.^.~Nd.tg..S...S.C#T.gIQ..PK........!.kE...p....1.../...org/springframework/expression/TypedValue.class.TkO.Q.=..m]Z.@.gU.>Y.....Bb....!..K....m.[..%Q...&.(...J....e..s.=sw......$...@&....ra.C.b".?2.&y..aJ..0U.Sp...A..~.asA<.....2y..k..mV...

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\spring-jdbc-3.2.12.RELEASE.jar (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v1.0 to extract, compression method=deflate
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):405963
                                                                                                                                                                                                    Entropy (8bit):7.878574402168652
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:6144:THyfu7HVqHVr+ktuElzb1qmxyBut4ZL+13D7Ho6rJgOl2j+acCQnTK7HZjR+M1Fg:THQ61qHVrzTzkButN33I8WOgavCT1k
                                                                                                                                                                                                    MD5:B796E0340603C27F70D7FBB40CAF2B1E
                                                                                                                                                                                                    SHA1:7DE9EEF0C6105381551E3F869149DC2026A0741E
                                                                                                                                                                                                    SHA-256:B6C46EC5B731377818B4FAF50B0F1E46A285D984ABAE686B63A618DDDF83F46C
                                                                                                                                                                                                    SHA-512:93EFA1B89615EBDA1ACA8A4560BC0A2BD2B2A84E39982757E766E6F1915E48E2CD989B4D99C1974C680D8B73CB4E894F9119819EC8A0A1BAD54F9C92F30DCE99
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK........-.kE................META-INF/..PK........-.kE.vu...........META-INF/MANIFEST.MF.M..LK-...K-*...R0.3..r.JM,IM.u........+h..%&.*8.....%...k.ry......tC2KrR.....2..u.R..1...2.3.34..r.qu.v......PK........-.kE................org/..PK........-.kE................org/springframework/..PK........-.kE................org/springframework/jdbc/..PK........-.kE...hy.......2...org/springframework/jdbc/SQLWarningException.class..KO.1..Oy."./._......1.....dbb@]...U.bgP..&..k........m....~........-.$.E:....d.d.,......}.|..w.lR.1+..S.).m..Y.T.Z\. ..E...,..N..d..J...M..Tr......A...1..F_I.b.B....=.?...s...-...?y..X. =4?..OD........1.9f..P..a1.%,.......s-..a.:..kS.9B..V?.>=.m.y.GG.Q.T.R...o.w._........k.7D.[../.Pc\E'.........S`.ScB.@AY7..X..0.d.10.I......4f..m5.x...w.....@......TU.\s_PK........-.kE.).@V.......;...org/springframework/jdbc/LobRetrievalFailureException.class...N.1....*.(.z..F..x0.0\T...&B.w....-)...D.....B4Q.`.....~...|{..+8NA..t8t .@..}+".W......3..(.

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\spring-orm-3.2.12.RELEASE.jar (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v1.0 to extract, compression method=deflate
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):385600
                                                                                                                                                                                                    Entropy (8bit):7.89042745452337
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:6144:ty0mzAdsTBv38ayNW/26v+DZNzxwf8ZxnsbwutZMFjw6vC/06HZqcM9FVyF3XTFC:suwVyRVbIUcewXWUlOV3nx8G
                                                                                                                                                                                                    MD5:DA5C4A95E68CDEA21CA071658CA2E5D0
                                                                                                                                                                                                    SHA1:87E8DB0900866DCB352BDED740BE06BF7FEF4E93
                                                                                                                                                                                                    SHA-256:B3DFE0F2C22C913D865B26423AFAF3CA0A6AC4A0A8996139FA0DB960489C5B47
                                                                                                                                                                                                    SHA-512:F3F90F49ACB8DDF08B7002E0E78FBD9B2E4F286BD7C5BE6183B367455809FBA245CB61828BE8E0899802ACF5A1420999DB316A686B0E4A71B0BBF823DCDEB7B2
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK........F.kE................META-INF/..PK........F.kE.u..t...........META-INF/MANIFEST.MF.M..LK-...K-*...R0.3..r.JM,IM.u........+h..%&.*8.....%...k.ry......tC2KrR.....2..u.r1T.m2.3.34..r.qu.v......PK........C.kE................org/..PK........C.kE................org/springframework/..PK........C.kE................org/springframework/orm/..PK........C.kE...@........E...org/springframework/orm/ObjectOptimisticLockingFailureException.class.U.o.V..n..dn.nia..l..N...6H...ne. .!m. 7qS.$..gE..=n.m............Qh.^_\.IK.)....|.9.9.........R...$.....|..\P.)_?.b...\..i.^.W.....5~...L..Y.....2.g8......?[.Z-.m...U.Y.j...#....N.<.5.....N..0.....9.j).de.s7..]2.1$g.M..N.^j.Wmo...n..<......P2..].Zl59..g..M..(.^].v..;uJ.)...9.[N...s..6.r..{..v.%SeH..v.....a"Z..../n............j.^Ej.......0.........z......H....^.....p*...!2..n.wb.m{e{...Z..<Nq .Gp.......f.N.b{...4X....e...../...&.........3x.%...t7.F....k..]Q..).0..0.T.ss..7&]....b..?."..~...-.!6..]O[..0L....

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\spring-security-config-3.2.5.RELEASE.jar (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v1.0 to extract, compression method=deflate
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):406830
                                                                                                                                                                                                    Entropy (8bit):7.923672372299203
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:6144:tackqLNEt/CJceogqUvb/Wuhi5WHdDHC//y1mc+eAJF+kKvAKAfZdE29Bl:taczNEt/R0P7WuRVHOy1mciFm9k/9Bl
                                                                                                                                                                                                    MD5:51826DCA625FD028C82F0F239AB0D236
                                                                                                                                                                                                    SHA1:1286983A3AD4549D7F7FD0F3784E747667B44B70
                                                                                                                                                                                                    SHA-256:61468C0429C568BC1DDA98B81DBC6C8B74E6CBFCF76B75ABBA50BE5944A5708E
                                                                                                                                                                                                    SHA-512:A320DCBB18A8980434EE88C92DC00D98D0B8705B6510A3F39A886FCBCE127AC6000A397D3472557D9E0BE263CC4028234F7C6FAB19624AFDCC9AB381171BE61D
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK........*Y.E................META-INF/..PK........*Y.E'..Q....xI......META-INF/MANIFEST.MF.\Ko.6.....0|+...G...{h...t..Y.'ZfbeeI+.q..;C.H..!...Mb...p8.q8.WVd..i/.....z...\..>We.^....._...!i.:+..kv...4<=.Y...eq.=.<u._6....U..._....ow...c../.....I.Y...u.......C...>..<l.Ys!.'{HXQ.-kAT..B^....R...m.:.5C.<.%T4.b...C..I|...L..,..DU...'V.E..s.&.z.....8.`..+.j.H..t.U]>eha..D.....C...,..70.e...Q..8.QBND.......Q:X........?...<W..P.5... O..-.Fy..f.(4.....".p....>.... ....Wh....;;.P..S;.4...w.59x..;B.......P.Tm.T.i...W/...........<."./%....#{b.I.3?.....H.kYS..'Y..v....x........5......^...Z...8..%.a...q.,.y.....S.1...)-.k.l...|.t.|.N....xN.....>..H.(x.d..o.........y..q.[.g.2.t..1.1"{...T...Y....V...g.\...d..D.....OH.d..Rhg...i..........U...v..v.. /[9.B>.t?..ar.[b"..S.......m=..cv...........A...fyr`m..n<B....;9...9. s.A.hW).Y.BC _%.....0z0....0...7M.2..8.!)+^dz.2......S.@...aJ..q.W...5.>...B.4..Z.P.S.J...<.|.;R~...!.4..Qc}#.Ja.....Y...........<Kb....T*....T

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\spring-security-core-3.2.5.RELEASE.jar (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v1.0 to extract, compression method=deflate
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):366941
                                                                                                                                                                                                    Entropy (8bit):7.799625108398948
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:6144:ZGdqAvLzEZHl8gSJFsFfj2kOUJI44VwdXGMLffUDlIreJUHeBh0Cl5Arve67:ZsvGFsJFcfVOU+AGM7fUJPJcFClu/
                                                                                                                                                                                                    MD5:C7F15D9647BD568AB8FABE480BF0E50E
                                                                                                                                                                                                    SHA1:D5DB43E696A02186AB7E18F8C9D99AFBDE94BD77
                                                                                                                                                                                                    SHA-256:5F14998003CC4737FF66B8A4044D607009C4B25FAF87564D5165CF5AFA1B275B
                                                                                                                                                                                                    SHA-512:1E804205CB15F1AAD77E7FFD1D5D67A9078A17FAB561AF447BFEF4E34725B24CA23AC17B1080020A695A0109BEC9B26DF1468AB58263B3E8634967427DA3AA7F
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK.........Y.E................META-INF/..PK.........Y.E.......+......META-INF/MANIFEST.MF.ZIo.6.....0|+.....$.C[.P.S..`.s.e.V,..)...{.b..&*E..M....._i.?3Y.|gB._........fG.g.+..DV"/....\..d.Y....,cR>.6._.....3.....b.......,......P^......t[...+.<.5l....`km..8.'.,y.@-|.L.NH.~..M......Me..8=&{..D.0..x.85{.ch..A...T3.p.Bco...q.j..g..(.r....R`]}..!V.y...s.g...r&......../Xh.O..3..,. ...9F1..Z.9-3Fr...X...pL.....m..0...*.'N..T.cj......T..gz.0..|u..1z\....\.r.U.s.nO._.XM.B..'...^.T.N...;m.-%y.Y..e..=><8M.p.........P[.].0..@......UM..y3M.j...2.y..+.....e.*..p$i2|.g....*._......i.C....g..W.ud.j...'c...6EVD=.\/].39b..Q.J.. G...a.y.u.[;..iXgf........d.P......j. W.gj..I.R.Dd.q....@.a....K..<.VPl..N...I...ISW.ae.w]e..9^.VQ..G.+.....L\....J...L..a.>f.67...D8...a.![.Rq...J.E..}.o..M...7.1....h.,.>/a.p...#J...(..Gv...H.3.M..M.3)$..P/..%@....,h....;.>b-G?.h.a.H..~3.S.e.Q.......$.$.*....H.....f'...]..d......_fu..+,T[C.o.8..3.=..a......U....(..+!T.6r.?r.

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\spring-tx-3.2.12.RELEASE.jar (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v1.0 to extract, compression method=deflate
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):242532
                                                                                                                                                                                                    Entropy (8bit):7.81939738950208
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:OmJ2ojX0Z+u7n/FQrSb/giCPBuYKqc82Jn7W2Sk3kani4huHorMRiGGBQGR2BW:V9X0v7bBC5/w7WHyPi9jEQW
                                                                                                                                                                                                    MD5:00CECF7D4C56A148AED65AC728D62014
                                                                                                                                                                                                    SHA1:E0422BAA59EDA8A9251916E249633E86C892175C
                                                                                                                                                                                                    SHA-256:BA9F749C3A957E731BF0C3C955BA06FDEE0F387416B425232AEEB5C3829D615E
                                                                                                                                                                                                    SHA-512:10DA6C1E33FF89B3055D5B636DC441F1A33576BAE2A2EF66FCFD045A3CF71805360CD8FB5BD3889AE53B930E8D2A9307BAC3C318456E5099D564B1892B11E0C9
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK........,.kE................META-INF/..PK........,.kE....s...........META-INF/MANIFEST.MF.M..LK-...K-*...R0.3..r.JM,IM.u........+h..%&.*8.....%...k.ry......tC2KrR.....2..uK*0..-2.3.34..r.qu.v......PK........,.kE................org/..PK........,.kE................org/springframework/..PK........,.kE................org/springframework/jca/..PK........,.kE................org/springframework/jca/work/..PK........,.kE..9{[...#...:...org/springframework/jca/work/WorkManagerTaskExecutor.class.W}p.g..mrw{.[...@...-$.....!.B.K.i%)...n.6a.....GB..V..Ym.U[m.U..%.F...E.3.Cg.C.q.Q.P...<.n.{.I...........~.w......6....x.6.#<|4D...x...!^.......0.....)...c...2>.B...'......x... .!4..0.<.......K<<..e|%.....O....&..2..a........p..o.../..f...!..d...C..o...Z.y8#.2.'.%.geLI.....>5..h...z..G...YF.k1+...D...m.j<T..&.NP.jj$.g.zj..-.J....S...U.....A..s.].X:....A{t..R,....#...=...*.[.H.u.....GOi...!..W..BD#.&.......>.[......q`..M.H0:.W...W....Z<c...yA&c..-.>.v].c....d.z:..0l.6

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\spring-web-3.2.12.RELEASE.jar (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v1.0 to extract, compression method=deflate
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):631768
                                                                                                                                                                                                    Entropy (8bit):7.884078646028978
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:12288:4XrM7JMcT9JDzr/f9fEzZqv6UYKCDJrHEq:f7a4DP9fEzoUJkq
                                                                                                                                                                                                    MD5:E9DAFB4D999CCE8435949859932CE7DE
                                                                                                                                                                                                    SHA1:01CB1FE35B23C7D6946CA8D1897698845D84B18E
                                                                                                                                                                                                    SHA-256:33A6AE266BFB3703B82BA7D155612C955AF92948990D839DB70605D2CAE8906E
                                                                                                                                                                                                    SHA-512:3C89D654867BF48C8E6CEB2EDB5B8DC5EE9F167EF31E55E7836692F92CBA45342FC1F96FB9854498958C3A5062110647C10995695DBB373266CD6445A75B5453
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK........<.kE................META-INF/..PK........<.kE8k.*t...........META-INF/MANIFEST.MF.M..LK-...K-*...R0.3..r.JM,IM.u........+h..%&.*8.....%...k.ry......tC2KrR.....2..u.S.0T.m2.3.34..r.qu.v......PK........;.kE................org/..PK........<.kE................org/springframework/..PK........;.kE................org/springframework/http/..PK........;.kEa..@....S...0...org/springframework/http/HttpStatus$Series.class.VmS.U.~..d.......--.B....Z..i.....4b.KX..e..M...#..../:..2...eFg......MJ.....9..s.s^.....O....'......../c&.+.e2.w.D..........L.S.>.l... .4.....:..c...D..W...c.=.....e...i.Ss...ymnv2-..M.2....8....b..t..'.....W]c....>H.y.fb....^.........d2..S..Y.I..2.$. .dZK...Oe2s...Tf1.y&...v......].L/.t.......(.v".wFS)YX!..i.1gK..;o,.#..s........H..O.......KS..3.E....Ar.u.C...,.......\.....[.(.Z..;..e.....4..v.(C..0H..F..C....?L.....M....Y..}*P.e,gW.D)S..j.rJ.cg.;..q....)......u.U...b........U.!.b.k*b.S1.A.k...l....../m....,gnzV...8>.wJ..b.......:7./.F..\..F9

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\swt-3.5.0.jar (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Java archive data (JAR)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):16141
                                                                                                                                                                                                    Entropy (8bit):7.908028090301315
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:sFq3xRqXW9ve1fME4Ck7BaGDUPDgSHqh35i49YB1sRQWD:crm9mf4ZpGzHqhXeBiRN
                                                                                                                                                                                                    MD5:35315811FC55E7C4DEE2FFCD3F2A430B
                                                                                                                                                                                                    SHA1:336F0063C646CD059B6A7E4EA1D2960C3D8E9D4B
                                                                                                                                                                                                    SHA-256:F8605F22655A41C0FF832DAD9311FF23074AF82F6F5FF323AB35E8CD73159166
                                                                                                                                                                                                    SHA-512:810EEFD8CCA23BEC075D33C91D700F8BF4B3CFBD5194368ECE700A0C8120652D41CD8CFE1C2F431AE60461D616FB463F08788BFC6239D669D615145737DA655A
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK........P..:................META-INF/MANIFEST.MF....}.MW.0..........|....E@A..{.x.4.@..$.._.S.J...y.}f..v.(^"...$$f.eT.r....G..R............L}`..|....$.1....X .......`4@T..n.k.B.>..G@.z9..~.f..^R...V|...#...L....s.,.W7...'H..n....IU............q?.j.....je.X........2..n...i....dL.......&.X......G.#..Gj.jX.p.....H..0..._..*..r.h.g%sa_....9G.....~.Gz..0..*=.OAs2..BA....t.IHP@n..L..H_...7...B.9g..G.Pp............tQ....}.......}.{c.X......}mk....a....~.l>u..L.eP.o?Qc.m.'...a.<......~..P...u..7o..Qg.........P`.|.'.. JA4..k.d.z..S.!.<...n.}.........W......r1^.......X+...;D....J.......mm.^.M{....D.9....<.ll.q..pP.7..b.....+...H..PK.....kf.......PK........P..:................META-INF/ECLIPSEF.SFm.Ms.0...3......U.......XP.jK7N...0...}iW.qw6.y.sB.2$.....5).D..m8..@....Z.>b$.T.......&..I.o.x3E.....c$.^..o.T4...}..U.....p7.&.!8.5..]P.fg.*..........N.u.4..Q.'....&..Z...m...w.eL.k.Wg...T.k."#Y\...$...+ ....cJ..+.%=(..h.......>.$.aph!..o .Ud..u.I.}

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\validation-api-1.1.0.Final.jar (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v1.0 to extract, compression method=store
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):63777
                                                                                                                                                                                                    Entropy (8bit):7.56111950694482
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:768:fK7EUX2gKq/jvUu2EIW0/3VDch1JXEs8igb0ldk2wkz/t/+yjGDeIsrAkNk9AZlK:4t3r2EIhR8Cz7sd9rT6DcrVNmAm
                                                                                                                                                                                                    MD5:4C257F52462860B62AB3CDAB45F53082
                                                                                                                                                                                                    SHA1:8613AE82954779D518631E05DAA73A6A954817D5
                                                                                                                                                                                                    SHA-256:F39D7BA7253E35F5AC48081EC1BC28C5DF9B32AC4B7DB20853E5A8E76BF7B0ED
                                                                                                                                                                                                    SHA-512:BC137C5F7FA6B7092F9FC233D8BE7D21D6767F8AA51C2E934B73692C82D28DBB410F55674D7B5A0E1523B514654339277B535B7F5BB01D457A11ABA2ECA3BBED
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK........Wx.B................META-INF/PK........Vx.BC.T....(.......META-INF/MANIFEST.MF.._O.0....;4<..G.2..CL0`H4._.+TJ....o....N%......9....xEc..L..*`..v.Q...z3.V......r..)b...........F.........w....k.@K.g.Mp..Nl..".q.o..9F....f.V.O..B.h.Q.km.M!.Y#..?X81.BA..(.8H({..|o.O.3.Z.[....\...q...?q..fBZ/|...T.:.Z..*.:.o..3.T,.{.5...A.........S...2H Z"....+.l&..P.Y............G...GE22.c.:...c*_\.~......J=..Z....C.."......6ND..P..I.jm.[..8\...,.5..G.O#.K6mn+...z....T. ..3H....8.I.3....q..PK........Rx.B................javax/PK........Sx.B................javax/validation/PK........Sx.B................javax/validation/bootstrap/PK........Sx.B................javax/validation/constraints/PK........Sx.B............&...javax/validation/constraintvalidation/PK........Sx.B................javax/validation/executable/PK........Sx.B................javax/validation/groups/PK........Sx.B................javax/validation/metadata/PK........Sx.B................javax/validation/spi/PK........Sx.

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\velocity-1.7.jar (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Java archive data (JAR)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):449505
                                                                                                                                                                                                    Entropy (8bit):7.9143813255747695
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:12288:DGSGMz/KkE9oPpYGAynsuwRz0qS9qEdhSz:aSUkEcpYGcenv8
                                                                                                                                                                                                    MD5:3692DD72F8367CB35FB6280DC2916725
                                                                                                                                                                                                    SHA1:2CEB567B8F3F21118ECDEC129FE1271DBC09AA7A
                                                                                                                                                                                                    SHA-256:EC92DAE810034F4B46DBB16EF4364A4013B0EFB24A8C5DD67435CAE46A290D8E
                                                                                                                                                                                                    SHA-512:E521785D947CAE1A02070B26A43D235B6319439A6364C58266D3F9C458F9A099406C10AAB5F51C5DB5BA541E88322CB35203C6758B4B8BB65F9539A345DA9A04
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK.........as=................META-INF/....PK.........as=..*.....<.......META-INF/MANIFEST.MF.X.n.7.}...X.Y". h..yH..H...\...wG2-...r...;..P+.l.I.fxx....s%....=.VhuS.c..W......P.oh.H...p....k].........xo`'....y....Y.UG...{.._...........]....[..-.D..h.D[...?...o.*,.DR...P.\~...ff{....7P..;U....WD.........u@.}.\...88Y.H..J.......~6.....;........s...(..@:GP.".....B(u.~.9.b...[.....u.I7......xf..B...zU....I..-.]....pf.......Z..)%.....{..7>/.w.w.@e....u.p......|...qz..%..........W.[w..,.:..8..OI...>^.........l.W.B.y......mx.S..p.B..n.La'.9...L..C<.u...|.xLX...C........V.)+j`D.3%l.TI.G..Q....=.#...\...Z..C.pX4.G.D..........f.7T.R......+...#bp..b.&....'.b..m3hsM..8..&.3'Fjf~..8..S....zC8H./.[.I+........".B..8.JL..p...S..D...]..~..O`.1..A'k.~&#..gC.FW..8..!0..^..un.J."vJN.D..D.....^^F.'.s...^..'.q.x.8$>9'^R(..l9#..q.e.:...4U...m.JhbK.^..p..Pc.J.?..J%$#D.O*'....i.%.....8...x.S.....2J..L........7GF..i/l....<b....q^..O..Wg.......%&...g.;.|...

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\websocket-api-9.4.1.v20170120.jar (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v1.0 to extract, compression method=deflate
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):42128
                                                                                                                                                                                                    Entropy (8bit):7.682605744014708
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:768:oHdxqjMg1yAhE060/hssgXSqaOXk4+bGNB1cVfgIPHknYU+1h:EYtEAPJ/hHgXSqaQKPH+6h
                                                                                                                                                                                                    MD5:CEE8A12A4512173AE92E5FA71C2212C1
                                                                                                                                                                                                    SHA1:BBCF8A0CA712F7957D57AE902F9EE21BF0E19FAC
                                                                                                                                                                                                    SHA-256:89EAEBAB6757B7FA31130E74713B49D0ADC26845D90C40F92AF15922BB2D22ED
                                                                                                                                                                                                    SHA-512:3BFD4EBD7BFBDB8328B15060E50709CE15913F46081A90601E88D0965DE4B91EB35BEAA5D3DEB0C49ABE64D3CEE2E29061D48D202455996FBA9A7B313F8B7A7C
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK.........Q4J...ek...........META-INF/MANIFEST.MF.T]o.0.}...`.0.DL..-M.C.xh..j..a...\...3.....:....TUD..{.>..N..306x.m..).h.{W......d.....k.d..R..).[HS.......?...&..3..R...H{..zMY...P..=Qo...z8....1...b}.P../L..~...%HkzP.`...X....v.....-....'W,].+.2..]/.....#.hpN.4..8...Q\......)y.c..d..........u.'..8.'.Y.o....m..f....\C>.@V:..\q.....f+..D4i....j>_.n.I.Y..a...X2Q.+...iJa...)...m..|qVe?..o.y.t.V...2W:%.:bg.T.'.l."..S.=..i./V.....J.{..,..=.Jac.c0..@iu.....-.....`.......2s$......t.j.j....S....-.8.R.S..P.c\/......sx...Y..?.....C........%.b..50.y...e#...Ij7.T...{...m..j].xs......v.q..LJU... =.8...z..q.....q.[M..zR....fS=..3.`v..k..&p.-.n.g7........|..PK.....ek.......PK.........Q4J................META-INF/PK.........Q4J................org/PK.........Q4J................org/eclipse/PK.........Q4J................org/eclipse/jetty/PK.........Q4J................org/eclipse/jetty/websocket/PK.........Q4J............ ...org/eclipse/jetty/websocket/api/PK.........Q4J............%...or

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\websocket-client-9.4.1.v20170120.jar (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v1.0 to extract, compression method=deflate
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):31717
                                                                                                                                                                                                    Entropy (8bit):7.860930120098471
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:768:r+76ABMwuqh6+X9NC9+P6OFZqoVwTNMLeStL:rLA5Zzi+3VqNMLeI
                                                                                                                                                                                                    MD5:0CC5AA8C66C693EBABBCF934A248232E
                                                                                                                                                                                                    SHA1:8858E4D6442F73CCF677119BFAEF3F84ECE7E2E7
                                                                                                                                                                                                    SHA-256:4C6B5F04F7FEB0C3D0EC0BA213363938275DBE2B12F4A8FF6BA2BAA646A33F8F
                                                                                                                                                                                                    SHA-512:820BD1284E6052C3C058F0F15C3FF3EB94415D6897453822A8375D02A73C4EB153F9EF0C8A6F2337719B1A02A4CAF3E6262E680855125E2A3E8BB9850D43B22E
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK........IQ4J....H...p.......META-INF/MANIFEST.MF.WQo.0.~G.?X<L 5&.]....2.:A..{...&.\L...........lB ..>..;.wLX f\..GZ..%.....8.%.>s.E"4...n....KNf*.=p].?k.-...C)x`2...x..K..n...l(....TE.L.uw|7..?.....r.....".=.}..+.Cwy(..c.p.f.>nW..`...v.......`....n.J.....gb@/.C.=...^.....k..A.[c..D.b&...]./....3.....&;.3.^....."...{1.?.."R.....5.R.....*.Fb....+i{.........e[0.t,...d.G'c.#...*.... 7y...2.'..*r.(.......,..yK6/d>..z..p....|...N.,q...|.bD..{'.A?<X....2....c<h.).5.Bs.).6H...Z.R....../....8..YD..5N....pj.8...._...xj..'....8.....pj...^.z..a..J.'N.8e..QXOS.8% Y:N.a..U.].`...hO..h...N}.!..g!..mWz...g .<roZ.....T.;.7@.....<..........(.G{...y...h-..+U.f.+h....[k.7.p?.I...J&.RHR.&S..i.1z=%..BBY.:.G4.qL..x'..E..ud.P\..Tq1..e....ON.N..u.).j...fQ*..t.M..S.}?..8..T[....s....L..3...%..9.H*....U.~.........~.V6...o...l.M.M...Y.88V....}..?.}j.r...h6..PK......H...p...PK........IQ4J................META-INF/PK........DQ4J................org/PK........DQ4J.......

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\websocket-common-9.4.1.v20170120.jar (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v1.0 to extract, compression method=deflate
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):199463
                                                                                                                                                                                                    Entropy (8bit):7.885693644124915
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:FS8VvTVKhmlP3cL/PS+RqNl7zSjfg4moi6CO9c/hSBZyAiZuWMGSGefdsLUuFL7c:lvTcLL/fMy2F8BviAWxSGGYL7c
                                                                                                                                                                                                    MD5:F007829B790FB2094A80FD02DC05F55B
                                                                                                                                                                                                    SHA1:F39AC6ACD2CAD905EC1D62C462C25403A8B6FFC5
                                                                                                                                                                                                    SHA-256:C22B0EBA59BBA7D7DCAE29DC4696B2395F2BAC636E3F198449B093CA37C3FC08
                                                                                                                                                                                                    SHA-512:88194059FC92A4E24DFA5ED06CF9E35BC60FB52BA5AB91E07610CAAC451C6315E3143F76BD79AF166584B80BA1791DC0F1B8A57B2D273F56467EEAD42856D2CA
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK........!Q4J.=..d...........META-INF/MANIFEST.MF.XMo.8..... rX$@DKN.u..q}haw.v..z(.....*RN..wFR$.$.)...5|..x#.X.,.T.w..@D.q.=....r...^..*{..+.#..!'K.._...........b..Q.1.<.I.R.;.===Q.3o.HV.0.,G....3kL...p@(.. ..=...K7<Rr....:6..q.....^..g..]..\...O/..^q..8......+zI......3.X.Be..\.....E.[s&.B..2.>.w9...O.]./..gZ.,.......;.........h.$"....l...N..S..`.VHu.zgdl....K."Q... .i..hE..u2W>.Z.Wx...bS';#.4..#_$....E.....=....Zw.{d+-........=......W...a..=s.H`..GD}.CB."...c.6.....y\[%eO..'.j.p..XX.<..l........*.>.7..VP...V!....1Z..~3.....-v..8.......!..c..= .1....h...!.. .%....@c..EW..N.I...}..h..ZP.'.fRj.`.@...pP..5.....@........K....7'........qv...Zq.8i.v5........j....;.....{.,...!V..... CA..pgM.7A.g2.O&.d. .I.#..L.t8.=w.Es.f..\...D..:.i..-}..n...d.8yw..^..1.k.lT.Y#9...4W.Y.....6:z..wV!...~.i....k.t_..H..U.. .NS.2.V.........y6.n.Plx....0........a.k.o..Mz.7..G.tz...hI.<K ..+..F.....>..3%...!.`.....B....M.....6..s.....o@.{..<.1^z...C<O?....e

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\websocket-server-9.4.1.v20170120.jar (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v1.0 to extract, compression method=deflate
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):34913
                                                                                                                                                                                                    Entropy (8bit):7.842815310061626
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:768:cdAtsqiNgUVm89SMvcHLUwlNiTyMAm0xpctjX:QAaqQgE9SbDlItqpg
                                                                                                                                                                                                    MD5:0BEB788190E652130A94600192867D15
                                                                                                                                                                                                    SHA1:C87DA0E86FAAE8BEAEAAF3F8E7270836C7C104F2
                                                                                                                                                                                                    SHA-256:379F8CF7A7378AC888E329C3FB678BC47DBBB1F7DFB693BB544E43AD5C0DAB0C
                                                                                                                                                                                                    SHA-512:E29F81042824E6BDD4AB812BF20819D72BA5B822686EE2F9FBCBC6B4B6153BEE26ECF70BDCCA3EC7A2B2778E237539785CC61614ED46162CC6A5DCE04ED415E2
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK.........Q4Jr..cn...i.......META-INF/MANIFEST.MF.WMo.0..#....VT"&I.h...].]A......Vn2.[.gc.......i...@..<..........^ V\..q..n.%a ....y......e.. ..o.x....J...g.....C.C..#3.#..[...E....'.a..>......K..^l.E(..G*.7.@...B.z..k..4.E......D.G6.Y1>..3...X.6.>.#...........v.l.MY.B[wk...R.....2.G2.....w.?.v.W....u^.h.r...CO./.1.........x,CS.r...Iqh?O...:....._I.?%.m.-S,..X.;..P%B.pJ.t2.!t._..z..z.OvJX...a c....M..|._.,....l..a.c..f.....K/..g.==..b.......I......k>1.q*2h..l.*3.i..fr.,>..6V!.q....3\..!Nyn..C.&...8&..).C...m&.4M.%...u.f[...9=._i.RG.P.b`....4M.).......q*..F1.d..l.i...5.t...G.]sk.n....0.|\.>.TsQ..8...ur..|.P....r....{&s...-.q.(5'....u......hRRMqO...].b....yv...ig...sjp.X....Rb...3j..-..vl..,1.i..be..n.@..!.bm.......5.....}D2.!c.`h.5X.]..8K);.I.s..|....8HW"...+.r...F.+bL........AM.W.z..V........T...t.....h..i.!.-...\......{..d{:..e..F..knv..L)3.gn.M...#........S...8.V...PK..r..cn...i...PK.........Q4J................META-INF/PK.........Q4J...

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\websocket-servlet-9.4.1.v20170120.jar (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Zip archive data, at least v1.0 to extract, compression method=deflate
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):21338
                                                                                                                                                                                                    Entropy (8bit):7.848740350449547
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:flWiPIJjmnp9nDbL+yeuLrG2A6xW4t9cJi/QrQblPYIQ4:tWiPI8np9DbLzLrjAIWe9cwYMBQX4
                                                                                                                                                                                                    MD5:7DC87F04CBDCC1FDDC90B17713C1AC92
                                                                                                                                                                                                    SHA1:E78937C6299B5C3FE4EEA9318D020566487012DE
                                                                                                                                                                                                    SHA-256:49A757232ECF236B012494BED1B47DB26E4F70682E379BF9613150688F478472
                                                                                                                                                                                                    SHA-512:2350EFEB1BBFF4FC380D9E4EA9F83541494A98E77D68F7C25A5C201D2E8BAC2E7A0EFDE2CD85D331B670A8B01B3B97E3F5AF2612FE4A9052492B0CA1095E83C3
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK........iQ4JA.."............META-INF/MANIFEST.MF.TMo.@..[..Xq............ EI..z.6..K.].6..g...Q..Y..1...}c&..... .\...w..\&....Aj...4.tV..e)..@U6.........R....:.B,x..x{'*. ..@*.".i:O....Q!.-[bV....0..+x.*~.C5d..c.\....... .o....O9$.R....^...\w./..$.5............aG....J.....~$.EB..y........d%.H....L.n22..F.u.._w....Oj..\/S$.&,~b3....Z..~^T.]4....'.B.V.}.C-?&.O.{.f).C.i..'A.>|.Jamp7.._..m....V.o.k...7...3......,.h4.4...*YZ..N.ey.J.<~=.c.......o%.....23_....P...?W.....4.s.......|C.c2 .'.j..Y....M...~...*?.....[j.q.S.......$..4f.w...-.Y.pgD.M..c..2QYD.U..'.Z@...g..)....X.8.>^.......$<}..t..xUR.....%.....0....o,..Y..Te...1t..#..........H.....z.... p..y.PK..A.."........PK........iQ4J................META-INF/PK........cQ4J................org/PK........cQ4J................org/eclipse/PK........cQ4J................org/eclipse/jetty/PK........cQ4J................org/eclipse/jetty/websocket/PK........iQ4J............$...org/eclipse/jetty/websocket/serv

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\xalan-2.7.0.jar (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Java archive data (JAR)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):2730442
                                                                                                                                                                                                    Entropy (8bit):7.961733032938122
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:49152:EtQNSzfN/D4Ks3S9uUyb+k46Az6bS9H2rwJonYZiSIUB:U7ezrUE+k46U2uIgIe
                                                                                                                                                                                                    MD5:A018D032C21A873225E702B36B171A10
                                                                                                                                                                                                    SHA1:A33C0097F1C70B20FA7DED220EA317EB3500515E
                                                                                                                                                                                                    SHA-256:BF1F065EFD6E3D5CB964DB4130815752015873338999D23DCAFC2DBC89FC7D9B
                                                                                                                                                                                                    SHA-512:29E1125F123FF3F605DE74B866BE800E78A5448609BD62F1F6A3DF13BC7668A37AD35936B7F8F0E87B60821B12EBFC86FA588EE972204BD7772D5BB077B42987
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK........#n.3................META-INF/....PK........"n.3 /.q............META-INF/MANIFEST.MF.M..0........bCW.J.Q.J ...]q[Y......,.C.{..[.@.z..g^..'c...}(..yat.]...>..,.K......c.....u.y...H..{..&.........<.4'..l....y_.q..Z=.a.i..2.....G.UT,,K.................`R.@.>.,.1..<...V.FI...PB.........D..t(....7.....E..../.".(=d/.z.....l<...X....um\.g..&........w..v..*.|J.;9...Orb.a...W..M9)y|.......F.....B....8.c.4.=.k.K......}...?.V.....B. ._....o.FiK..2MF....L./....V..3o,uMD........(kt..........?4U9.9.....xI .."...v._..w..t......zM.'.PG.n.Of-J.L.N.D....../PK.........l.3................META-INF/services/PK.........l.3................java_cup/PK.........l.3................java_cup/runtime/PK.........l.3................org/PK.........l.3................org/apache/PK.........l.3................org/apache/xalan/PK.........l.3................org/apache/xalan/client/PK.........l.3................org/apache/xalan/extensions/PK.........l.3................org/apache/xalan/lib/PK.

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\xercesImpl-2.8.0.jar (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Java archive data (JAR)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):1207073
                                                                                                                                                                                                    Entropy (8bit):7.9076955919078715
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:24576:tEESygjwyOtq3CFJESGZ9R4JQfbqbL0YUZrUHlCQgspjwty0xeR:tENNEZtuCFpY/42bu0YmUHLpjwtyweR
                                                                                                                                                                                                    MD5:00B9A88A935985D17B7621C74A498BB4
                                                                                                                                                                                                    SHA1:6E60617C9D81EA1EF96913C226900BC2D1E69C37
                                                                                                                                                                                                    SHA-256:A3C7AB3A9B292EAA3354AD7BA7887FF6EC5803BB821AEEECFA3F63B65BF874B1
                                                                                                                                                                                                    SHA-512:A23D2F03894240F8648F211927BFA19B4A09DE42C36636FCE9BE2CFD5BCA7F48313B8D024E862E5B76C0868A474E5495FABF2632202611ABC21041C0F06FEE8A
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK........:.\4................META-INF/....PK........9.\4oxR.^...{.......META-INF/MANIFEST.MF.]o.0......r...:M.E.@..FWzk...%vd...~..0hH.I.B.:...$:.}....m..6B...X.^...+.......i.FE....*ND.!..`)...n6o.{..b....k......J'JsK._.z.....g.....4.........C.*.Q...f5......j...=.r...Fy(.CY..\(..v.YO.........]q..S-e......5.....y.8.5.`...w,..<.....\/=k..XI....%.2..N.6J0.S....9`zkO}.*....m..S........-.i.v.p.I.UvO%..Q.t.Z.......L..U'.B..IfO.K....w..*....1..:...2.c...."D..J.M[..K=..?k"cDVn...wt....X'........*...!.x...Yd.....4+.....&.3..P...'.h^.!g...i;..R./....X...e..DgP...AU..!>tVo...pm....e.`.Vsi..F.ex.S]...G"O.*......:.v~U.3..3^........x......OyP.......]..?.K.@.Re....#.>..PK.........\4................META-INF/services/PK........).\4................org/PK........*.\4................org/apache/PK........(.\4................org/apache/html/PK........*.\4................org/apache/html/dom/PK........*.\4................org/apache/wml/PK........+.\4................org/apa

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\xml-apis-1.3.03.jar (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Java archive data (JAR)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):195119
                                                                                                                                                                                                    Entropy (8bit):7.706968549402945
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:AEcDYEdaefjX7tEOqbhp31ODvqTatMHLWpa9uU6M806Zz10P4umpf3HpI:TcDYEPjJtq1LOD2aqrpkUzOdpI
                                                                                                                                                                                                    MD5:6DEE9238DD2900171197104951940778
                                                                                                                                                                                                    SHA1:3845D5AABD62DC1954F2C0E84A799068C917AD2B
                                                                                                                                                                                                    SHA-256:EC225A1C66D4505FECD1AD7644CE4477E626F439FD9230DBF8338CEBDFC3A0E5
                                                                                                                                                                                                    SHA-512:49FBA74C5E3223B6A4F557A71C9EFB4069B04A337E7F2C1B4877D6DC5C812FAB7CFB5BE406CD4706261BED0D4ADEFA1A6190AC73FB02C201B316FFA3A066D3B5
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK.........[Y4................META-INF/....PK.........[Y4c.U.,...........META-INF/MANIFEST.MF.UM..0..#...V....u..Xh%V...l.^M2.W...N...v.....h#q..7o.L<......D...}.#.fc..N.......\./..P"..v....;h..<....I..j7...w.c..\8..pVq..8.\9%..2..u...h.....(9.`.$,.N..-%..b.A..D.w..'...fc.'.Z.b..+....n..........=...Y..D.&R....../.~.....^.....9...uJ..y.'..9..,..........2G4c!x.X0...SX.V.tI.Zf.t...#.X...U..g.]0;.s.t.p......P..3z$......b..!F..=ym.`f.]...o.N..B...a.3.5..fi\.D..V.o.....k.^....&....f.WD.....D..(....?..D...........*...z.<./.....G..p.....*.......~p...O9x,.B...X....*.Bs..J..'.S.re|...*s.Q,;.5.&...0.R2{.5..Q.N..j.q,....-eR..Q ..PK.........[Y4................javax/PK.........[Y4................javax/xml/PK.........[Y4................javax/xml/datatype/PK.........[Y4................javax/xml/namespace/PK.........[Y4................javax/xml/parsers/PK.........[Y4................javax/xml/transform/PK.........[Y4................javax/xml/transform/dom/PK.........[Y4..........

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\lib\xom-1.2.5.jar (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:Java archive data (JAR)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):308863
                                                                                                                                                                                                    Entropy (8bit):7.884396117260113
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:6144:UohU5MMRxDpMT1saqsSscC7+Km/45yVecAgDI0CmMBZ4:jhUpRxDpg1slsSfTKm/4MeULCPBS
                                                                                                                                                                                                    MD5:91B16B5B53AE0804671A57DBF7623FAD
                                                                                                                                                                                                    SHA1:4166493B9F04E91B858BA4150B28B4D197F8F8EA
                                                                                                                                                                                                    SHA-256:0E22C49AB86A6533299160B95DB9201FD7040F4F082E90D563CA7E8D972BBE3A
                                                                                                                                                                                                    SHA-512:EE13F72B87587FD5CA4ADBAD7A5AB2A04CFC056C68FE3D0633F2DBD554564AA8043C6A1447FB2450C01855AFCDE116C74DB4B736D684558507CA7BC7EC391F8F
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK..........<................META-INF/....PK..........<+D..............META-INF/MANIFEST.MF.T.n.0....?.9..E?......@..m....4...P.JR...YJ....../.v.3....3.......b..0.R[.......!..v.o.9H...<...G.N7.v...U.I C...0..t.!..ft..3.b&8s..=.'!&.?.}d.M.~?DU.ML.R.......r..2..a..RP.Pe..9....1...d..D..).....V..h..m..k..,.-.#.t....R.5.O..\la.I/..&...ra ...s...Z....]Ln{.A.da0(2m\t....7..B.)...r..j...&T........teAw.l..Z..:..i.R..[@.h3..."{....H...A. ...v..."..B.CY.............e..K...&/VU./.z.'.U.>.y6..{...n(C..7KVd'.~.T.\.Gg....;.........+.\..V....o.........l....W.0......5m.t`...8...}..........z........j.1z.A2.gnA@..cV}.K....z.m_'p.r{`.....:..=...f..u.3..z.Z....V.'J.....f/}.....4.n......#).T.h..]xh.^..w.S.dtGl...y.A.....PK..........<................nu/....PK..........<................nu/xom/....PK...........<."mq............nu/xom/ASCIIWriter.class;.o.>...=..F...R...\}.`gO...."v.FF.A.xHjE.L.....&3/...AU.'+.,Q?3_."m...$.....e.[k..0.2.q1.0.32......''..%..X4.5...s~

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\logs\BridgeNative.2024-10-03.log

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\iDentalSoft Bridge\iDSBridgeNative.exe
                                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):48
                                                                                                                                                                                                    Entropy (8bit):4.631328385912462
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:tR7oWfjPsWxXM1B/oy:nHpxc15l
                                                                                                                                                                                                    MD5:EF1FCFBDF9B4543676C939C770DCCF43
                                                                                                                                                                                                    SHA1:47EF0C421182D1994E58A43C5149A314D674704B
                                                                                                                                                                                                    SHA-256:210B9C72CA6B505418AA28F79C72D237457180314D5C94D59662E22BA45E8BF4
                                                                                                                                                                                                    SHA-512:28920199EC49DBA3C2FEEAA1A09D33127F586BC9FCDC8A3D06D63C432EA9EC0CAE1D266489C314CB7B66A48FE83BDCBD3492ACFBA7D3B6E52FA08E138715A40E
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:2024-10-03 15:39:13 INFO iDSBridgeNative start..

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\logs\iDentalSoft-Bridge.log

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ.exe
                                                                                                                                                                                                    File Type:ASCII text, with very long lines (1201), with CRLF line terminators
                                                                                                                                                                                                    Category:modified
                                                                                                                                                                                                    Size (bytes):3442
                                                                                                                                                                                                    Entropy (8bit):5.175436773218382
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:48:9mxKIOlZ4U7Z9zM5JeYwTXYE+kvMvvvnvkT0/yzLj8yg4eh0XUMyPOciEFWFKImc:bDld7Z9zMmDYE+Q4Xv2EthPPOmFC33
                                                                                                                                                                                                    MD5:67F9308330B2FD07F43EDFDDD3930F19
                                                                                                                                                                                                    SHA1:29189531E8795E7874A516B8F9E4FFC28E60D1C6
                                                                                                                                                                                                    SHA-256:C5EA8A004F6E6858205B588D0A09ACEEE175388649B75335940C75B574431450
                                                                                                                                                                                                    SHA-512:918360982876202A90C72E0F7AB00C727089CF6FECDD8EED05D226963D3B88DC9EE5BFF5002F654EE8EE53DBC33BD1CFE64F156C968F2BE0CF59FAE4678AB01B
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:2024-10-03 15:39:09,483 INFO com.iss.idental.bridge.utils.FileMutex.createMutex(FileMutex.java:119) - (FileMutex.java:119) Try to lock file :iDentalSoftBridge.lck..2024-10-03 15:39:09,921 INFO org.springframework.context.support.AbstractApplicationContext.prepareRefresh(AbstractApplicationContext.java:512) - (AbstractApplicationContext.java:512) Refreshing org.springframework.context.support.ClassPathXmlApplicationContext@100df86: startup date [Thu Oct 03 15:39:09 EDT 2024]; root of context hierarchy..2024-10-03 15:39:09,983 INFO org.springframework.beans.factory.xml.XmlBeanDefinitionReader.loadBeanDefinitions(XmlBeanDefinitionReader.java:316) - (XmlBeanDefinitionReader.java:316) Loading XML bean definitions from class path resource [applicationContext.xml]..2024-10-03 15:39:10,389 INFO org.springframework.beans.factory.annotation.AutowiredAnnotationBeanPostProcessor.<init>(AutowiredAnnotationBeanPostProcessor.java:141) - (AutowiredAnnotationBeanPostProcessor.java:141) JSR-330 'jav

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\mfc100.dll (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):4397384
                                                                                                                                                                                                    Entropy (8bit):7.044986254855662
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:98304:wnXVMSRMlBoIafB/I6A9Xwk2px12CqRe+RM/kXben7XTWwt52n7/YRFLOAkGkzdC:wnX1f2CYo7XTqYRFLOyomFHKnPAT
                                                                                                                                                                                                    MD5:A807596CB3CB377A1A687C9734D67A37
                                                                                                                                                                                                    SHA1:29DD7CA9AF4085C6897788C1AFAADF59DD5D8B0E
                                                                                                                                                                                                    SHA-256:496E1A21645ABAA90FA544C025E6F0DE1CBCBD5D060007A8A9E2FB5787655D0E
                                                                                                                                                                                                    SHA-512:7534CC0BF5CFCF238FEFDBE47FA895E47D08F7545CFE2E9DCEDA703E7652060821E3CFF9F839E5BC78A11205B9A0FD1A5DBA47B845AE83D05A6005F49A224E28
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........._.1...1...1.......1.......1.......1.'....1.......1.......1.......1.......1...0.H.1.....(.1.......1.......1.......1.Rich..1.................PE..L....)_M.........."!......*..d........%.......+....x..........................C.....OdC...@.........................@.*.......).......,.H.............C.H.....@.$..../..................................@...............8.....)......................text...3.*.......*................. ..`.data.........+.......*.............@....rsrc...H.....,.......+.............@..@.reloc...a....@..b....?.............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\mfc140.dll (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):4875912
                                                                                                                                                                                                    Entropy (8bit):7.054105439139926
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:98304:0l3vFG3W/RNZbjNysi2Mn9VUfH0i9xCYX6LFLOAkGkzdnEVomFHKnPe8p:S/jjw9Vvi9xCYX6LFLOyomFHKnPe8p
                                                                                                                                                                                                    MD5:ED7F7A91A1E2DA5EDBDD9C365BC733C3
                                                                                                                                                                                                    SHA1:B3E963DFC8246ED1DEF52FD3F6E0E9550CD84340
                                                                                                                                                                                                    SHA-256:A1B9349D4AB78DE0000F0028631CBDB6AA9ED8D815E1A7D5513C773E65CF2CB9
                                                                                                                                                                                                    SHA-512:B757AB9D3F3A0BC202553C778FF5B947A233AFB8130997F6DB18A589E0B7BC2F727EAA87BBAAE888BEF5CE00217BEF2B4C6224D3271B706148A9216747756A6B
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......L.............m:.....m<.....m=......Z.............................m&.........................6..........Rich...................PE..L...z{.Z.........."!....../.........`.+......./...............................J.......K...@A........................p.........0......P1..............(J..>....F......>..8...........................04..@.............0..............................text...c./......./................. ..`.data...\...../......./.............@....idata..vT....0..V...r0.............@..@.didat.......@1.......0.............@....rsrc........P1.......0.............@..@.reloc........F......dF.............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\msvcp100.dll (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):421200
                                                                                                                                                                                                    Entropy (8bit):6.59808962341698
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:12288:iHEqYsrMWIqz473PTiPoH/aGhUgiW6QR7t5qv3Ooc8UHkC2eKq87:iH9YsIWIW4rPTiPofaDv3Ooc8UHkC2e8
                                                                                                                                                                                                    MD5:03E9314004F504A14A61C3D364B62F66
                                                                                                                                                                                                    SHA1:0AA3CAAC24FDF9D9D4C618E2BBF0A063036CD55D
                                                                                                                                                                                                    SHA-256:A3BA6421991241BEA9C8334B62C3088F8F131AB906C3CC52113945D05016A35F
                                                                                                                                                                                                    SHA-512:2FCFF4439D2759D93C57D49B24F28AE89B7698E284E76AC65FE2B50BDEFC23A8CC3C83891D671DE4E4C0F036CEF810856DE79AC2B028AA89A895BF35ABFF8C8D
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........._d..17..17..17...7..17..7..17..07 .17(..7..17..7..17..7..17..7..17..7..17..7..17..7..17..7..17Rich..17........................PE..L.....K.........."!.................<.............x......................................@.................................`...<.... ...............V..P....0..H;..p................................/..@...............p............................text............................... ..`.data...$:.......,..................@....rsrc........ ......................@..@.reloc...S...0...T..................@..B........................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\msvcp140.dll (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):462120
                                                                                                                                                                                                    Entropy (8bit):6.664534921531032
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:12288:C3QUergtVv7jfIobCFvUkKShUgiW6QR7t5s03Ooc8dHkC2esIs:bUXzv3IoCFvUf03Ooc8dHkC2eJs
                                                                                                                                                                                                    MD5:BB18507C9891BFA94162D3220FC5FFD8
                                                                                                                                                                                                    SHA1:0680F3B4362EFCBF22D8B9D8AA1CB93798A732F0
                                                                                                                                                                                                    SHA-256:A36EB3003B3C7EE57984A26354C80263082305F149318FBF2896B8C3BB5A6D91
                                                                                                                                                                                                    SHA-512:66F19D0A6B62690952EC3063571C61B066D6F50C5955F693370D1349F2B49ED9C7943507C30041898AED0DDFC7A494EE12A43A22D80649A09D6CD35134E56103
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........>.$._.w._.w._.w..2w._.w.'Nw._.w._.w._.w.9.v._.w.9.v._.w.9.v._.w.9.v._.w.9.v._.w.9.v._.w.9"w._.w.9.v._.wRich._.w........................PE..L...4x.Z.........."!.....T..........@........p...............................0......y.....@A...................................,.......................(?......`@...w..8............................-..@...................`...@....................text...2R.......T.................. ..`.data...T(...p.......X..............@....idata...............p..............@..@.didat..4...........................@....rsrc...............................@..@.reloc..`@.......B..................@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\msvcr100.dll (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):770384
                                                                                                                                                                                                    Entropy (8bit):6.908020029901359
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:12288:fQmCy3NeRjkpQmj3oaMtQqjoygfXq3kon9IlbgaOxQdVJJ6j5EBKX8hR5:ImCy3VQs9MtLjTgfa3kon9FaOdEz5
                                                                                                                                                                                                    MD5:67EC459E42D3081DD8FD34356F7CAFC1
                                                                                                                                                                                                    SHA1:1738050616169D5B17B5ADAC3FF0370B8C642734
                                                                                                                                                                                                    SHA-256:1221A09484964A6F38AF5E34EE292B9AFEFCCB3DC6E55435FD3AAF7C235D9067
                                                                                                                                                                                                    SHA-512:9ED1C106DF217E0B4E4FBD1F4275486CEBA1D8A225D6C7E47B854B0B5E6158135B81BE926F51DB0AD5C624F9BD1D09282332CF064680DC9F7D287073B9686D33
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ R.HA<.HA<.HA<.A9..KA<.HA=..A<.'7..@<.'7...A<.'7..|A<.'7...A<.'7..IA<.'7..IA<.'7..IA<.RichHA<.........PE..L.....K.........."!................. ....... .....x.................................S....@..........................I......D...(.......................P....... L..h...8...........................pE..@............................................text............................... ..`.data...|Z... ...N..................@....rsrc................X..............@..@.reloc.. L.......N...\..............@..B........................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\unins000.dat

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:InnoSetup Log iDentalSoft Bridge {CF11B05F-C6FE-4E39-A811-138FA9A971E8}, version 0x30, 53847 bytes, 936905\user, "C:\Program Files (x86)\iDentalSoft Bridge"
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):53847
                                                                                                                                                                                                    Entropy (8bit):5.200660866026195
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:aOt2k9w17n5Xhv/nr82cN91Wn3yzcjTz7KsmrHX3lKnQ166keUc0QBnWm4dsoXwh:rry521gi4jNeGJM
                                                                                                                                                                                                    MD5:E14F3F14246A811EFA8D9C2B003981FD
                                                                                                                                                                                                    SHA1:28209E4C7C2361C9789D96CAEF5D309FBA9FB65C
                                                                                                                                                                                                    SHA-256:A270C712C161C786F89DF6499964B470CF05654428A21157C23BC096F99B1F5A
                                                                                                                                                                                                    SHA-512:8188FA8F036A66D5E462C27D9584FE925EAD4749222E73BB7EF5AA063724F72C2EB5BED5BF3DB3E69DBB7B68B6E497A266726E6EE386F2C38D1034242123B2A4
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:Inno Setup Uninstall Log (b)....................................{CF11B05F-C6FE-4E39-A811-138FA9A971E8}..........................................................................................iDentalSoft Bridge..............................................................................................................0.......W...%...............................................................................................................]-(1........!a1B......L....936905.user)C:\Program Files (x86)\iDentalSoft Bridge...........&...=.. ......F....BIFPS........1....................................................................................................BOOLEAN..............TINPUTOPTIONWIZARDPAGE....TINPUTOPTIONWIZARDPAGE...................TOBJECT....TOBJECT.........TNEWCHECKLISTBOX....TNEWCHECKLISTBOX.........TNEWSTATICTEXT....TNEWSTATICTEXT.........TWIZARDFORM....TWIZARDFORM.........TNEWBUTTON....TNEWBUTTON...........................!MAIN....-1.....`.......GETDEFAULTPATH...

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\unins000.exe (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):727029
                                                                                                                                                                                                    Entropy (8bit):6.5015001724386785
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:12288:UTPcYn5c/rPx37/zHBA6a5Ueyp2CrIEROlnrNORuiVbRx9Y1:IPcYn5c/rPx37/zHBA6pDp2mIEiiNRxy
                                                                                                                                                                                                    MD5:EF0AF3E170C66023DDF1C9BCE05754C8
                                                                                                                                                                                                    SHA1:41F0ED5CA288ABEA87F157E913855B08152C00E4
                                                                                                                                                                                                    SHA-256:A91284CF6C26025C045760EB30C8A85FE158935E32237A1E698AA07808C46E0A
                                                                                                                                                                                                    SHA-512:ADD18FA15FE5BD5CD33CA812318245DD607C2837135D72E6A1E3A8884DE20C432F05C9387C110C86D604CD7768920062B5F93FDA802538E7C964F5DF1658F892
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................z...n....................@..............................................@...............................%......d3................... ......................................................................................CODE....\y.......z.................. ..`DATA.................~..............@...BSS......................................idata...%.......&..................@....tls.....................................rdata..............................@..P.reloc...... ......................@..P.rsrc...d3.......4..................@..P.....................P..............@..P........................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\iDentalSoft Bridge\vcruntime140.dll (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):87360
                                                                                                                                                                                                    Entropy (8bit):6.88438978709945
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:1536:4rcAKWRMbpuRQci+7uXTKLWe+27JofZo0ENm2eK7oJnoUSgpAY8ODcDcm7cIsXg4:4r3KiRQcJ7uj8f7Jofm0ENm2eK7mnoU0
                                                                                                                                                                                                    MD5:B3FBD2F37A60830E6666961255D91EA1
                                                                                                                                                                                                    SHA1:712B9909B1D041EDDF8EDCCE2517CF3201D05E73
                                                                                                                                                                                                    SHA-256:13DF03D586FEEA45FA52DC512DDF9FA5C1C6BBF0D90C6B01F0EC6D73776EADCC
                                                                                                                                                                                                    SHA-512:BF5D66A9A4FB884EF96EC15407F2547C821D7A1A134EB3E9C68F6A5C563F6D28052970CCCF224CBE45DD1F8B1138CCE6238748B716D048CF8686268AFEB30337
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....... .id..:d..:d..:..=:f..:m.A:o..:d..:L..:w..;k..:w..;w..:w..;`..:w..;...:w..;e..:w.-:e..:w..;e..:Richd..:........PE..L...*x.Z.........."!......... ..............................................P............@A................................. .......0..................@?...@..H...p ..8............................ ..@............ ...............................text............................... ..`.data...............................@....idata....... ......................@..@.rsrc........0......................@..@.reloc..H....@......................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iDentalSoft Bridge\iDentalSoft Bridge Uninstall.lnk

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Icon number=0, Archive, ctime=Thu Oct 3 18:38:46 2024, mtime=Thu Oct 3 18:38:46 2024, atime=Thu Oct 3 18:38:15 2024, length=727029, window=hide
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):2098
                                                                                                                                                                                                    Entropy (8bit):3.5816792004917177
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:48:86vSvX4dORWo5rvpEv89dT8dSdEMUDkEZgyg:86cJ5rvp7DKXDZgy
                                                                                                                                                                                                    MD5:723FABAF30F07FB869D8209A2A13CFED
                                                                                                                                                                                                    SHA1:AC6C08FAACCDCEA28CC27BE9021611FBD15834A6
                                                                                                                                                                                                    SHA-256:6946A8A1941CBA393D5A35D1A5E4E60686D4E8C3BD6C85BE36C4844F1A7E4D36
                                                                                                                                                                                                    SHA-512:42EFA473277DE819F714D0872E9F628563AEBD26E52E18A83F38FFD017F85231F291557BE958E21FF6496F8C832AE576E135B297A4D53B401EF298F815ADF15E
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:L..................F.@.. ...j...............9....................................P.O. .:i.....+00.../C:\.....................1.....CY...PROGRA~2.........O.ICY.....................V........P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....n.1.....CY....IDENTA~1..V......CY.CY...........................B$..i.D.e.n.t.a.l.S.o.f.t. .B.r.i.d.g.e.....f.2.....CY. .unins000.exe..J......CY.CY.....*......................?..u.n.i.n.s.0.0.0...e.x.e.......e...............-.......d.............1......C:\Program Files (x86)\iDentalSoft Bridge\unins000.exe..E.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.i.D.e.n.t.a.l.S.o.f.t. .B.r.i.d.g.e.\.u.n.i.n.s.0.0.0...e.x.e.).C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.i.D.e.n.t.a.l.S.o.f.t. .B.r.i.d.g.e.F.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.i.D.e.n.t.a.l.S.o.f.t. .B.r.i.d.g.e.\.i.c.o.n.\.i.s.s._.A.g.e.n.t._.u.n.i.n.s.t.a.l.l...i.c.o.........%ProgramFiles%\iDentalSoft Bridge\ic

                                                                                                                                                                                                    C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iDentalSoft Bridge\iDentalSoft Bridge.lnk

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Icon number=0, Archive, ctime=Thu Oct 3 18:38:47 2024, mtime=Thu Oct 3 18:38:47 2024, atime=Mon Nov 20 21:43:40 2023, length=33104, window=hide
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):2242
                                                                                                                                                                                                    Entropy (8bit):3.6184572824039605
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:48:87ZY+dORVo8ev2mnvfZJ81WdpdDd0UD3Bsyg:8K+8ev2mnv0Ilsy
                                                                                                                                                                                                    MD5:C82C622C2C037D25732D2A72DE7186E8
                                                                                                                                                                                                    SHA1:BF4552A355E6D76C82D4CEE6DB6B069C9E5A62AE
                                                                                                                                                                                                    SHA-256:7B2C6141141527F26B8F8E1F61280620922801324FA71F4ED8F10D113E6BFEB2
                                                                                                                                                                                                    SHA-512:F323EB491793BE1F58FDB16BF38EAB558245F4F9035201F9A3A4008D82C1EDE29B2B4A325C83921AD089A65E1E8C20C3D01C6D031D8E526ACF9192CB2380F3B4
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:L..................F.@.. ....$.......$.......v......P............................P.O. .:i.....+00.../C:\.....................1.....CY...PROGRA~2.........O.ICY.....................V......2/.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....n.1.....CY...IDENTA~1..V......CY.CY...........................S...i.D.e.n.t.a.l.S.o.f.t. .B.r.i.d.g.e.....J.1.....CY...bin.8......CY.CY.............................&.b.i.n.....z.2.P...tWt. .IDENTA~1.EXE..^......CY.CY.....a.........................i.D.e.n.t.a.l.S.o.f.t.-.B.r.i.d.g.e...e.x.e.......s...............-.......r.............1......C:\Program Files (x86)\iDentalSoft Bridge\bin\iDentalSoft-Bridge.exe..S.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.i.D.e.n.t.a.l.S.o.f.t. .B.r.i.d.g.e.\.b.i.n.\.i.D.e.n.t.a.l.S.o.f.t.-.B.r.i.d.g.e...e.x.e.-.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.i.D.e.n.t.a.l.S.o.f.t. .B.r.i.d.g.e.\.b.i.n.F.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.

                                                                                                                                                                                                    C:\ProgramData\Oracle\Java\.oracle_jre_usage\bf02f2a4d931bd0.timestamp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ.exe
                                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):62
                                                                                                                                                                                                    Entropy (8bit):5.078959818346708
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:oFj4I5Mhuq2YRVAlPXAo2swQn:oJ5MMqxzAlvN20
                                                                                                                                                                                                    MD5:7CBB1BEF5303AD2316A82302F9593D79
                                                                                                                                                                                                    SHA1:50DF98481B914D78ACE0D475CFF647F1E1A0378A
                                                                                                                                                                                                    SHA-256:4A97BBD2DCCCEF857D1868F3F9DEE6F2F01E52F908B2E85315A59AE42ACD9D2F
                                                                                                                                                                                                    SHA-512:B63E18A11FCB283B3B2C242004357795EA968C65BE086C50324703EE789CDF36DFD7DC5FE18C483E07D70F6D32C0B4DDB3F4E8152CE38FA580D772BD3F374CDA
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:C:\Program Files (x86)\iDentalSoft Bridge\jre..1727984354052..

                                                                                                                                                                                                    C:\Users\Public\Desktop\iDentalSoft Bridge.lnk

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Icon number=0, Archive, ctime=Thu Oct 3 18:38:47 2024, mtime=Thu Oct 3 18:39:03 2024, atime=Mon Nov 20 21:43:40 2023, length=33104, window=hide
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):2224
                                                                                                                                                                                                    Entropy (8bit):3.614036783877304
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:48:80X4dORWo5nkmnvfZJ8BdpdDd0UD3Bsyg:8AJ5nkmnv0Flsy
                                                                                                                                                                                                    MD5:0B276452BD9BF135384AC0BB243F987B
                                                                                                                                                                                                    SHA1:23F1263BCA98E327254C36C3EF5FB11DEB51F74A
                                                                                                                                                                                                    SHA-256:84D564CF5A6C09B046A63665BF48526097A251B265FEFBC089752E4089B6B07D
                                                                                                                                                                                                    SHA-512:B2C843D4F41591C2166BB75C7614F11C626EF3233A08A9AFB7C447DF0C2BB6E1A3EFBB5D61D4B0D0FB3C38E20165DA8F27A4DC8CDA02EC36223198743E0D2C37
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:L..................F.@.. ....$........#......v......P............................P.O. .:i.....+00.../C:\.....................1.....CY...PROGRA~2.........O.ICY.....................V........P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....n.1.....CY....IDENTA~1..V......CY.CY...........................B$..i.D.e.n.t.a.l.S.o.f.t. .B.r.i.d.g.e.....J.1.....CY...bin.8......CY.CY.............................&.b.i.n.....z.2.P...tWt. .IDENTA~1.EXE..^......CY.CY.....a.........................i.D.e.n.t.a.l.S.o.f.t.-.B.r.i.d.g.e...e.x.e.......s...............-.......r.............1......C:\Program Files (x86)\iDentalSoft Bridge\bin\iDentalSoft-Bridge.exe..J.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.i.D.e.n.t.a.l.S.o.f.t. .B.r.i.d.g.e.\.b.i.n.\.i.D.e.n.t.a.l.S.o.f.t.-.B.r.i.d.g.e...e.x.e.-.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.i.D.e.n.t.a.l.S.o.f.t. .B.r.i.d.g.e.\.b.i.n.F.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.i.D.e.n.t.a.

                                                                                                                                                                                                    C:\Users\user\.swt\lib\win32\x86\swt-win32-4332.dll

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ.exe
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):438272
                                                                                                                                                                                                    Entropy (8bit):6.45159984442509
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:cNZ6/hZzXIxsfYG0CTjZTvAC6aXs0G0DolGm3D/oLYGb5wcSkpytA9uD9iat9i5x:cxMV/SXzUbaZkpn9vhsqNyXJeSi
                                                                                                                                                                                                    MD5:89E4275939F2A216F42EFC3B5785F5DC
                                                                                                                                                                                                    SHA1:B4768995011C973E81F58A27652F2D230BBCE940
                                                                                                                                                                                                    SHA-256:D8389AFCD0F81F598D9309E3573FD88AE5EE211286CDC2E6CF3F9033F689C1FD
                                                                                                                                                                                                    SHA-512:6076F3483481BA5B0B159841CCA3827EF9A155B543549B2F48E7B8A39498010F1196BA6134A6F1431B11D3EBBF1A293B8BCDA902689E626101772D27C387C64D
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........{............}h......}{.....|.J.....|.H.........0....}x.....}o......}i......}m.....Rich............................PE..L......Q...........!.................................................................q.............................. ........G..@................................O...................................C..@...............X............................text............................... ..`.rdata........... ..................@..@.data...|i....... ..................@....rsrc................0..............@..@.reloc..p`.......p...@..............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\3F88.tmp\iDental-Agent.bat

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\iDentalSoft Bridge\bin\iDentalSoft-Bridge.exe
                                                                                                                                                                                                    File Type:ASCII text, with no line terminators
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):12
                                                                                                                                                                                                    Entropy (8bit):3.2516291673878226
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:FJA4:FJA4
                                                                                                                                                                                                    MD5:22A3AA0D46289FF2EE7ED797EE859F50
                                                                                                                                                                                                    SHA1:92CCEF9549789289E51E7691AF3BF6EF73603501
                                                                                                                                                                                                    SHA-256:208984629A84A719B40A3DCF87CDDCE708FCEAEF09D4CF5CC0D71C6EE40AC1A1
                                                                                                                                                                                                    SHA-512:05BE5D8381598B34A840643C784ED74B0533F3861717D54147A3008A945F4DD1E2FB0C5FCDF6445AE9FD06C1C67614BB97EA5342EA3CC6651A09301C6C13F086
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:call run.bat

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\5504.tmp\iDental-Agent.bat

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\iDentalSoft Bridge\bin\iDentalSoft-Bridge.exe
                                                                                                                                                                                                    File Type:ASCII text, with no line terminators
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):12
                                                                                                                                                                                                    Entropy (8bit):3.2516291673878226
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:FJA4:FJA4
                                                                                                                                                                                                    MD5:22A3AA0D46289FF2EE7ED797EE859F50
                                                                                                                                                                                                    SHA1:92CCEF9549789289E51E7691AF3BF6EF73603501
                                                                                                                                                                                                    SHA-256:208984629A84A719B40A3DCF87CDDCE708FCEAEF09D4CF5CC0D71C6EE40AC1A1
                                                                                                                                                                                                    SHA-512:05BE5D8381598B34A840643C784ED74B0533F3861717D54147A3008A945F4DD1E2FB0C5FCDF6445AE9FD06C1C67614BB97EA5342EA3CC6651A09301C6C13F086
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:call run.bat

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\hsperfdata_user\3804

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ.exe
                                                                                                                                                                                                    File Type:data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):65536
                                                                                                                                                                                                    Entropy (8bit):1.3019624850487714
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:96:py4rp88G0K1Y0wAG8IqFsAQ+BYAyUSUr/341AUqUxUEUiUbUoU/7oA+Uk:pyz8G0K17FI6H/r/oD3C1vQxT/
                                                                                                                                                                                                    MD5:5A006B352DD5143EF5FCC8F20C085406
                                                                                                                                                                                                    SHA1:5D5E33D3B66AD31AEFCC2BF3D678C16ED4B9B730
                                                                                                                                                                                                    SHA-256:42CA840B9EFEE8D6BF36D33C77B67AD1A5168988A2F10B1FE3A260B11E29C476
                                                                                                                                                                                                    SHA-512:8C552F4854CD2D49896DAC5131CB3A29D5CDF56B2C30F7FF679A8557D3BFDFEA1278D3D1DCAC646B85FA8E84A2C74D92D9B3ECFE38431AD4B50D3AC8C6C6E92B
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:.........:.............. .......8...........J...0...sun.rt._sync_Inflations.............8...........J...0...sun.rt._sync_Deflations.............@...........J...8...sun.rt._sync_ContendedLockAttempts..........8...........J...0...sun.rt._sync_FutileWakeups..........0...........J...(...sun.rt._sync_Parks..........@...........J...8...sun.rt._sync_EmptyNotifications.............8...........J...0...sun.rt._sync_Notifications..........8...........J...0...sun.rt._sync_SlowEnter..............8...........J...0...sun.rt._sync_SlowExit...............8...........J...0...sun.rt._sync_SlowNotify.............8...........J...0...sun.rt._sync_SlowNotifyAll..........8...........J...0...sun.rt._sync_FailedSpins............@...........J...8...sun.rt._sync_SuccessfulSpins................8...........J...0...sun.rt._sync_PrivateA...............8...........J...0...sun.rt._sync_PrivateB...............@...........J...8...sun.rt._sync_MonInCirculation...............8...........J...0...sun.rt._sync_MonScavenged...

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\hsperfdata_user\7048

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ.exe
                                                                                                                                                                                                    File Type:data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):65536
                                                                                                                                                                                                    Entropy (8bit):1.3068282717435615
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:96:d/mrLt8G+kNnL3FAG8IMiAQ+BzAyUSUr/341AUqUxUEUiUbUoU/7oA+UU:d/+8G+kNnL3mIEG/r/oD3C1vQxT/
                                                                                                                                                                                                    MD5:BCDEF54D39784FDE646201CC41A552A2
                                                                                                                                                                                                    SHA1:13D07DF0DB42239EA7E42197B1E66B0969EAE194
                                                                                                                                                                                                    SHA-256:8D6CED36844EEABC6F971699133546D64DEC80FE1B155EC52CE83E762527786B
                                                                                                                                                                                                    SHA-512:9A3ECAA3ACD3ACB4BF0C501145B99F6CC6CF2DA87CDB9BC86721C25A7D061EDC5A7E760C01BE94D92065EB8E278BFF83CC1E7FFA86F6B314DEE2F2952FE16689
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:.........:.............. .......8...........J...0...sun.rt._sync_Inflations.............8...........J...0...sun.rt._sync_Deflations.............@...........J...8...sun.rt._sync_ContendedLockAttempts..........8...........J...0...sun.rt._sync_FutileWakeups..........0...........J...(...sun.rt._sync_Parks..........@...........J...8...sun.rt._sync_EmptyNotifications.............8...........J...0...sun.rt._sync_Notifications..........8...........J...0...sun.rt._sync_SlowEnter..............8...........J...0...sun.rt._sync_SlowExit...............8...........J...0...sun.rt._sync_SlowNotify.............8...........J...0...sun.rt._sync_SlowNotifyAll..........8...........J...0...sun.rt._sync_FailedSpins............@...........J...8...sun.rt._sync_SuccessfulSpins................8...........J...0...sun.rt._sync_PrivateA...............8...........J...0...sun.rt._sync_PrivateB...............@...........J...8...sun.rt._sync_MonInCirculation...............8...........J...0...sun.rt._sync_MonScavenged...

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\is-NQDF9.tmp\_isetup\_setup64.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32+ executable (console) x86-64, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):6144
                                                                                                                                                                                                    Entropy (8bit):4.289297026665552
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:48:Sv1LfWvPcXegCPUo1vlZQrAxoONfHFZONfH3d1xCWMBFNL2pGSS4k+bkg6j0KHc:wfkcXegaJ/ZAYNzcld1xaX12pfSKvkc
                                                                                                                                                                                                    MD5:C8871EFD8AF2CF4D9D42D1FF8FADBF89
                                                                                                                                                                                                    SHA1:D0EACD5322C036554D509C7566F0BCC7607209BD
                                                                                                                                                                                                    SHA-256:E4FC574A01B272C2D0AED0EC813F6D75212E2A15A5F5C417129DD65D69768F40
                                                                                                                                                                                                    SHA-512:2735BB610060F749E26ACD86F2DF2B8A05F2BDD3DCCF3E4B2946EBB21BA0805FB492C474B1EEB2C5B8BF1A421F7C1B8728245F649C644F4A9ECC5BD8770A16F6
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d.....HP..........#............................@.............................`..............................................................<!.......P.......@..0.................................................................... ...............................text............................... ..`.rdata..|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc........P......................@..@................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\is-NQDF9.tmp\_isetup\_shfoldr.dll

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):23312
                                                                                                                                                                                                    Entropy (8bit):4.596242908851566
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:+Vm08QoKkiWZ76UJuP71W55iWHHoSHigH2euwsHTGHVb+VHHmnH+aHjHqLHxmoq1:2m08QotiCjJuPGw4
                                                                                                                                                                                                    MD5:92DC6EF532FBB4A5C3201469A5B5EB63
                                                                                                                                                                                                    SHA1:3E89FF837147C16B4E41C30D6C796374E0B8E62C
                                                                                                                                                                                                    SHA-256:9884E9D1B4F8A873CCBD81F8AD0AE257776D2348D027D811A56475E028360D87
                                                                                                                                                                                                    SHA-512:9908E573921D5DBC3454A1C0A6C969AB8A81CC2E8B5385391D46B1A738FB06A76AA3282E0E58D0D2FFA6F27C85668CD5178E1500B8A39B1BBAE04366AE6A86D3
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......IzJ^..$...$...$...%.".$.T87...$.[."...$...$...$.Rich..$.........................PE..L.....\;...........#..... ...4.......'.......0.....q....................................................................k...l)..<....@.../...................p..T....................................................................................text...{........ .................. ..`.data...\....0.......&..............@....rsrc..../...@...0...(..............@..@.reloc.......p.......X..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\Desktop\iDentalSoftBridgeSetup_12.2.0_x86 (1).exe
                                                                                                                                                                                                    File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):715776
                                                                                                                                                                                                    Entropy (8bit):6.492613189170303
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:12288:cTPcYn5c/rPx37/zHBA6a5Ueyp2CrIEROlnrNORuiVbRx9YE:APcYn5c/rPx37/zHBA6pDp2mIEiiNRxN
                                                                                                                                                                                                    MD5:3461AE6D7441C2E5698CA4B4177C962F
                                                                                                                                                                                                    SHA1:D532D47307824000451E3E90B490AC38CF781A46
                                                                                                                                                                                                    SHA-256:00388FD91B95FC1C789EB87D2FD58FC7BD174AB95C5EF527F0DE423C37D92316
                                                                                                                                                                                                    SHA-512:54444DB3E0FF88653EC7B009D633EC6E8D4EC6C7F2A86406212D7E8D798A596EDD8631D24FBD971F0E401682EEC72FEFA16654E4DEA3DE32F4CB7979D5A6CFE5
                                                                                                                                                                                                    Malicious:true
                                                                                                                                                                                                    Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................z...n....................@..............................................@...............................%......d3................... ......................................................................................CODE....\y.......z.................. ..`DATA.................~..............@...BSS......................................idata...%.......&..................@....tls.....................................rdata..............................@..P.reloc...... ......................@..P.rsrc...d3.......4..................@..P.....................P..............@..P........................................................................................................................................

                                                                                                                                                                                                    C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1003\83aa4cc77f591dfc2374580bbd95f6ba_9e146be9-c76a-4720-bcdb-53011b87bd06

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ.exe
                                                                                                                                                                                                    File Type:data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):45
                                                                                                                                                                                                    Entropy (8bit):0.9111711733157262
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:/lwlt7n:WNn
                                                                                                                                                                                                    MD5:C8366AE350E7019AEFC9D1E6E6A498C6
                                                                                                                                                                                                    SHA1:5731D8A3E6568A5F2DFBBC87E3DB9637DF280B61
                                                                                                                                                                                                    SHA-256:11E6ACA8E682C046C83B721EEB5C72C5EF03CB5936C60DF6F4993511DDC61238
                                                                                                                                                                                                    SHA-512:33C980D5A638BFC791DE291EBF4B6D263B384247AB27F261A54025108F2F85374B579A026E545F81395736DD40FA4696F2163CA17640DD47F1C42BC9971B18CD
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:........................................J2SE.

                                                                                                                                                                                                    C:\Windows\certutil.log

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exe
                                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                    Category:modified
                                                                                                                                                                                                    Size (bytes):1012
                                                                                                                                                                                                    Entropy (8bit):4.96697755961817
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:12:uvcs1WiFl8Ovtsjtdn5cWv7Ccs1WiFl8OvtS6QFcLC9Fsin5cWvZv:Fs1Wij866CW2cs1Wij86H8SCLtCWZv
                                                                                                                                                                                                    MD5:2959C4515AD3CC6C1DC39274EE3A8701
                                                                                                                                                                                                    SHA1:40A0BCBB8F9847725489ED13DF3A59506F63EFCE
                                                                                                                                                                                                    SHA-256:F62ADB32F7DBDF55DDC465932E4CDF3CFC627684B1CE1BEA02F2D601D442D201
                                                                                                                                                                                                    SHA-512:23CCD31EFCAB48EB8CA15FE8C4AE663DE4DD2C67DC9D4D28467795EBFA56E00939CABBC6D9F2CCAEA5DD676A45850AE8731046E6ECAE9D9DF09BF136952A8827
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:..========================================================================..402.420.948: Begin: 03/10/2024 15:39 08.469s..402.203.0: 0x80070057 (WIN32: 87): ..CertCli Version..301.3220.0: certcli.dll: The parameter is incorrect. 0x80070057 (WIN32: 87)..301.3220.0: certutil.exe: 5.2.3790.0 retail (srv03_rtm.030324-2048)..301.3124.465: Command Line: CertUtil -delstore Root localgateway.iDentalSoft..301.3143.511: Command Succeeded..402.315.949: End: 03/10/2024 15:39 08.485s....========================================================================..402.420.948: Begin: 03/10/2024 15:39 08.907s..402.203.0: 0x80070057 (WIN32: 87): ..CertCli Version..301.3220.0: certcli.dll: The parameter is incorrect. 0x80070057 (WIN32: 87)..301.3220.0: certutil.exe: 5.2.3790.0 retail (srv03_rtm.030324-2048)..301.3124.465: Command Line: CertUtil -addstore Root "C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\BridgeSelfCertificate.cer"..301.3143.511: Command Succeeded..402.315.949: End: 03/10/2024 15:

                                                                                                                                                                                                    \Device\ConDrv

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exe
                                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):54
                                                                                                                                                                                                    Entropy (8bit):4.460918928442595
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:NGFVfmzWXtQ2zAXRv:4viXJ
                                                                                                                                                                                                    MD5:3D48205CF450F57570A97ED0B68A0C0B
                                                                                                                                                                                                    SHA1:50606888F3DA17D7DFA6F19E6D6DBFEBBBD57EAB
                                                                                                                                                                                                    SHA-256:60FF2EF827E2CC4BD01DA622731D396CE1E3C09C25163CB0A0F0D28D5E861929
                                                                                                                                                                                                    SHA-512:799DC1B6E82A3113A48BA316E4D6EA505070FF6CDFCE3AAD96DFA1A3F4F954374E0EA0536D5DFD126A1511D27C3A9112BC3C07F3920C25356250DAED03024801
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:402.203.0: 0x80070057 (WIN32: 87): ..CertCli Version..

                                                                                                                                                                                                    Static File Info

                                                                                                                                                                                                    General

                                                                                                                                                                                                    File type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Entropy (8bit):7.999987668904929
                                                                                                                                                                                                    TrID:
                                                                                                                                                                                                    • Win32 Executable (generic) a (10002005/4) 98.86%
                                                                                                                                                                                                    • Inno Setup installer (109748/4) 1.08%
                                                                                                                                                                                                    • Win16/32 Executable Delphi generic (2074/23) 0.02%
                                                                                                                                                                                                    • Generic Win/DOS Executable (2004/3) 0.02%
                                                                                                                                                                                                    • DOS Executable Generic (2002/1) 0.02%
                                                                                                                                                                                                    File name:iDentalSoftBridgeSetup_12.2.0_x86 (1).exe
                                                                                                                                                                                                    File size:77'230'776 bytes
                                                                                                                                                                                                    MD5:4eb785583966bc768c79a867a68a73ec
                                                                                                                                                                                                    SHA1:6cbcb89f3a3b44861007c31d90731d76e357cdc3
                                                                                                                                                                                                    SHA256:6c9e522203f8b8f4a020c991c2703e1787a49ca281bf56d0bfcf09ca98b6811b
                                                                                                                                                                                                    SHA512:9dc315baab100a3845ecacca202e9f4f8e9f59b5e275c6ad61ff22f7e981241aee0719ae7e29666f351d374db02d1911877df36d40c15b7d4cc6e0df124f4c4f
                                                                                                                                                                                                    SSDEEP:1572864:73TvXJ/B7D2Azpq/gRdFhjOaKlAdCtGcODPbWm5r5p:TTD7D2Azw/gRrWtG/PbW+P
                                                                                                                                                                                                    TLSH:C908338385C251ADCC96B077E65593EE2C394E74CA4EC0F69132705A6A26AC7EF1370F
                                                                                                                                                                                                    File Content Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

                                                                                                                                                                                                    File Icon

                                                                                                                                                                                                    Icon Hash:0c66e2d000800404

                                                                                                                                                                                                    Static PE Info

                                                                                                                                                                                                    General

                                                                                                                                                                                                    Entrypoint:0x409c40
                                                                                                                                                                                                    Entrypoint Section:CODE
                                                                                                                                                                                                    Digitally signed:true
                                                                                                                                                                                                    Imagebase:0x400000
                                                                                                                                                                                                    Subsystem:windows gui
                                                                                                                                                                                                    Image File Characteristics:RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
                                                                                                                                                                                                    DLL Characteristics:TERMINAL_SERVER_AWARE
                                                                                                                                                                                                    Time Stamp:0x2A425E19 [Fri Jun 19 22:22:17 1992 UTC]
                                                                                                                                                                                                    TLS Callbacks:
                                                                                                                                                                                                    CLR (.Net) Version:
                                                                                                                                                                                                    OS Version Major:1
                                                                                                                                                                                                    OS Version Minor:0
                                                                                                                                                                                                    File Version Major:1
                                                                                                                                                                                                    File Version Minor:0
                                                                                                                                                                                                    Subsystem Version Major:1
                                                                                                                                                                                                    Subsystem Version Minor:0
                                                                                                                                                                                                    Import Hash:884310b1928934402ea6fec1dbd3cf5e

                                                                                                                                                                                                    Authenticode Signature

                                                                                                                                                                                                    Signature Valid:true
                                                                                                                                                                                                    Signature Issuer:CN=GlobalSign CodeSigning CA - SHA256 - G3, O=GlobalSign nv-sa, C=BE
                                                                                                                                                                                                    Signature Validation Error:The operation completed successfully
                                                                                                                                                                                                    Error Number:0
                                                                                                                                                                                                    Not Before, Not After
                                                                                                                                                                                                    • 14/12/2020 12:30:40 15/12/2023 12:30:40
                                                                                                                                                                                                    Subject Chain
                                                                                                                                                                                                    • CN="IDENTALSOFT, INC.", O="IDENTALSOFT, INC.", L=Milpitas, S=California, C=US
                                                                                                                                                                                                    Version:3
                                                                                                                                                                                                    Thumbprint MD5:88A8EF0639F9610B4464EDC3DB91BAD7
                                                                                                                                                                                                    Thumbprint SHA-1:6258376AB8C96960DBDE8B6C1783DCE025BD30F1
                                                                                                                                                                                                    Thumbprint SHA-256:F057EC15D689BE8A6CB33A4E69C83B6CA942106A6754FB563074D3E8870BEDA2
                                                                                                                                                                                                    Serial:4376CB7E77563F42AA00C404

                                                                                                                                                                                                    Entrypoint Preview

                                                                                                                                                                                                    Instruction
                                                                                                                                                                                                    push ebp
                                                                                                                                                                                                    mov ebp, esp
                                                                                                                                                                                                    add esp, FFFFFFC4h
                                                                                                                                                                                                    push ebx
                                                                                                                                                                                                    push esi
                                                                                                                                                                                                    push edi
                                                                                                                                                                                                    xor eax, eax
                                                                                                                                                                                                    mov dword ptr [ebp-10h], eax
                                                                                                                                                                                                    mov dword ptr [ebp-24h], eax
                                                                                                                                                                                                    call 00007F7370CC400Bh
                                                                                                                                                                                                    call 00007F7370CC5212h
                                                                                                                                                                                                    call 00007F7370CC54A1h
                                                                                                                                                                                                    call 00007F7370CC5544h
                                                                                                                                                                                                    call 00007F7370CC74E3h
                                                                                                                                                                                                    call 00007F7370CC9E4Eh
                                                                                                                                                                                                    call 00007F7370CC9FB5h
                                                                                                                                                                                                    xor eax, eax
                                                                                                                                                                                                    push ebp
                                                                                                                                                                                                    push 0040A2FCh
                                                                                                                                                                                                    push dword ptr fs:[eax]
                                                                                                                                                                                                    mov dword ptr fs:[eax], esp
                                                                                                                                                                                                    xor edx, edx
                                                                                                                                                                                                    push ebp
                                                                                                                                                                                                    push 0040A2C5h
                                                                                                                                                                                                    push dword ptr fs:[edx]
                                                                                                                                                                                                    mov dword ptr fs:[edx], esp
                                                                                                                                                                                                    mov eax, dword ptr [0040C014h]
                                                                                                                                                                                                    call 00007F7370CCAA1Bh
                                                                                                                                                                                                    call 00007F7370CCA64Eh
                                                                                                                                                                                                    lea edx, dword ptr [ebp-10h]
                                                                                                                                                                                                    xor eax, eax
                                                                                                                                                                                                    call 00007F7370CC7B08h
                                                                                                                                                                                                    mov edx, dword ptr [ebp-10h]
                                                                                                                                                                                                    mov eax, 0040CE24h
                                                                                                                                                                                                    call 00007F7370CC40B7h
                                                                                                                                                                                                    push 00000002h
                                                                                                                                                                                                    push 00000000h
                                                                                                                                                                                                    push 00000001h
                                                                                                                                                                                                    mov ecx, dword ptr [0040CE24h]
                                                                                                                                                                                                    mov dl, 01h
                                                                                                                                                                                                    mov eax, 0040738Ch
                                                                                                                                                                                                    call 00007F7370CC8397h
                                                                                                                                                                                                    mov dword ptr [0040CE28h], eax
                                                                                                                                                                                                    xor edx, edx
                                                                                                                                                                                                    push ebp
                                                                                                                                                                                                    push 0040A27Dh
                                                                                                                                                                                                    push dword ptr fs:[edx]
                                                                                                                                                                                                    mov dword ptr fs:[edx], esp
                                                                                                                                                                                                    call 00007F7370CCAA8Bh
                                                                                                                                                                                                    mov dword ptr [0040CE30h], eax
                                                                                                                                                                                                    mov eax, dword ptr [0040CE30h]
                                                                                                                                                                                                    cmp dword ptr [eax+0Ch], 01h
                                                                                                                                                                                                    jne 00007F7370CCABCAh
                                                                                                                                                                                                    mov eax, dword ptr [0040CE30h]
                                                                                                                                                                                                    mov edx, 00000028h
                                                                                                                                                                                                    call 00007F7370CC8798h
                                                                                                                                                                                                    mov edx, dword ptr [00000030h]

                                                                                                                                                                                                    Data Directories

                                                                                                                                                                                                    NameVirtual AddressVirtual Size Is in Section
                                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_IMPORT0xd0000x950.idata
                                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_RESOURCE0x110000x5330.rsrc
                                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_SECURITY0x49a55680x1d50
                                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_BASERELOC0x100000x0.reloc
                                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_TLS0xf0000x18.rdata
                                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_IAT0x00x0
                                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                                                                                                                                    Sections

                                                                                                                                                                                                    NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                                                                                                                    CODE0x10000x93640x9400e8a38c5eb0d717d3fb478c7e19f20477False0.6147856841216216data6.563139352016593IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                    DATA0xb0000x24c0x4005d98c64569668b0235ae89005918165aFalse0.3046875data2.7373065622921344IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                    BSS0xc0000xe880x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                    .idata0xd0000x9500xa00bb5485bf968b970e5ea81292af2acdbaFalse0.414453125data4.430733069799036IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                    .tls0xe0000x80x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                    .rdata0xf0000x180x2009ba824905bf9c7922b6fc87a38b74366False0.052734375data0.2044881574398449IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                    .reloc0x100000x8b40x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                    .rsrc0x110000x53300x540037d22ba0dc657b16587b81ff34fb1c67False0.1849423363095238data3.9523066078553852IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ

                                                                                                                                                                                                    Resources

                                                                                                                                                                                                    NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                                                                                                                                    RT_ICON0x113240x468Device independent bitmap graphic, 16 x 32 x 32, image size 1088EnglishUnited States0.2553191489361702
                                                                                                                                                                                                    RT_ICON0x1178c0x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 4224EnglishUnited States0.16674484052532834
                                                                                                                                                                                                    RT_ICON0x128340x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 9600EnglishUnited States0.09056016597510373
                                                                                                                                                                                                    RT_STRING0x14ddc0x2f2data0.35543766578249336
                                                                                                                                                                                                    RT_STRING0x150d00x30cdata0.3871794871794872
                                                                                                                                                                                                    RT_STRING0x153dc0x2cedata0.42618384401114207
                                                                                                                                                                                                    RT_STRING0x156ac0x68data0.75
                                                                                                                                                                                                    RT_STRING0x157140xb4data0.6277777777777778
                                                                                                                                                                                                    RT_STRING0x157c80xaedata0.5344827586206896
                                                                                                                                                                                                    RT_RCDATA0x158780x2cdata1.25
                                                                                                                                                                                                    RT_GROUP_ICON0x158a40x30dataEnglishUnited States0.8541666666666666
                                                                                                                                                                                                    RT_VERSION0x158d40x4b8COM executable for DOSEnglishUnited States0.28228476821192056
                                                                                                                                                                                                    RT_MANIFEST0x15d8c0x5a4XML 1.0 document, ASCII text, with CRLF line terminatorsEnglishUnited States0.42590027700831024

                                                                                                                                                                                                    Imports

                                                                                                                                                                                                    DLLImport
                                                                                                                                                                                                    kernel32.dllDeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, InitializeCriticalSection, VirtualFree, VirtualAlloc, LocalFree, LocalAlloc, WideCharToMultiByte, TlsSetValue, TlsGetValue, MultiByteToWideChar, GetModuleHandleA, GetLastError, GetCommandLineA, WriteFile, SetFilePointer, SetEndOfFile, RtlUnwind, ReadFile, RaiseException, GetStdHandle, GetFileSize, GetSystemTime, GetFileType, ExitProcess, CreateFileA, CloseHandle
                                                                                                                                                                                                    user32.dllMessageBoxA
                                                                                                                                                                                                    oleaut32.dllVariantChangeTypeEx, VariantCopyInd, VariantClear, SysStringLen, SysAllocStringLen
                                                                                                                                                                                                    advapi32.dllRegQueryValueExA, RegOpenKeyExA, RegCloseKey, OpenProcessToken, LookupPrivilegeValueA
                                                                                                                                                                                                    kernel32.dllWriteFile, VirtualQuery, VirtualProtect, VirtualFree, VirtualAlloc, Sleep, SizeofResource, SetLastError, SetFilePointer, SetErrorMode, SetEndOfFile, RemoveDirectoryA, ReadFile, LockResource, LoadResource, LoadLibraryA, IsDBCSLeadByte, GetWindowsDirectoryA, GetVersionExA, GetUserDefaultLangID, GetSystemInfo, GetSystemDefaultLCID, GetProcAddress, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetLastError, GetFullPathNameA, GetFileSize, GetFileAttributesA, GetExitCodeProcess, GetEnvironmentVariableA, GetCurrentProcess, GetCommandLineA, GetACP, InterlockedExchange, FormatMessageA, FindResourceA, DeleteFileA, CreateProcessA, CreateFileA, CreateDirectoryA, CloseHandle
                                                                                                                                                                                                    user32.dllTranslateMessage, SetWindowLongA, PeekMessageA, MsgWaitForMultipleObjects, MessageBoxA, LoadStringA, ExitWindowsEx, DispatchMessageA, DestroyWindow, CreateWindowExA, CallWindowProcA, CharPrevA
                                                                                                                                                                                                    comctl32.dllInitCommonControls
                                                                                                                                                                                                    advapi32.dllAdjustTokenPrivileges

                                                                                                                                                                                                    Possible Origin

                                                                                                                                                                                                    Language of compilation systemCountry where language is spokenMap
                                                                                                                                                                                                    EnglishUnited States

                                                                                                                                                                                                    Network Behavior

                                                                                                                                                                                                    ⊘No network behavior found

                                                                                                                                                                                                    Statistics

                                                                                                                                                                                                    CPU Usage

                                                                                                                                                                                                    Click to jump to process

                                                                                                                                                                                                    Memory Usage

                                                                                                                                                                                                    Click to jump to process

                                                                                                                                                                                                    High Level Behavior Distribution

                                                                                                                                                                                                    Click to dive into process behavior distribution

                                                                                                                                                                                                    Behavior

                                                                                                                                                                                                    Click to jump to process

                                                                                                                                                                                                    System Behavior

                                                                                                                                                                                                    General

                                                                                                                                                                                                    Target ID:0
                                                                                                                                                                                                    Start time:15:38:15
                                                                                                                                                                                                    Start date:03/10/2024
                                                                                                                                                                                                    Path:C:\Users\user\Desktop\iDentalSoftBridgeSetup_12.2.0_x86 (1).exe
                                                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                                                    Commandline:"C:\Users\user\Desktop\iDentalSoftBridgeSetup_12.2.0_x86 (1).exe"
                                                                                                                                                                                                    Imagebase:0x400000
                                                                                                                                                                                                    File size:77'230'776 bytes
                                                                                                                                                                                                    MD5 hash:4EB785583966BC768C79A867A68A73EC
                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                    Reputation:low
                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                    General

                                                                                                                                                                                                    Target ID:2
                                                                                                                                                                                                    Start time:15:38:15
                                                                                                                                                                                                    Start date:03/10/2024
                                                                                                                                                                                                    Path:C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp
                                                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                                                    Commandline:"C:\Users\user\AppData\Local\Temp\is-O58FB.tmp\iDentalSoftBridgeSetup_12.2.0_x86 (1).tmp" /SL5="$2040C,76918457,64512,C:\Users\user\Desktop\iDentalSoftBridgeSetup_12.2.0_x86 (1).exe"
                                                                                                                                                                                                    Imagebase:0x400000
                                                                                                                                                                                                    File size:715'776 bytes
                                                                                                                                                                                                    MD5 hash:3461AE6D7441C2E5698CA4B4177C962F
                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                    Reputation:low
                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                    General

                                                                                                                                                                                                    Target ID:8
                                                                                                                                                                                                    Start time:15:39:08
                                                                                                                                                                                                    Start date:03/10/2024
                                                                                                                                                                                                    Path:C:\Program Files (x86)\iDentalSoft Bridge\bin\iDentalSoft-Bridge.exe
                                                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                                                    Commandline:"C:\Program Files (x86)\iDentalSoft Bridge\bin\iDentalSoft-Bridge.exe"
                                                                                                                                                                                                    Imagebase:0x400000
                                                                                                                                                                                                    File size:33'104 bytes
                                                                                                                                                                                                    MD5 hash:3A8BD34A555D3F6AE3EE8D35168A5A48
                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                    Reputation:low
                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                    General

                                                                                                                                                                                                    Target ID:9
                                                                                                                                                                                                    Start time:15:39:08
                                                                                                                                                                                                    Start date:03/10/2024
                                                                                                                                                                                                    Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                                    Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                    Imagebase:0x7ff66e660000
                                                                                                                                                                                                    File size:862'208 bytes
                                                                                                                                                                                                    MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                    Reputation:high
                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                    General

                                                                                                                                                                                                    Target ID:10
                                                                                                                                                                                                    Start time:15:39:08
                                                                                                                                                                                                    Start date:03/10/2024
                                                                                                                                                                                                    Path:C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exe
                                                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                                                    Commandline:"C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exe" -delstore Root localgateway.iDentalSoft
                                                                                                                                                                                                    Imagebase:0x1000000
                                                                                                                                                                                                    File size:569'344 bytes
                                                                                                                                                                                                    MD5 hash:711DB2EF10B6C2AB2080698AEC6C6D08
                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                    Reputation:low
                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                    General

                                                                                                                                                                                                    Target ID:11
                                                                                                                                                                                                    Start time:15:39:08
                                                                                                                                                                                                    Start date:03/10/2024
                                                                                                                                                                                                    Path:C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                                                    Commandline:C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\3F88.tmp\iDental-Agent.bat""
                                                                                                                                                                                                    Imagebase:0x1c0000
                                                                                                                                                                                                    File size:236'544 bytes
                                                                                                                                                                                                    MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                    Reputation:high
                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                    General

                                                                                                                                                                                                    Target ID:12
                                                                                                                                                                                                    Start time:15:39:08
                                                                                                                                                                                                    Start date:03/10/2024
                                                                                                                                                                                                    Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                                    Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                    Imagebase:0x7ff66e660000
                                                                                                                                                                                                    File size:862'208 bytes
                                                                                                                                                                                                    MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                    Reputation:high
                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                    General

                                                                                                                                                                                                    Target ID:13
                                                                                                                                                                                                    Start time:15:39:08
                                                                                                                                                                                                    Start date:03/10/2024
                                                                                                                                                                                                    Path:C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ.exe
                                                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                                                    Commandline:"C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ" -Xss1m -Xms512M -Xmx512M -XX:MaxPermSize=256M -cp "C:\Program Files (x86)\iDentalSoft Bridge\iDentalSoftBridge.jar";etc\ com.iss.idental.bridge.main.BridgeApplicationMain
                                                                                                                                                                                                    Imagebase:0xb20000
                                                                                                                                                                                                    File size:191'552 bytes
                                                                                                                                                                                                    MD5 hash:9F8C5EAF561629D9323720ED6A80E9F8
                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                    Reputation:low
                                                                                                                                                                                                    Has exited:false

                                                                                                                                                                                                    General

                                                                                                                                                                                                    Target ID:14
                                                                                                                                                                                                    Start time:15:39:08
                                                                                                                                                                                                    Start date:03/10/2024
                                                                                                                                                                                                    Path:C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exe
                                                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                                                    Commandline:"C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\certutil.exe" -addstore Root "C:\Program Files (x86)\iDentalSoft Bridge\bin\certutil\BridgeSelfCertificate.cer"
                                                                                                                                                                                                    Imagebase:0x1000000
                                                                                                                                                                                                    File size:569'344 bytes
                                                                                                                                                                                                    MD5 hash:711DB2EF10B6C2AB2080698AEC6C6D08
                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                    Reputation:low
                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                    General

                                                                                                                                                                                                    Target ID:15
                                                                                                                                                                                                    Start time:15:39:08
                                                                                                                                                                                                    Start date:03/10/2024
                                                                                                                                                                                                    Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                                    Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                    Imagebase:0x7ff66e660000
                                                                                                                                                                                                    File size:862'208 bytes
                                                                                                                                                                                                    MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                    Reputation:high
                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                    General

                                                                                                                                                                                                    Target ID:16
                                                                                                                                                                                                    Start time:15:39:08
                                                                                                                                                                                                    Start date:03/10/2024
                                                                                                                                                                                                    Path:C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                                                    Commandline:icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
                                                                                                                                                                                                    Imagebase:0xaf0000
                                                                                                                                                                                                    File size:29'696 bytes
                                                                                                                                                                                                    MD5 hash:2E49585E4E08565F52090B144062F97E
                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                    Reputation:high
                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                    General

                                                                                                                                                                                                    Target ID:17
                                                                                                                                                                                                    Start time:15:39:08
                                                                                                                                                                                                    Start date:03/10/2024
                                                                                                                                                                                                    Path:C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                                                    Commandline:icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage\bf02f2a4d931bd0.timestamp /grant "everyone":(OI)(CI)M
                                                                                                                                                                                                    Imagebase:0xaf0000
                                                                                                                                                                                                    File size:29'696 bytes
                                                                                                                                                                                                    MD5 hash:2E49585E4E08565F52090B144062F97E
                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                    Reputation:high
                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                    General

                                                                                                                                                                                                    Target ID:18
                                                                                                                                                                                                    Start time:15:39:08
                                                                                                                                                                                                    Start date:03/10/2024
                                                                                                                                                                                                    Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                                    Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                    Imagebase:0x7ff66e660000
                                                                                                                                                                                                    File size:862'208 bytes
                                                                                                                                                                                                    MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                    Reputation:high
                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                    General

                                                                                                                                                                                                    Target ID:19
                                                                                                                                                                                                    Start time:15:39:08
                                                                                                                                                                                                    Start date:03/10/2024
                                                                                                                                                                                                    Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                                    Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                    Imagebase:0x7ff66e660000
                                                                                                                                                                                                    File size:862'208 bytes
                                                                                                                                                                                                    MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                    Reputation:high
                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                    General

                                                                                                                                                                                                    Target ID:20
                                                                                                                                                                                                    Start time:15:39:11
                                                                                                                                                                                                    Start date:03/10/2024
                                                                                                                                                                                                    Path:C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                                                    Commandline:taskkill /F /IM iDSBridgeNative.exe
                                                                                                                                                                                                    Imagebase:0x440000
                                                                                                                                                                                                    File size:74'240 bytes
                                                                                                                                                                                                    MD5 hash:CA313FD7E6C2A778FFD21CFB5C1C56CD
                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                    General

                                                                                                                                                                                                    Target ID:21
                                                                                                                                                                                                    Start time:15:39:11
                                                                                                                                                                                                    Start date:03/10/2024
                                                                                                                                                                                                    Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                                    Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                    Imagebase:0x7ff66e660000
                                                                                                                                                                                                    File size:862'208 bytes
                                                                                                                                                                                                    MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                    General

                                                                                                                                                                                                    Target ID:22
                                                                                                                                                                                                    Start time:15:39:12
                                                                                                                                                                                                    Start date:03/10/2024
                                                                                                                                                                                                    Path:C:\Windows\SysWOW64\tasklist.exe
                                                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                                                    Commandline:tasklist
                                                                                                                                                                                                    Imagebase:0x7c0000
                                                                                                                                                                                                    File size:79'360 bytes
                                                                                                                                                                                                    MD5 hash:0A4448B31CE7F83CB7691A2657F330F1
                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                    General

                                                                                                                                                                                                    Target ID:23
                                                                                                                                                                                                    Start time:15:39:12
                                                                                                                                                                                                    Start date:03/10/2024
                                                                                                                                                                                                    Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                                    Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                    Imagebase:0x7ff66e660000
                                                                                                                                                                                                    File size:862'208 bytes
                                                                                                                                                                                                    MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                    General

                                                                                                                                                                                                    Target ID:24
                                                                                                                                                                                                    Start time:15:39:12
                                                                                                                                                                                                    Start date:03/10/2024
                                                                                                                                                                                                    Path:C:\Program Files (x86)\iDentalSoft Bridge\bin\iDentalSoft-Bridge.exe
                                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                                    Commandline:"C:\Program Files (x86)\iDentalSoft Bridge\bin\iDentalSoft-Bridge.exe"
                                                                                                                                                                                                    Imagebase:0x400000
                                                                                                                                                                                                    File size:33'104 bytes
                                                                                                                                                                                                    MD5 hash:3A8BD34A555D3F6AE3EE8D35168A5A48
                                                                                                                                                                                                    Has elevated privileges:false
                                                                                                                                                                                                    Has administrator privileges:false
                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                    General

                                                                                                                                                                                                    Target ID:26
                                                                                                                                                                                                    Start time:15:39:13
                                                                                                                                                                                                    Start date:03/10/2024
                                                                                                                                                                                                    Path:C:\Program Files (x86)\iDentalSoft Bridge\iDSBridgeNative.exe
                                                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                                                    Commandline:"C:\Program Files (x86)\iDentalSoft Bridge\iDSBridgeNative.exe"
                                                                                                                                                                                                    Imagebase:0xa60000
                                                                                                                                                                                                    File size:52'560 bytes
                                                                                                                                                                                                    MD5 hash:1ED16F2085B9AEB0455D4152C4C08E2F
                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                    Has exited:false

                                                                                                                                                                                                    General

                                                                                                                                                                                                    Target ID:28
                                                                                                                                                                                                    Start time:15:39:13
                                                                                                                                                                                                    Start date:03/10/2024
                                                                                                                                                                                                    Path:C:\Program Files (x86)\iDentalSoft Bridge\bin\iDentalSoft-Bridge.exe
                                                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                                                    Commandline:"C:\Program Files (x86)\iDentalSoft Bridge\bin\iDentalSoft-Bridge.exe"
                                                                                                                                                                                                    Imagebase:0x400000
                                                                                                                                                                                                    File size:33'104 bytes
                                                                                                                                                                                                    MD5 hash:3A8BD34A555D3F6AE3EE8D35168A5A48
                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                    General

                                                                                                                                                                                                    Target ID:29
                                                                                                                                                                                                    Start time:15:39:13
                                                                                                                                                                                                    Start date:03/10/2024
                                                                                                                                                                                                    Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                                    Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                    Imagebase:0x7ff66e660000
                                                                                                                                                                                                    File size:862'208 bytes
                                                                                                                                                                                                    MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                    General

                                                                                                                                                                                                    Target ID:30
                                                                                                                                                                                                    Start time:15:39:13
                                                                                                                                                                                                    Start date:03/10/2024
                                                                                                                                                                                                    Path:C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                                                    Commandline:C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\5504.tmp\iDental-Agent.bat""
                                                                                                                                                                                                    Imagebase:0x1c0000
                                                                                                                                                                                                    File size:236'544 bytes
                                                                                                                                                                                                    MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                    General

                                                                                                                                                                                                    Target ID:31
                                                                                                                                                                                                    Start time:15:39:13
                                                                                                                                                                                                    Start date:03/10/2024
                                                                                                                                                                                                    Path:C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ.exe
                                                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                                                    Commandline:"C:\Program Files (x86)\iDentalSoft Bridge\jre\bin\iDSBridgeJ" -Xss1m -Xms512M -Xmx512M -XX:MaxPermSize=256M -cp "C:\Program Files (x86)\iDentalSoft Bridge\iDentalSoftBridge.jar";etc\ com.iss.idental.bridge.main.BridgeApplicationMain
                                                                                                                                                                                                    Imagebase:0xb20000
                                                                                                                                                                                                    File size:191'552 bytes
                                                                                                                                                                                                    MD5 hash:9F8C5EAF561629D9323720ED6A80E9F8
                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                    Disassembly

                                                                                                                                                                                                    Reset < >

                                                                                                                                                                                                      Execution Graph

                                                                                                                                                                                                      Execution Coverage:22.9%
                                                                                                                                                                                                      Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                                                      Signature Coverage:2.5%
                                                                                                                                                                                                      Total number of Nodes:1453
                                                                                                                                                                                                      Total number of Limit Nodes:26
                                                                                                                                                                                                      execution_graph 4980 409c40 5021 4030dc 4980->5021 4982 409c56 5024 4042e8 4982->5024 4984 409c5b 5027 40457c GetModuleHandleA GetProcAddress 4984->5027 4988 409c65 5035 4065c8 4988->5035 4990 409c6a 5044 4090a4 GetModuleHandleA GetProcAddress GetModuleHandleA GetProcAddress 4990->5044 5007 409d43 5106 4074a0 5007->5106 5009 409d05 5009->5007 5139 409aa0 5009->5139 5010 409d84 5110 407a28 5010->5110 5011 409d69 5011->5010 5012 409aa0 18 API calls 5011->5012 5012->5010 5014 409da9 5120 408b08 5014->5120 5018 409def 5019 408b08 35 API calls 5018->5019 5020 409e28 5018->5020 5019->5018 5149 403094 5021->5149 5023 4030e1 GetModuleHandleA GetCommandLineA 5023->4982 5026 404323 5024->5026 5150 403154 5024->5150 5026->4984 5028 404598 5027->5028 5029 40459f GetProcAddress 5027->5029 5028->5029 5030 4045b5 GetProcAddress 5029->5030 5031 4045ae 5029->5031 5032 4045c4 SetProcessDEPPolicy 5030->5032 5033 4045c8 5030->5033 5031->5030 5032->5033 5034 404624 6F9C1CD0 5033->5034 5034->4988 5163 405ca8 5035->5163 5045 4090f7 5044->5045 5325 406fa0 SetErrorMode 5045->5325 5050 403198 4 API calls 5051 40913c 5050->5051 5052 409b30 GetSystemInfo VirtualQuery 5051->5052 5053 409be4 5052->5053 5056 409b5a 5052->5056 5058 409768 5053->5058 5054 409bc5 VirtualQuery 5054->5053 5054->5056 5055 409b84 VirtualProtect 5055->5056 5056->5053 5056->5054 5056->5055 5057 409bb3 VirtualProtect 5056->5057 5057->5054 5335 406bd0 GetCommandLineA 5058->5335 5060 409825 5061 4031b8 4 API calls 5060->5061 5063 40983f 5061->5063 5062 406c2c 20 API calls 5065 409785 5062->5065 5066 406c2c 5063->5066 5064 403454 18 API calls 5064->5065 5065->5060 5065->5062 5065->5064 5067 406c53 GetModuleFileNameA 5066->5067 5068 406c77 GetCommandLineA 5066->5068 5069 403278 18 API calls 5067->5069 5072 406c7c 5068->5072 5070 406c75 5069->5070 5073 406ca4 5070->5073 5071 406c81 5074 403198 4 API calls 5071->5074 5072->5071 5075 406af0 18 API calls 5072->5075 5076 406c89 5072->5076 5077 403198 4 API calls 5073->5077 5074->5076 5075->5072 5079 40322c 4 API calls 5076->5079 5078 406cb9 5077->5078 5080 4031e8 5078->5080 5079->5073 5081 4031ec 5080->5081 5084 4031fc 5080->5084 5083 403254 18 API calls 5081->5083 5081->5084 5082 403228 5086 4074e0 5082->5086 5083->5084 5084->5082 5085 4025ac 4 API calls 5084->5085 5085->5082 5087 4074ea 5086->5087 5356 407576 5087->5356 5359 407578 5087->5359 5088 407516 5089 40752a 5088->5089 5362 40748c GetLastError 5088->5362 5093 409bec FindResourceA 5089->5093 5094 409c01 5093->5094 5095 409c06 SizeofResource 5093->5095 5096 409aa0 18 API calls 5094->5096 5097 409c13 5095->5097 5098 409c18 LoadResource 5095->5098 5096->5095 5099 409aa0 18 API calls 5097->5099 5100 409c26 5098->5100 5101 409c2b LockResource 5098->5101 5099->5098 5104 409aa0 18 API calls 5100->5104 5102 409c37 5101->5102 5103 409c3c 5101->5103 5105 409aa0 18 API calls 5102->5105 5103->5009 5136 407918 5103->5136 5104->5101 5105->5103 5108 4074b4 5106->5108 5107 4074c4 5107->5011 5108->5107 5109 4073ec 34 API calls 5108->5109 5109->5107 5111 407a35 5110->5111 5112 405890 18 API calls 5111->5112 5113 407a89 5111->5113 5112->5113 5114 407918 InterlockedExchange 5113->5114 5115 407a9b 5114->5115 5116 405890 18 API calls 5115->5116 5117 407ab1 5115->5117 5116->5117 5118 407af4 5117->5118 5119 405890 18 API calls 5117->5119 5118->5014 5119->5118 5130 408b82 5120->5130 5135 408b39 5120->5135 5121 408bcd 5470 407cb8 5121->5470 5122 407cb8 35 API calls 5122->5135 5123 407cb8 35 API calls 5123->5130 5126 408be4 5128 4031b8 4 API calls 5126->5128 5127 4034f0 18 API calls 5127->5130 5129 408bfe 5128->5129 5146 404c20 5129->5146 5130->5121 5130->5123 5130->5127 5133 403420 18 API calls 5130->5133 5134 4031e8 18 API calls 5130->5134 5131 403420 18 API calls 5131->5135 5132 4031e8 18 API calls 5132->5135 5133->5130 5134->5130 5135->5122 5135->5130 5135->5131 5135->5132 5461 4034f0 5135->5461 5496 4078c4 5136->5496 5140 409ac1 5139->5140 5141 409aa9 5139->5141 5143 405890 18 API calls 5140->5143 5142 405890 18 API calls 5141->5142 5144 409abb 5142->5144 5145 409ad2 5143->5145 5144->5007 5145->5007 5147 402594 18 API calls 5146->5147 5148 404c2b 5147->5148 5148->5018 5149->5023 5151 403164 5150->5151 5152 40318c TlsGetValue 5150->5152 5151->5026 5153 403196 5152->5153 5154 40316f 5152->5154 5153->5026 5158 40310c 5154->5158 5156 403174 TlsGetValue 5157 403184 5156->5157 5157->5026 5159 403120 LocalAlloc 5158->5159 5160 403116 5158->5160 5161 40313e TlsSetValue 5159->5161 5162 403132 5159->5162 5160->5159 5161->5162 5162->5156 5235 405940 5163->5235 5166 405280 GetSystemDefaultLCID 5170 4052b6 5166->5170 5167 404cdc 19 API calls 5167->5170 5168 40520c 19 API calls 5168->5170 5169 4031e8 18 API calls 5169->5170 5170->5167 5170->5168 5170->5169 5174 405318 5170->5174 5171 40520c 19 API calls 5171->5174 5172 4031e8 18 API calls 5172->5174 5173 404cdc 19 API calls 5173->5174 5174->5171 5174->5172 5174->5173 5175 40539b 5174->5175 5303 4031b8 5175->5303 5178 4053c4 GetSystemDefaultLCID 5307 40520c GetLocaleInfoA 5178->5307 5181 4031e8 18 API calls 5182 405404 5181->5182 5183 40520c 19 API calls 5182->5183 5184 405419 5183->5184 5185 40520c 19 API calls 5184->5185 5186 40543d 5185->5186 5313 405258 GetLocaleInfoA 5186->5313 5189 405258 GetLocaleInfoA 5190 40546d 5189->5190 5191 40520c 19 API calls 5190->5191 5192 405487 5191->5192 5193 405258 GetLocaleInfoA 5192->5193 5194 4054a4 5193->5194 5195 40520c 19 API calls 5194->5195 5196 4054be 5195->5196 5197 4031e8 18 API calls 5196->5197 5198 4054cb 5197->5198 5199 40520c 19 API calls 5198->5199 5200 4054e0 5199->5200 5201 4031e8 18 API calls 5200->5201 5202 4054ed 5201->5202 5203 405258 GetLocaleInfoA 5202->5203 5204 4054fb 5203->5204 5205 40520c 19 API calls 5204->5205 5206 405515 5205->5206 5207 4031e8 18 API calls 5206->5207 5208 405522 5207->5208 5209 40520c 19 API calls 5208->5209 5210 405537 5209->5210 5211 4031e8 18 API calls 5210->5211 5212 405544 5211->5212 5213 40520c 19 API calls 5212->5213 5214 405559 5213->5214 5215 405576 5214->5215 5216 405567 5214->5216 5218 40322c 4 API calls 5215->5218 5321 40322c 5216->5321 5219 405574 5218->5219 5220 40520c 19 API calls 5219->5220 5221 405598 5220->5221 5222 4055b5 5221->5222 5223 4055a6 5221->5223 5224 403198 4 API calls 5222->5224 5225 40322c 4 API calls 5223->5225 5226 4055b3 5224->5226 5225->5226 5315 4033b4 5226->5315 5228 4055d7 5229 4033b4 18 API calls 5228->5229 5230 4055f1 5229->5230 5231 4031b8 LocalAlloc TlsSetValue TlsGetValue TlsGetValue 5230->5231 5232 40560b 5231->5232 5233 405cf4 GetVersionExA 5232->5233 5234 405d0b 5233->5234 5234->4990 5236 40594c 5235->5236 5243 404cdc LoadStringA 5236->5243 5239 4031e8 18 API calls 5240 40597d 5239->5240 5246 403198 5240->5246 5250 403278 5243->5250 5247 4031b7 5246->5247 5248 40319e 5246->5248 5247->5166 5248->5247 5299 4025ac 5248->5299 5255 403254 5250->5255 5252 403288 5253 403198 4 API calls 5252->5253 5254 4032a0 5253->5254 5254->5239 5256 403274 5255->5256 5257 403258 5255->5257 5256->5252 5260 402594 5257->5260 5259 403261 5259->5252 5261 402598 5260->5261 5263 4025a2 5260->5263 5266 401fd4 5261->5266 5262 40259e 5262->5263 5264 403154 4 API calls 5262->5264 5263->5259 5263->5263 5264->5263 5267 401fe8 5266->5267 5268 401fed 5266->5268 5277 401918 RtlInitializeCriticalSection 5267->5277 5270 402012 RtlEnterCriticalSection 5268->5270 5271 40201c 5268->5271 5274 401ff1 5268->5274 5270->5271 5271->5274 5284 401ee0 5271->5284 5274->5262 5275 402147 5275->5262 5276 40213d RtlLeaveCriticalSection 5276->5275 5278 40193c RtlEnterCriticalSection 5277->5278 5279 401946 5277->5279 5278->5279 5280 401964 LocalAlloc 5279->5280 5281 40197e 5280->5281 5282 4019c3 RtlLeaveCriticalSection 5281->5282 5283 4019cd 5281->5283 5282->5283 5283->5268 5286 401ef0 5284->5286 5285 401f1c 5289 401f40 5285->5289 5295 401d00 5285->5295 5286->5285 5286->5289 5290 401e58 5286->5290 5289->5275 5289->5276 5291 4016d8 LocalAlloc VirtualAlloc VirtualFree VirtualFree VirtualAlloc 5290->5291 5292 401e68 5291->5292 5293 401dcc 9 API calls 5292->5293 5294 401e75 5292->5294 5293->5294 5294->5286 5296 401d4e 5295->5296 5297 401d1e 5295->5297 5296->5297 5298 401c68 9 API calls 5296->5298 5297->5289 5298->5297 5300 4025b0 5299->5300 5302 4025ba 5299->5302 5301 403154 4 API calls 5300->5301 5300->5302 5301->5302 5302->5247 5305 4031be 5303->5305 5304 4031e3 5304->5178 5305->5304 5306 4025ac 4 API calls 5305->5306 5306->5305 5308 405233 5307->5308 5309 405245 5307->5309 5310 403278 18 API calls 5308->5310 5311 40322c 4 API calls 5309->5311 5312 405243 5310->5312 5311->5312 5312->5181 5314 405274 5313->5314 5314->5189 5316 4033bc 5315->5316 5317 403254 18 API calls 5316->5317 5318 4033cf 5317->5318 5319 4031e8 18 API calls 5318->5319 5320 4033f7 5319->5320 5323 403230 5321->5323 5322 403252 5322->5219 5323->5322 5324 4025ac 4 API calls 5323->5324 5324->5322 5333 403414 5325->5333 5328 406fee 5329 407284 FormatMessageA 5328->5329 5330 4072aa 5329->5330 5331 403278 18 API calls 5330->5331 5332 4072c7 5331->5332 5332->5050 5334 403418 LoadLibraryA 5333->5334 5334->5328 5342 406af0 5335->5342 5337 406bf3 5338 406af0 18 API calls 5337->5338 5339 406c05 5337->5339 5338->5337 5340 403198 4 API calls 5339->5340 5341 406c1a 5340->5341 5341->5065 5343 406b1c 5342->5343 5344 403278 18 API calls 5343->5344 5345 406b29 5344->5345 5352 403420 5345->5352 5347 406b31 5348 4031e8 18 API calls 5347->5348 5349 406b49 5348->5349 5350 403198 4 API calls 5349->5350 5351 406b6b 5350->5351 5351->5337 5353 403426 5352->5353 5355 403437 5352->5355 5354 403254 18 API calls 5353->5354 5353->5355 5354->5355 5355->5347 5357 407578 5356->5357 5358 4075b7 CreateFileA 5357->5358 5358->5088 5360 403414 5359->5360 5361 4075b7 CreateFileA 5360->5361 5361->5088 5365 4073ec 5362->5365 5366 407284 19 API calls 5365->5366 5367 407414 5366->5367 5368 407434 5367->5368 5374 405194 5367->5374 5377 405890 5368->5377 5371 407443 5372 403198 4 API calls 5371->5372 5373 407460 5372->5373 5373->5089 5381 4051a8 5374->5381 5378 405897 5377->5378 5379 4031e8 18 API calls 5378->5379 5380 4058af 5379->5380 5380->5371 5382 4051c5 5381->5382 5389 404e58 5382->5389 5385 4051f1 5387 403278 18 API calls 5385->5387 5388 4051a3 5387->5388 5388->5368 5393 404e73 5389->5393 5390 404e85 5390->5385 5394 404be4 5390->5394 5393->5390 5397 404f7a 5393->5397 5404 404e4c 5393->5404 5395 405940 19 API calls 5394->5395 5396 404bf5 5395->5396 5396->5385 5398 404f8b 5397->5398 5401 404fd9 5397->5401 5400 40505f 5398->5400 5398->5401 5403 404ff7 5400->5403 5411 404e38 5400->5411 5401->5403 5407 404df4 5401->5407 5403->5393 5403->5403 5405 403198 4 API calls 5404->5405 5406 404e56 5405->5406 5406->5393 5408 404e02 5407->5408 5414 404bfc 5408->5414 5410 404e30 5410->5401 5427 4039a4 5411->5427 5417 4059b0 5414->5417 5416 404c15 5416->5410 5418 4059be 5417->5418 5419 404cdc 19 API calls 5418->5419 5420 4059e8 5419->5420 5421 405194 33 API calls 5420->5421 5422 4059f6 5421->5422 5423 4031e8 18 API calls 5422->5423 5424 405a01 5423->5424 5425 4031b8 LocalAlloc TlsSetValue TlsGetValue TlsGetValue 5424->5425 5426 405a1b 5425->5426 5426->5416 5428 4039ab 5427->5428 5433 4038b4 5428->5433 5430 4039cb 5431 403198 4 API calls 5430->5431 5432 4039d2 5431->5432 5432->5403 5434 4038d5 5433->5434 5435 4038c8 5433->5435 5437 403934 5434->5437 5438 4038db 5434->5438 5436 403780 6 API calls 5435->5436 5441 4038d0 5436->5441 5439 403993 5437->5439 5440 40393b 5437->5440 5442 4038e1 5438->5442 5443 4038ee 5438->5443 5448 4037f4 VariantClear VariantChangeTypeEx VariantChangeTypeEx 5439->5448 5444 403941 5440->5444 5445 40394b 5440->5445 5441->5430 5446 403894 6 API calls 5442->5446 5447 403894 6 API calls 5443->5447 5449 403864 23 API calls 5444->5449 5450 4037f4 VariantClear VariantChangeTypeEx VariantChangeTypeEx 5445->5450 5446->5441 5451 4038fc 5447->5451 5448->5441 5449->5441 5452 40395d 5450->5452 5453 4037f4 VariantClear VariantChangeTypeEx VariantChangeTypeEx 5451->5453 5454 403864 23 API calls 5452->5454 5455 403917 5453->5455 5456 403976 5454->5456 5457 40374c VariantClear 5455->5457 5458 40374c VariantClear 5456->5458 5459 40392c 5457->5459 5460 40398b 5458->5460 5459->5430 5460->5430 5463 4034fd 5461->5463 5469 40352d 5461->5469 5462 403198 4 API calls 5465 403517 5462->5465 5464 403526 5463->5464 5466 403509 5463->5466 5467 403254 18 API calls 5464->5467 5465->5135 5476 4025c4 5466->5476 5467->5469 5469->5462 5471 407cd3 5470->5471 5475 407cc8 5470->5475 5480 407c5c 5471->5480 5474 405890 18 API calls 5474->5475 5475->5126 5477 4025ca 5476->5477 5478 4025dc 5477->5478 5479 403154 4 API calls 5477->5479 5478->5465 5478->5478 5479->5478 5481 407caf 5480->5481 5482 407c70 5480->5482 5481->5474 5481->5475 5482->5481 5484 407bac 5482->5484 5485 407bb7 5484->5485 5486 407bc8 5484->5486 5487 405890 18 API calls 5485->5487 5488 4074a0 34 API calls 5486->5488 5487->5486 5489 407bdc 5488->5489 5490 4074a0 34 API calls 5489->5490 5491 407bfd 5490->5491 5492 407918 InterlockedExchange 5491->5492 5493 407c12 5492->5493 5494 407c28 5493->5494 5495 405890 18 API calls 5493->5495 5494->5482 5495->5494 5497 4078d6 5496->5497 5498 4078e7 5496->5498 5499 4078db InterlockedExchange 5497->5499 5498->5009 5499->5498 6172 409e47 6173 409e6c 6172->6173 6174 4098f4 29 API calls 6173->6174 6177 409e71 6174->6177 6175 409ec4 6206 4026c4 GetSystemTime 6175->6206 6177->6175 6181 408dd8 18 API calls 6177->6181 6178 409ec9 6179 409330 46 API calls 6178->6179 6180 409ed1 6179->6180 6182 4031e8 18 API calls 6180->6182 6183 409ea0 6181->6183 6184 409ede 6182->6184 6186 409ea8 MessageBoxA 6183->6186 6185 406928 19 API calls 6184->6185 6187 409eeb 6185->6187 6186->6175 6188 409eb5 6186->6188 6189 4066c0 19 API calls 6187->6189 6190 405864 19 API calls 6188->6190 6191 409efb 6189->6191 6190->6175 6192 406638 19 API calls 6191->6192 6193 409f0c 6192->6193 6194 403340 18 API calls 6193->6194 6195 409f1a 6194->6195 6196 4031e8 18 API calls 6195->6196 6197 409f2a 6196->6197 6198 4074e0 37 API calls 6197->6198 6199 409f69 6198->6199 6200 402594 18 API calls 6199->6200 6201 409f89 6200->6201 6202 407a28 19 API calls 6201->6202 6203 409fcb 6202->6203 6204 407cb8 35 API calls 6203->6204 6205 409ff2 6204->6205 6206->6178 6085 407548 6086 407554 CloseHandle 6085->6086 6087 40755d 6085->6087 6086->6087 6658 402b48 RaiseException 6088 407749 6089 4076dc WriteFile 6088->6089 6097 407724 6088->6097 6090 4076e8 6089->6090 6091 4076ef 6089->6091 6092 40748c 35 API calls 6090->6092 6093 407700 6091->6093 6094 4073ec 34 API calls 6091->6094 6092->6091 6094->6093 6095 4077e0 6096 4078db InterlockedExchange 6095->6096 6099 407890 6095->6099 6098 4078e7 6096->6098 6097->6088 6097->6095 6659 40294a 6660 402952 6659->6660 6661 403554 4 API calls 6660->6661 6662 402967 6660->6662 6661->6660 6663 403f4a 6664 403f53 6663->6664 6665 403f5c 6663->6665 6666 403f07 4 API calls 6664->6666 6666->6665 6207 403a52 6208 403a74 6207->6208 6209 403a5a WriteFile 6207->6209 6209->6208 6210 403a78 GetLastError 6209->6210 6210->6208 6211 402654 6212 403154 4 API calls 6211->6212 6213 402614 6212->6213 6214 402632 6213->6214 6215 403154 4 API calls 6213->6215 6215->6214 6675 405160 6676 405173 6675->6676 6677 404e58 33 API calls 6676->6677 6678 405187 6677->6678 5500 409e62 5501 409aa0 18 API calls 5500->5501 5502 409e67 5501->5502 5503 409e6c 5502->5503 5603 402f24 5502->5603 5537 4098f4 5503->5537 5506 409ec4 5542 4026c4 GetSystemTime 5506->5542 5508 409e71 5508->5506 5608 408dd8 5508->5608 5509 409ec9 5543 409330 5509->5543 5513 4031e8 18 API calls 5515 409ede 5513->5515 5514 409ea0 5517 409ea8 MessageBoxA 5514->5517 5561 406928 5515->5561 5517->5506 5519 409eb5 5517->5519 5611 405864 5519->5611 5524 409f0c 5588 403340 5524->5588 5526 409f1a 5527 4031e8 18 API calls 5526->5527 5528 409f2a 5527->5528 5529 4074e0 37 API calls 5528->5529 5530 409f69 5529->5530 5531 402594 18 API calls 5530->5531 5532 409f89 5531->5532 5533 407a28 19 API calls 5532->5533 5534 409fcb 5533->5534 5535 407cb8 35 API calls 5534->5535 5536 409ff2 5535->5536 5615 40953c 5537->5615 5542->5509 5560 409350 5543->5560 5546 409375 CreateDirectoryA 5547 4093ed 5546->5547 5548 40937f GetLastError 5546->5548 5549 40322c 4 API calls 5547->5549 5548->5560 5550 4093f7 5549->5550 5552 4031b8 4 API calls 5550->5552 5551 408dd8 18 API calls 5551->5560 5554 409411 5552->5554 5555 4031b8 4 API calls 5554->5555 5557 40941e 5555->5557 5556 407284 19 API calls 5556->5560 5557->5513 5559 405890 18 API calls 5559->5560 5560->5546 5560->5551 5560->5556 5560->5559 5707 406cf4 5560->5707 5730 409224 5560->5730 5749 404c94 5560->5749 5752 408da8 5560->5752 5862 406820 5561->5862 5564 403454 18 API calls 5565 40694a 5564->5565 5566 4066c0 5565->5566 5867 4068e4 5566->5867 5569 4066f0 5571 403340 18 API calls 5569->5571 5570 4066fe 5572 403454 18 API calls 5570->5572 5573 4066fc 5571->5573 5574 406711 5572->5574 5576 403198 4 API calls 5573->5576 5575 403340 18 API calls 5574->5575 5575->5573 5577 406733 5576->5577 5578 406638 5577->5578 5579 406642 5578->5579 5580 406665 5578->5580 5873 406950 5579->5873 5581 40322c 4 API calls 5580->5581 5583 40666e 5581->5583 5583->5524 5584 406649 5584->5580 5585 406654 5584->5585 5586 403340 18 API calls 5585->5586 5587 406662 5586->5587 5587->5524 5589 403344 5588->5589 5590 4033a5 5588->5590 5591 4031e8 5589->5591 5592 40334c 5589->5592 5594 4031fc 5591->5594 5595 403254 18 API calls 5591->5595 5592->5590 5597 4031e8 18 API calls 5592->5597 5598 40335b 5592->5598 5593 403228 5593->5526 5594->5593 5599 4025ac 4 API calls 5594->5599 5595->5594 5596 403254 18 API calls 5600 403375 5596->5600 5597->5598 5598->5596 5599->5593 5601 4031e8 18 API calls 5600->5601 5602 4033a1 5601->5602 5602->5526 5604 403154 4 API calls 5603->5604 5605 402f29 5604->5605 5879 402bcc 5605->5879 5607 402f51 5607->5607 5609 408da8 18 API calls 5608->5609 5610 408df4 5609->5610 5610->5514 5612 405869 5611->5612 5613 405940 19 API calls 5612->5613 5614 40587b 5613->5614 5614->5614 5622 40955b 5615->5622 5616 409590 5618 40959d GetUserDefaultLangID 5616->5618 5623 409592 5616->5623 5617 409594 5633 407024 GetModuleHandleA GetProcAddress 5617->5633 5618->5623 5621 40956f 5627 409884 5621->5627 5622->5616 5622->5617 5622->5621 5623->5621 5624 4095cb GetACP 5623->5624 5625 4095ef 5623->5625 5624->5621 5624->5623 5625->5621 5626 409615 GetACP 5625->5626 5626->5621 5626->5625 5628 40988c 5627->5628 5632 4098c6 5627->5632 5629 403420 18 API calls 5628->5629 5628->5632 5630 4098c0 5629->5630 5691 408e80 5630->5691 5632->5508 5634 407067 5633->5634 5635 40705e 5633->5635 5636 407070 5634->5636 5637 4070a8 5634->5637 5644 403198 4 API calls 5635->5644 5654 406f68 5636->5654 5639 406f68 RegOpenKeyExA 5637->5639 5642 4070c1 5639->5642 5640 407089 5641 4070de 5640->5641 5657 406f5c 5640->5657 5646 40322c 4 API calls 5641->5646 5642->5641 5645 406f5c 20 API calls 5642->5645 5648 407120 5644->5648 5649 4070d5 RegCloseKey 5645->5649 5650 4070eb 5646->5650 5651 403198 4 API calls 5648->5651 5649->5641 5660 4032fc 5650->5660 5653 407128 5651->5653 5653->5623 5655 406f73 5654->5655 5656 406f79 RegOpenKeyExA 5654->5656 5655->5656 5656->5640 5674 406e10 5657->5674 5661 403300 5660->5661 5662 40333f 5660->5662 5663 40330a 5661->5663 5669 4031e8 5661->5669 5662->5635 5664 403334 5663->5664 5665 40331d 5663->5665 5666 4034f0 18 API calls 5664->5666 5668 4034f0 18 API calls 5665->5668 5673 403322 5666->5673 5667 403228 5667->5635 5668->5673 5670 403254 18 API calls 5669->5670 5671 4031fc 5669->5671 5670->5671 5671->5667 5672 4025ac 4 API calls 5671->5672 5672->5667 5673->5635 5675 406e36 RegQueryValueExA 5674->5675 5676 406e7b 5675->5676 5681 406e59 5675->5681 5678 403198 4 API calls 5676->5678 5677 406e73 5679 403198 4 API calls 5677->5679 5680 406f47 RegCloseKey 5678->5680 5679->5676 5680->5641 5681->5676 5681->5677 5682 403278 18 API calls 5681->5682 5683 403420 18 API calls 5681->5683 5682->5681 5684 406eb0 RegQueryValueExA 5683->5684 5684->5675 5686 406ecc 5684->5686 5685 4034f0 18 API calls 5687 406f0e 5685->5687 5686->5676 5686->5685 5688 406f20 5687->5688 5690 403420 18 API calls 5687->5690 5689 4031e8 18 API calls 5688->5689 5689->5676 5690->5688 5692 408e8e 5691->5692 5694 408ea6 5692->5694 5704 408e18 5692->5704 5695 408e18 18 API calls 5694->5695 5696 408eca 5694->5696 5695->5696 5697 407918 InterlockedExchange 5696->5697 5698 408ee5 5697->5698 5699 408e18 18 API calls 5698->5699 5701 408ef8 5698->5701 5699->5701 5700 408e18 18 API calls 5700->5701 5701->5700 5702 403278 18 API calls 5701->5702 5703 408f27 5701->5703 5702->5701 5703->5632 5705 405890 18 API calls 5704->5705 5706 408e29 5705->5706 5706->5694 5756 406a58 5707->5756 5710 406d26 5712 406a58 19 API calls 5710->5712 5713 406d72 5710->5713 5715 406d36 5712->5715 5764 406888 5713->5764 5714 406d42 5714->5713 5718 406d67 5714->5718 5721 406a58 19 API calls 5714->5721 5715->5714 5717 406a34 21 API calls 5715->5717 5717->5714 5718->5713 5776 406cc8 GetWindowsDirectoryA 5718->5776 5723 406d5b 5721->5723 5722 406638 19 API calls 5724 406d87 5722->5724 5723->5718 5726 406a34 21 API calls 5723->5726 5725 40322c 4 API calls 5724->5725 5727 406d91 5725->5727 5726->5718 5728 4031b8 4 API calls 5727->5728 5729 406dab 5728->5729 5729->5560 5731 409244 5730->5731 5732 406638 19 API calls 5731->5732 5733 40925d 5732->5733 5734 40322c 4 API calls 5733->5734 5735 409268 5734->5735 5736 406978 20 API calls 5735->5736 5738 4033b4 18 API calls 5735->5738 5739 408dd8 18 API calls 5735->5739 5741 405890 18 API calls 5735->5741 5742 4092e4 5735->5742 5816 4091b0 5735->5816 5824 409034 5735->5824 5736->5735 5738->5735 5739->5735 5741->5735 5743 40322c 4 API calls 5742->5743 5744 4092ef 5743->5744 5745 4031b8 4 API calls 5744->5745 5746 409309 5745->5746 5747 403198 4 API calls 5746->5747 5748 409311 5747->5748 5748->5560 5750 4051a8 33 API calls 5749->5750 5751 404cb2 5750->5751 5751->5560 5753 408dc8 5752->5753 5852 408c80 5753->5852 5757 4034f0 18 API calls 5756->5757 5759 406a6b 5757->5759 5758 406a82 GetEnvironmentVariableA 5758->5759 5760 406a8e 5758->5760 5759->5758 5763 406a95 5759->5763 5778 406dec 5759->5778 5761 403198 4 API calls 5760->5761 5761->5763 5763->5710 5773 406a34 5763->5773 5765 403414 5764->5765 5766 4068ab GetFullPathNameA 5765->5766 5767 4068b7 5766->5767 5768 4068ce 5766->5768 5767->5768 5769 4068bf 5767->5769 5770 40322c 4 API calls 5768->5770 5771 403278 18 API calls 5769->5771 5772 4068cc 5770->5772 5771->5772 5772->5722 5782 4069dc 5773->5782 5777 406ce9 5776->5777 5777->5713 5779 406dfa 5778->5779 5780 4034f0 18 API calls 5779->5780 5781 406e08 5780->5781 5781->5759 5789 406978 5782->5789 5784 4069fe 5785 406a06 GetFileAttributesA 5784->5785 5786 406a1b 5785->5786 5787 403198 4 API calls 5786->5787 5788 406a23 5787->5788 5788->5710 5799 406744 5789->5799 5791 4069b0 5794 4069c6 5791->5794 5795 4069bb 5791->5795 5793 406989 5793->5791 5806 406970 CharPrevA 5793->5806 5807 403454 5794->5807 5796 40322c 4 API calls 5795->5796 5798 4069c4 5796->5798 5798->5784 5802 406755 5799->5802 5800 4067b9 5801 406680 IsDBCSLeadByte 5800->5801 5804 4067b4 5800->5804 5801->5804 5802->5800 5803 406773 5802->5803 5803->5804 5814 406680 IsDBCSLeadByte 5803->5814 5804->5793 5806->5793 5808 403486 5807->5808 5810 403459 5807->5810 5809 403198 4 API calls 5808->5809 5811 40347c 5809->5811 5810->5808 5812 40346d 5810->5812 5811->5798 5813 403278 18 API calls 5812->5813 5813->5811 5815 406694 5814->5815 5815->5803 5817 403198 4 API calls 5816->5817 5819 4091d1 5817->5819 5821 4091fe 5819->5821 5833 4032a8 5819->5833 5836 403494 5819->5836 5822 403198 4 API calls 5821->5822 5823 409213 5822->5823 5823->5735 5840 408f70 5824->5840 5826 40904a 5827 40904e 5826->5827 5846 406a48 5826->5846 5827->5735 5830 409081 5849 408fac 5830->5849 5834 403278 18 API calls 5833->5834 5835 4032b5 5834->5835 5835->5819 5837 4034c3 5836->5837 5838 403498 5836->5838 5837->5819 5839 4034f0 18 API calls 5838->5839 5839->5837 5841 408f7a 5840->5841 5842 408f7e 5840->5842 5841->5826 5843 408fa0 SetLastError 5842->5843 5844 408f87 Wow64DisableWow64FsRedirection 5842->5844 5845 408f9b 5843->5845 5844->5845 5845->5826 5847 4069dc 21 API calls 5846->5847 5848 406a52 GetLastError 5847->5848 5848->5830 5850 408fb1 Wow64RevertWow64FsRedirection 5849->5850 5851 408fbb 5849->5851 5850->5851 5851->5735 5853 403198 4 API calls 5852->5853 5860 408cb1 5852->5860 5853->5860 5854 408cdc 5855 4031b8 4 API calls 5854->5855 5856 408d69 5855->5856 5856->5560 5857 408cc8 5859 4032fc 18 API calls 5857->5859 5858 403278 18 API calls 5858->5860 5859->5854 5860->5854 5860->5857 5860->5858 5861 4032fc 18 API calls 5860->5861 5861->5860 5863 406744 IsDBCSLeadByte 5862->5863 5865 406835 5863->5865 5864 40687f 5864->5564 5865->5864 5866 406680 IsDBCSLeadByte 5865->5866 5866->5865 5868 4068f3 5867->5868 5869 406820 IsDBCSLeadByte 5868->5869 5871 4068fe 5869->5871 5870 4066ea 5870->5569 5870->5570 5871->5870 5872 406680 IsDBCSLeadByte 5871->5872 5872->5871 5874 406957 5873->5874 5875 40695b 5873->5875 5874->5584 5878 406970 CharPrevA 5875->5878 5877 40696c 5877->5584 5878->5877 5880 402bd5 RaiseException 5879->5880 5881 402be6 5879->5881 5880->5881 5881->5607 6216 402e64 6217 402e69 6216->6217 6218 402e7a RtlUnwind 6217->6218 6219 402e5e 6217->6219 6220 402e9d 6218->6220 6233 40667c IsDBCSLeadByte 6234 406694 6233->6234 6691 403f7d 6692 403fa2 6691->6692 6695 403f84 6691->6695 6694 403e8e 4 API calls 6692->6694 6692->6695 6693 403f8c 6694->6695 6695->6693 6696 402674 4 API calls 6695->6696 6697 403fca 6696->6697 5940 403d02 5942 403d12 5940->5942 5941 403ddf ExitProcess 5942->5941 5943 403db8 5942->5943 5946 403dea 5942->5946 5950 403da4 5942->5950 5951 403d8f MessageBoxA 5942->5951 5956 403cc8 5943->5956 5947 403cc8 4 API calls 5948 403dcc 5947->5948 5960 4019dc 5948->5960 5972 403fe4 5950->5972 5951->5943 5952 403dd1 5952->5941 5952->5946 5958 403cd6 5956->5958 5957 403ceb 5957->5947 5958->5957 5976 402674 5958->5976 5961 401abb 5960->5961 5962 4019ed 5960->5962 5961->5952 5963 401a04 RtlEnterCriticalSection 5962->5963 5964 401a0e LocalFree 5962->5964 5963->5964 5965 401a41 5964->5965 5966 401a49 5965->5966 5967 401a2f VirtualFree 5965->5967 5968 401a70 LocalFree 5966->5968 5969 401a87 5966->5969 5967->5965 5968->5968 5968->5969 5970 401aa9 RtlDeleteCriticalSection 5969->5970 5971 401a9f RtlLeaveCriticalSection 5969->5971 5970->5952 5971->5970 5973 403fe8 5972->5973 5979 403f07 5973->5979 5975 404006 5977 403154 4 API calls 5976->5977 5978 40267a 5977->5978 5978->5957 5982 403f09 5979->5982 5980 403f3c 5980->5975 5984 403154 4 API calls 5982->5984 5986 403e9c 5982->5986 5990 403f3d 5982->5990 6002 403e9c 5982->6002 5983 403ecf 5983->5975 5984->5982 5985 403ef2 5988 402674 4 API calls 5985->5988 5986->5980 5986->5985 5991 403ea9 5986->5991 5993 403e8e 5986->5993 5988->5983 5990->5975 5991->5983 5992 402674 4 API calls 5991->5992 5992->5983 5994 403e4c 5993->5994 5995 403e67 5994->5995 5996 403e62 5994->5996 5997 403e7b 5994->5997 6000 403e78 5995->6000 6001 402674 4 API calls 5995->6001 5998 403cc8 4 API calls 5996->5998 5999 402674 4 API calls 5997->5999 5998->5995 5999->6000 6000->5985 6000->5991 6001->6000 6003 403ed7 6002->6003 6009 403ea9 6002->6009 6005 403ef2 6003->6005 6006 403e8e 4 API calls 6003->6006 6004 403ecf 6004->5982 6007 402674 4 API calls 6005->6007 6008 403ee6 6006->6008 6007->6004 6008->6005 6008->6009 6009->6004 6010 402674 4 API calls 6009->6010 6010->6004 6239 404206 6240 4041cc 6239->6240 6243 40420a 6239->6243 6241 404282 6242 403154 4 API calls 6244 404323 6242->6244 6243->6241 6243->6242 6245 402c08 6248 402c82 6245->6248 6249 402c19 6245->6249 6246 402c56 RtlUnwind 6247 403154 4 API calls 6246->6247 6247->6248 6249->6246 6249->6248 6252 402b28 6249->6252 6253 402b31 RaiseException 6252->6253 6254 402b47 6252->6254 6253->6254 6254->6246 6255 408c10 6256 408c17 6255->6256 6257 403198 4 API calls 6256->6257 6265 408cb1 6257->6265 6258 408cdc 6259 4031b8 4 API calls 6258->6259 6260 408d69 6259->6260 6261 408cc8 6263 4032fc 18 API calls 6261->6263 6262 403278 18 API calls 6262->6265 6263->6258 6264 4032fc 18 API calls 6264->6265 6265->6258 6265->6261 6265->6262 6265->6264 6266 40a011 6267 40a036 6266->6267 6268 407918 InterlockedExchange 6267->6268 6269 40a060 6268->6269 6270 40a070 6269->6270 6271 409aa0 18 API calls 6269->6271 6276 4076ac SetEndOfFile 6270->6276 6271->6270 6273 40a08c 6274 4025ac 4 API calls 6273->6274 6275 40a0c3 6274->6275 6277 4076c3 6276->6277 6278 4076bc 6276->6278 6277->6273 6279 40748c 35 API calls 6278->6279 6279->6277 6704 409916 6705 409918 6704->6705 6706 40993a 6705->6706 6707 409956 CallWindowProcA 6705->6707 6707->6706 6161 407017 6162 407008 SetErrorMode 6161->6162 6284 403018 6285 403070 6284->6285 6286 403025 6284->6286 6287 40302a RtlUnwind 6286->6287 6288 40304e 6287->6288 6290 402f78 6288->6290 6291 402be8 6288->6291 6292 402bf1 RaiseException 6291->6292 6293 402c04 6291->6293 6292->6293 6293->6285 6714 409918 6715 40993a 6714->6715 6717 409927 6714->6717 6716 409956 CallWindowProcA 6716->6715 6717->6715 6717->6716 6298 40901e 6299 409010 6298->6299 6300 408fac Wow64RevertWow64FsRedirection 6299->6300 6301 409018 6300->6301 6302 409020 SetLastError 6303 409029 6302->6303 6318 403a28 ReadFile 6319 403a46 6318->6319 6320 403a49 GetLastError 6318->6320 6105 40762c ReadFile 6106 407663 6105->6106 6107 40764c 6105->6107 6108 407652 GetLastError 6107->6108 6109 40765c 6107->6109 6108->6106 6108->6109 6110 40748c 35 API calls 6109->6110 6110->6106 6325 40a02c 6326 409aa0 18 API calls 6325->6326 6327 40a031 6326->6327 6328 40a036 6327->6328 6329 402f24 5 API calls 6327->6329 6330 407918 InterlockedExchange 6328->6330 6329->6328 6331 40a060 6330->6331 6332 40a070 6331->6332 6333 409aa0 18 API calls 6331->6333 6334 4076ac 36 API calls 6332->6334 6333->6332 6335 40a08c 6334->6335 6336 4025ac 4 API calls 6335->6336 6337 40a0c3 6336->6337 6722 40712e 6723 407118 6722->6723 6724 403198 4 API calls 6723->6724 6725 407120 6724->6725 6726 403198 4 API calls 6725->6726 6727 407128 6726->6727 6728 408f30 6731 408dfc 6728->6731 6732 408e05 6731->6732 6733 403198 4 API calls 6732->6733 6734 408e13 6732->6734 6733->6732 6735 403932 6736 403924 6735->6736 6739 40374c 6736->6739 6738 40392c 6740 403766 6739->6740 6741 403759 6739->6741 6740->6738 6741->6740 6742 403779 VariantClear 6741->6742 6742->6738 6011 4075c4 SetFilePointer 6012 4075f7 6011->6012 6013 4075e7 GetLastError 6011->6013 6013->6012 6014 4075f0 6013->6014 6015 40748c 35 API calls 6014->6015 6015->6012 6338 4076c8 WriteFile 6339 4076e8 6338->6339 6342 4076ef 6338->6342 6340 40748c 35 API calls 6339->6340 6340->6342 6341 407700 6342->6341 6343 4073ec 34 API calls 6342->6343 6343->6341 6344 40a2ca 6353 4096fc 6344->6353 6347 402f24 5 API calls 6348 40a2d4 6347->6348 6349 403198 4 API calls 6348->6349 6350 40a2f3 6349->6350 6351 403198 4 API calls 6350->6351 6352 40a2fb 6351->6352 6362 4056ac 6353->6362 6355 409745 6358 403198 4 API calls 6355->6358 6356 409717 6356->6355 6368 40720c 6356->6368 6360 40975a 6358->6360 6359 409735 6361 40973d MessageBoxA 6359->6361 6360->6347 6361->6355 6363 403154 4 API calls 6362->6363 6364 4056b1 6363->6364 6365 4056c9 6364->6365 6366 403154 4 API calls 6364->6366 6365->6356 6367 4056bf 6366->6367 6367->6356 6369 4056ac 4 API calls 6368->6369 6370 40721b 6369->6370 6371 407221 6370->6371 6372 40722f 6370->6372 6373 40322c 4 API calls 6371->6373 6375 40724b 6372->6375 6376 40723f 6372->6376 6374 40722d 6373->6374 6374->6359 6386 4032b8 6375->6386 6379 4071d0 6376->6379 6380 40322c 4 API calls 6379->6380 6381 4071df 6380->6381 6382 4071fc 6381->6382 6383 406950 CharPrevA 6381->6383 6382->6374 6384 4071eb 6383->6384 6384->6382 6385 4032fc 18 API calls 6384->6385 6385->6382 6387 403278 18 API calls 6386->6387 6388 4032c2 6387->6388 6388->6374 6389 402ccc 6392 402cfe 6389->6392 6394 402cdd 6389->6394 6390 402d88 RtlUnwind 6391 403154 4 API calls 6390->6391 6391->6392 6393 402b28 RaiseException 6395 402d7f 6393->6395 6394->6390 6394->6392 6394->6393 6395->6390 6751 403fcd 6752 403f07 4 API calls 6751->6752 6753 403fd6 6752->6753 6754 403e9c 4 API calls 6753->6754 6755 403fe2 6754->6755 6396 4024d0 6397 4024e4 6396->6397 6398 4024e9 6396->6398 6401 401918 4 API calls 6397->6401 6399 402518 6398->6399 6400 40250e RtlEnterCriticalSection 6398->6400 6403 4024ed 6398->6403 6411 402300 6399->6411 6400->6399 6401->6398 6405 402525 6407 402581 6405->6407 6408 402577 RtlLeaveCriticalSection 6405->6408 6406 401fd4 14 API calls 6409 402531 6406->6409 6408->6407 6409->6405 6421 40215c 6409->6421 6412 402314 6411->6412 6414 4023b8 6412->6414 6415 402335 6412->6415 6413 402344 6413->6405 6413->6406 6414->6413 6419 402455 6414->6419 6438 401d80 6414->6438 6442 401e84 6414->6442 6415->6413 6435 401b74 6415->6435 6419->6413 6420 401d00 9 API calls 6419->6420 6420->6413 6422 40217a 6421->6422 6423 402175 6421->6423 6424 4021ab RtlEnterCriticalSection 6422->6424 6427 4021b5 6422->6427 6429 40217e 6422->6429 6425 401918 4 API calls 6423->6425 6424->6427 6425->6422 6426 4021c1 6430 4022e3 RtlLeaveCriticalSection 6426->6430 6431 4022ed 6426->6431 6427->6426 6428 402244 6427->6428 6433 402270 6427->6433 6428->6429 6432 401d80 7 API calls 6428->6432 6429->6405 6430->6431 6431->6405 6432->6429 6433->6426 6434 401d00 7 API calls 6433->6434 6434->6426 6436 40215c 9 API calls 6435->6436 6437 401b95 6436->6437 6437->6413 6439 401d92 6438->6439 6440 401d89 6438->6440 6439->6414 6440->6439 6441 401b74 9 API calls 6440->6441 6441->6439 6447 401768 6442->6447 6444 401e99 6445 401ea6 6444->6445 6458 401dcc 6444->6458 6445->6414 6448 401787 6447->6448 6449 40183b 6448->6449 6450 401494 LocalAlloc VirtualAlloc VirtualAlloc VirtualFree 6448->6450 6452 40132c LocalAlloc 6448->6452 6453 401821 6448->6453 6455 4017d6 6448->6455 6456 4017e7 6449->6456 6469 4015c4 6449->6469 6450->6448 6452->6448 6454 40150c VirtualFree 6453->6454 6454->6456 6465 40150c 6455->6465 6456->6444 6459 401d80 9 API calls 6458->6459 6460 401de0 6459->6460 6473 40132c 6460->6473 6462 401df0 6463 401df8 6462->6463 6477 401b44 6462->6477 6463->6445 6468 40153b 6465->6468 6466 401594 6466->6456 6467 401568 VirtualFree 6467->6468 6468->6466 6468->6467 6470 40160a 6469->6470 6471 401626 VirtualAlloc 6470->6471 6472 40163a 6470->6472 6471->6470 6471->6472 6472->6456 6474 401348 6473->6474 6482 4012e4 6474->6482 6478 401b61 6477->6478 6479 401b52 6477->6479 6478->6463 6480 401d00 9 API calls 6479->6480 6481 401b5f 6480->6481 6481->6463 6485 40128c 6482->6485 6484 4012ef 6484->6462 6486 401298 LocalAlloc 6485->6486 6487 4012aa 6485->6487 6486->6487 6487->6484 6487->6487 6488 4028d2 6489 4028da 6488->6489 6490 403554 4 API calls 6489->6490 6491 4028ef 6489->6491 6490->6489 6492 4025ac 4 API calls 6491->6492 6493 4028f4 6492->6493 6756 4019d3 6757 4019ba 6756->6757 6758 4019c3 RtlLeaveCriticalSection 6757->6758 6759 4019cd 6757->6759 6758->6759 6115 407fd4 6116 407fe6 6115->6116 6118 407fed 6115->6118 6126 407f10 6116->6126 6119 408021 6118->6119 6121 408015 6118->6121 6122 408017 6118->6122 6120 40804e 6119->6120 6123 407d7c 33 API calls 6119->6123 6140 407e2c 6121->6140 6137 407d7c 6122->6137 6123->6120 6127 407f25 6126->6127 6128 407f34 6127->6128 6129 407d7c 33 API calls 6127->6129 6130 407f6e 6128->6130 6131 407d7c 33 API calls 6128->6131 6129->6128 6132 407f82 6130->6132 6133 407d7c 33 API calls 6130->6133 6131->6130 6136 407fae 6132->6136 6147 407eb8 6132->6147 6133->6132 6136->6118 6150 4058c4 6137->6150 6139 407d9e 6139->6119 6141 405194 33 API calls 6140->6141 6142 407e57 6141->6142 6158 407de4 6142->6158 6144 407e5f 6145 403198 4 API calls 6144->6145 6146 407e74 6145->6146 6146->6119 6148 407ec7 VirtualFree 6147->6148 6149 407ed9 VirtualAlloc 6147->6149 6148->6149 6149->6136 6151 4058d0 6150->6151 6152 405194 33 API calls 6151->6152 6153 4058fd 6152->6153 6154 4031e8 18 API calls 6153->6154 6155 405908 6154->6155 6156 403198 4 API calls 6155->6156 6157 40591d 6156->6157 6157->6139 6159 4058c4 33 API calls 6158->6159 6160 407e06 6159->6160 6160->6144 6498 405ad4 6499 405adc 6498->6499 6501 405ae4 6498->6501 6500 405aeb 6499->6500 6502 405ae2 6499->6502 6503 405940 19 API calls 6500->6503 6505 405a4c 6502->6505 6503->6501 6506 405a54 6505->6506 6507 405a6e 6506->6507 6508 403154 4 API calls 6506->6508 6509 405a73 6507->6509 6510 405a8a 6507->6510 6508->6506 6511 405940 19 API calls 6509->6511 6512 403154 4 API calls 6510->6512 6513 405a86 6511->6513 6514 405a8f 6512->6514 6516 403154 4 API calls 6513->6516 6515 4059b0 33 API calls 6514->6515 6515->6513 6517 405ab8 6516->6517 6518 403154 4 API calls 6517->6518 6519 405ac6 6518->6519 6519->6501 6520 40a0d5 6521 40a105 6520->6521 6522 40a10f CreateWindowExA SetWindowLongA 6521->6522 6523 405194 33 API calls 6522->6523 6524 40a192 6523->6524 6525 4032fc 18 API calls 6524->6525 6526 40a1a0 6525->6526 6527 4032fc 18 API calls 6526->6527 6528 40a1ad 6527->6528 6529 406b7c 19 API calls 6528->6529 6530 40a1b9 6529->6530 6531 4032fc 18 API calls 6530->6531 6532 40a1c2 6531->6532 6533 4099a4 43 API calls 6532->6533 6534 40a1d4 6533->6534 6535 409884 19 API calls 6534->6535 6536 40a1e7 6534->6536 6535->6536 6537 40a220 6536->6537 6538 4094d8 9 API calls 6536->6538 6539 40a239 6537->6539 6542 40a233 RemoveDirectoryA 6537->6542 6538->6537 6540 40a242 DestroyWindow 6539->6540 6541 40a24d 6539->6541 6540->6541 6543 40a275 6541->6543 6544 40357c 4 API calls 6541->6544 6542->6539 6545 40a26b 6544->6545 6546 4025ac 4 API calls 6545->6546 6546->6543 6016 40a0e7 6017 40a0eb SetLastError 6016->6017 6047 409648 GetLastError 6017->6047 6020 40a105 6022 40a10f CreateWindowExA SetWindowLongA 6020->6022 6021 402f24 5 API calls 6021->6020 6023 405194 33 API calls 6022->6023 6024 40a192 6023->6024 6025 4032fc 18 API calls 6024->6025 6026 40a1a0 6025->6026 6027 4032fc 18 API calls 6026->6027 6028 40a1ad 6027->6028 6060 406b7c GetCommandLineA 6028->6060 6031 4032fc 18 API calls 6032 40a1c2 6031->6032 6065 4099a4 6032->6065 6035 409884 19 API calls 6036 40a1e7 6035->6036 6037 40a220 6036->6037 6038 4094d8 9 API calls 6036->6038 6039 40a239 6037->6039 6042 40a233 RemoveDirectoryA 6037->6042 6038->6037 6040 40a242 DestroyWindow 6039->6040 6041 40a24d 6039->6041 6040->6041 6043 40a275 6041->6043 6044 40357c 4 API calls 6041->6044 6042->6039 6045 40a26b 6044->6045 6046 4025ac 4 API calls 6045->6046 6046->6043 6048 404c94 33 API calls 6047->6048 6049 40968f 6048->6049 6050 407284 19 API calls 6049->6050 6051 40969f 6050->6051 6052 408da8 18 API calls 6051->6052 6053 4096b4 6052->6053 6054 405890 18 API calls 6053->6054 6055 4096c3 6054->6055 6056 4031b8 4 API calls 6055->6056 6057 4096e2 6056->6057 6058 403198 4 API calls 6057->6058 6059 4096ea 6058->6059 6059->6020 6059->6021 6061 406af0 18 API calls 6060->6061 6062 406ba1 6061->6062 6063 403198 4 API calls 6062->6063 6064 406bbf 6063->6064 6064->6031 6066 4033b4 18 API calls 6065->6066 6067 4099df 6066->6067 6068 409a11 CreateProcessA 6067->6068 6069 409a24 CloseHandle 6068->6069 6070 409a1d 6068->6070 6072 409a2d 6069->6072 6071 409648 35 API calls 6070->6071 6071->6069 6081 409978 6072->6081 6075 409a49 6076 409978 3 API calls 6075->6076 6077 409a4e GetExitCodeProcess CloseHandle 6076->6077 6078 409a6e 6077->6078 6079 403198 4 API calls 6078->6079 6080 409a76 6079->6080 6080->6035 6080->6036 6082 40998c PeekMessageA 6081->6082 6083 409980 TranslateMessage DispatchMessageA 6082->6083 6084 40999e MsgWaitForMultipleObjects 6082->6084 6083->6082 6084->6072 6084->6075 6763 402be9 RaiseException 6764 402c04 6763->6764 6553 402af2 6554 402afe 6553->6554 6557 402ed0 6554->6557 6558 403154 4 API calls 6557->6558 6560 402ee0 6558->6560 6559 402b03 6560->6559 6562 402b0c 6560->6562 6563 402b25 6562->6563 6564 402b15 RaiseException 6562->6564 6563->6559 6564->6563 6765 402dfa 6766 402e26 6765->6766 6767 402e0d 6765->6767 6769 402ba4 6767->6769 6770 402bc9 6769->6770 6771 402bad 6769->6771 6770->6766 6772 402bb5 RaiseException 6771->6772 6772->6770 6773 4075fa GetFileSize 6774 407626 6773->6774 6775 407616 GetLastError 6773->6775 6775->6774 6776 40761f 6775->6776 6777 40748c 35 API calls 6776->6777 6777->6774 6778 406ffb 6779 407008 SetErrorMode 6778->6779 6569 403a80 CloseHandle 6570 403a90 6569->6570 6571 403a91 GetLastError 6569->6571 5882 40a282 5884 40a1f4 5882->5884 5883 40a220 5886 40a239 5883->5886 5889 40a233 RemoveDirectoryA 5883->5889 5884->5883 5894 4094d8 5884->5894 5887 40a242 DestroyWindow 5886->5887 5888 40a24d 5886->5888 5887->5888 5890 40a275 5888->5890 5902 40357c 5888->5902 5889->5886 5892 40a26b 5893 4025ac 4 API calls 5892->5893 5893->5890 5895 409532 5894->5895 5897 4094eb 5894->5897 5895->5883 5896 4094f3 Sleep 5896->5897 5897->5895 5897->5896 5898 409503 Sleep 5897->5898 5900 40951a GetLastError 5897->5900 5915 408fbc 5897->5915 5898->5897 5900->5895 5901 409524 GetLastError 5900->5901 5901->5895 5901->5897 5903 403591 5902->5903 5904 4035a0 5902->5904 5909 4035d0 5903->5909 5910 40359b 5903->5910 5912 4035b6 5903->5912 5905 4035b1 5904->5905 5906 4035b8 5904->5906 5907 403198 4 API calls 5905->5907 5908 4031b8 4 API calls 5906->5908 5907->5912 5908->5912 5909->5912 5913 40357c 4 API calls 5909->5913 5910->5904 5911 4035ec 5910->5911 5911->5912 5923 403554 5911->5923 5912->5892 5913->5909 5916 408f70 2 API calls 5915->5916 5917 408fd2 5916->5917 5918 408fd6 5917->5918 5919 408ff2 DeleteFileA GetLastError 5917->5919 5918->5897 5920 409010 5919->5920 5921 408fac Wow64RevertWow64FsRedirection 5920->5921 5922 409018 5921->5922 5922->5897 5925 403566 5923->5925 5926 403578 5925->5926 5927 403604 5925->5927 5926->5911 5928 40357c 5927->5928 5929 4035a0 5928->5929 5934 40359b 5928->5934 5935 4035b6 5928->5935 5937 4035d0 5928->5937 5930 4035b1 5929->5930 5931 4035b8 5929->5931 5932 403198 4 API calls 5930->5932 5933 4031b8 4 API calls 5931->5933 5932->5935 5933->5935 5934->5929 5939 4035ec 5934->5939 5935->5925 5936 40357c 4 API calls 5936->5937 5937->5935 5937->5936 5938 403554 4 API calls 5938->5939 5939->5935 5939->5938 6572 404283 6573 4042c3 6572->6573 6574 403154 4 API calls 6573->6574 6575 404323 6574->6575 6780 404185 6781 4041ff 6780->6781 6782 4041cc 6781->6782 6783 403154 4 API calls 6781->6783 6784 404323 6783->6784 6576 40a287 6577 40a290 6576->6577 6579 40a2bb 6576->6579 6586 409448 6577->6586 6581 403198 4 API calls 6579->6581 6580 40a295 6580->6579 6583 40a2b3 MessageBoxA 6580->6583 6582 40a2f3 6581->6582 6584 403198 4 API calls 6582->6584 6583->6579 6585 40a2fb 6584->6585 6587 409454 GetCurrentProcess OpenProcessToken 6586->6587 6588 4094af ExitWindowsEx 6586->6588 6589 409466 6587->6589 6590 40946a LookupPrivilegeValueA AdjustTokenPrivileges GetLastError 6587->6590 6588->6589 6589->6580 6590->6588 6590->6589 6591 403e87 6592 403e4c 6591->6592 6593 403e67 6592->6593 6594 403e62 6592->6594 6595 403e7b 6592->6595 6598 403e78 6593->6598 6599 402674 4 API calls 6593->6599 6596 403cc8 4 API calls 6594->6596 6597 402674 4 API calls 6595->6597 6596->6593 6597->6598 6599->6598 6608 407e90 6609 407eb8 VirtualFree 6608->6609 6610 407e9d 6609->6610 6789 403991 6790 403983 6789->6790 6791 40374c VariantClear 6790->6791 6792 40398b 6791->6792 6622 403a97 6623 403aac 6622->6623 6624 403bbc GetStdHandle 6623->6624 6625 403b0e CreateFileA 6623->6625 6635 403ab2 6623->6635 6626 403c17 GetLastError 6624->6626 6630 403bba 6624->6630 6625->6626 6627 403b2c 6625->6627 6626->6635 6629 403b3b GetFileSize 6627->6629 6627->6630 6629->6626 6631 403b4e SetFilePointer 6629->6631 6632 403be7 GetFileType 6630->6632 6630->6635 6631->6626 6636 403b6a ReadFile 6631->6636 6634 403c02 CloseHandle 6632->6634 6632->6635 6634->6635 6636->6626 6637 403b8c 6636->6637 6637->6630 6638 403b9f SetFilePointer 6637->6638 6638->6626 6639 403bb0 SetEndOfFile 6638->6639 6639->6626 6639->6630 6797 405ba2 6799 405ba4 6797->6799 6798 405be0 6802 405940 19 API calls 6798->6802 6799->6798 6800 405bf7 6799->6800 6801 405bda 6799->6801 6806 404cdc 19 API calls 6800->6806 6801->6798 6803 405c4c 6801->6803 6804 405bf3 6802->6804 6805 4059b0 33 API calls 6803->6805 6808 403198 4 API calls 6804->6808 6805->6804 6807 405c20 6806->6807 6809 4059b0 33 API calls 6807->6809 6810 405c86 6808->6810 6809->6804 6811 408da4 6812 408dc8 6811->6812 6813 408c80 18 API calls 6812->6813 6814 408dd1 6813->6814 6640 402caa 6641 403154 4 API calls 6640->6641 6642 402caf 6641->6642 6829 4011aa 6830 4011ac GetStdHandle 6829->6830 6111 4076ac SetEndOfFile 6112 4076c3 6111->6112 6113 4076bc 6111->6113 6114 40748c 35 API calls 6113->6114 6114->6112 6643 4028ac 6644 402594 18 API calls 6643->6644 6645 4028b6 6644->6645 6646 401ab9 6647 401a96 6646->6647 6648 401aa9 RtlDeleteCriticalSection 6647->6648 6649 401a9f RtlLeaveCriticalSection 6647->6649 6649->6648

                                                                                                                                                                                                      Executed Functions

                                                                                                                                                                                                      Function 00409B30 Relevance: 7.6, APIs: 5, Instructions: 78memoryCOMMON
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                      control_flow_graph 135 409b30-409b54 GetSystemInfo VirtualQuery 136 409be4-409beb 135->136 137 409b5a 135->137 138 409bd9-409bde 137->138 138->136 139 409b5c-409b63 138->139 140 409bc5-409bd7 VirtualQuery 139->140 141 409b65-409b69 139->141 140->136 140->138 141->140 142 409b6b-409b73 141->142 143 409b84-409b95 VirtualProtect 142->143 144 409b75-409b78 142->144 146 409b97 143->146 147 409b99-409b9b 143->147 144->143 145 409b7a-409b7d 144->145 145->143 148 409b7f-409b82 145->148 146->147 149 409baa-409bad 147->149 148->143 148->147 150 409b9d-409ba6 call 409b28 149->150 151 409baf-409bb1 149->151 150->149 151->140 153 409bb3-409bc0 VirtualProtect 151->153 153->140
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetSystemInfo.KERNEL32(?), ref: 00409B42
                                                                                                                                                                                                      • VirtualQuery.KERNEL32(00400000,?,0000001C,?), ref: 00409B4D
                                                                                                                                                                                                      • VirtualProtect.KERNEL32(?,?,00000040,?,00400000,?,0000001C,?), ref: 00409B8E
                                                                                                                                                                                                      • VirtualProtect.KERNEL32(?,?,?,?,?,?,00000040,?,00400000,?,0000001C,?), ref: 00409BC0
                                                                                                                                                                                                      • VirtualQuery.KERNEL32(?,?,0000001C,00400000,?,0000001C,?), ref: 00409BD0
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.2688578704.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688548958.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688605236.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688635991.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Virtual$ProtectQuery$InfoSystem
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 2441996862-0
                                                                                                                                                                                                      • Opcode ID: 9fe1c1492d4e2c4f54cecc4c125b8c20c153f3aea56d010d52fe367946264e59
                                                                                                                                                                                                      • Instruction ID: 3002c4020e31fcb34e6ffc2d5983d7aa910ebdc8277ab133fd4bc27d875cdae8
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 9fe1c1492d4e2c4f54cecc4c125b8c20c153f3aea56d010d52fe367946264e59
                                                                                                                                                                                                      • Instruction Fuzzy Hash: F4219DB12003046BD7709AA99C85E5777E9EB85370F04082BFA89E32D3D239FC40C669
                                                                                                                                                                                                      Function 0040520C Relevance: 1.5, APIs: 1, Instructions: 29COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0040C4BC,00000001,?,004052D7,?,00000000,004053B6), ref: 0040522A
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.2688578704.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688548958.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688605236.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688635991.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: InfoLocale
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 2299586839-0
                                                                                                                                                                                                      • Opcode ID: 08facca5f8c818d7ae0117448837c5e97f15c9e55cb3aedc2694e0bc5091a832
                                                                                                                                                                                                      • Instruction ID: 1248db9972fbf410c55bf070b604c98f5d62b90992f8f49b6b6440a9954d2c50
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 08facca5f8c818d7ae0117448837c5e97f15c9e55cb3aedc2694e0bc5091a832
                                                                                                                                                                                                      • Instruction Fuzzy Hash: E2E0927170021427D710A9A99C86AEB725CEB58310F0002BFB904E73C6EDB49E804AED
                                                                                                                                                                                                      Function 0040A0E7 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 111COMMON
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • SetLastError.KERNEL32 ref: 0040A0F4
                                                                                                                                                                                                        • Part of subcall function 00409648: GetLastError.KERNEL32(00000000,004096EB,?,0040B240,?,020704F0), ref: 0040966C
                                                                                                                                                                                                      • CreateWindowExA.USER32(00000000,STATIC,InnoSetupLdrWindow,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00400000,00000000), ref: 0040A131
                                                                                                                                                                                                      • SetWindowLongA.USER32(0002040C,000000FC,00409918), ref: 0040A148
                                                                                                                                                                                                      • RemoveDirectoryA.KERNEL32(00000000,0040A287,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040A234
                                                                                                                                                                                                      • DestroyWindow.USER32(0002040C,0040A287,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040A248
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.2688578704.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688548958.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688605236.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688635991.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Window$ErrorLast$CreateDestroyDirectoryLongRemove
                                                                                                                                                                                                      • String ID: /SL5="$%x,%d,%d,$InnoSetupLdrWindow$STATIC$xXA
                                                                                                                                                                                                      • API String ID: 3757039580-4017149741
                                                                                                                                                                                                      • Opcode ID: 92d7a146f7fa7ea583be229cf1972f4387f7e731d45899e9009fd1a518b8a977
                                                                                                                                                                                                      • Instruction ID: f6a9afe5b3848034850d92184c83b7d566fc641e007638e18ad9d31f508a71de
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 92d7a146f7fa7ea583be229cf1972f4387f7e731d45899e9009fd1a518b8a977
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 3B411071600204DFD710EBA9EE86B9977A4EB45304F10467EF514B73E2C7B89811CB9D
                                                                                                                                                                                                      Function 0040457C Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 27libraryloaderCOMMON
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                      control_flow_graph 41 40457c-404596 GetModuleHandleA GetProcAddress 42 404598 41->42 43 40459f-4045ac GetProcAddress 41->43 42->43 44 4045b5-4045c2 GetProcAddress 43->44 45 4045ae 43->45 46 4045c4-4045c6 SetProcessDEPPolicy 44->46 47 4045c8-4045c9 44->47 45->44 46->47
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetModuleHandleA.KERNEL32(kernel32.dll,?,00409C60), ref: 00404582
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 0040458F
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,SetSearchPathMode), ref: 004045A5
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,SetProcessDEPPolicy), ref: 004045BB
                                                                                                                                                                                                      • SetProcessDEPPolicy.KERNEL32(00000001,00000000,SetProcessDEPPolicy,00000000,SetSearchPathMode,kernel32.dll,?,00409C60), ref: 004045C6
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.2688578704.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688548958.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688605236.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688635991.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: AddressProc$HandleModulePolicyProcess
                                                                                                                                                                                                      • String ID: SetDllDirectoryW$SetProcessDEPPolicy$SetSearchPathMode$kernel32.dll
                                                                                                                                                                                                      • API String ID: 3256987805-3653653586
                                                                                                                                                                                                      • Opcode ID: 5152b1c660b0fef0348360efae9d442e0d6811f491f57bfacbbc157bf84edc67
                                                                                                                                                                                                      • Instruction ID: 1f393095ee8ecda9e1e01b6ca7d440447e938bbc9796bcd5dbe8d266940e5f64
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 5152b1c660b0fef0348360efae9d442e0d6811f491f57bfacbbc157bf84edc67
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 5FE02DD03813013AEA5032F20D83B2B20884AD0B49B2414377F25B61C3EDBDDA40587E
                                                                                                                                                                                                      Function 0040A0D5 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 105COMMON
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • CreateWindowExA.USER32(00000000,STATIC,InnoSetupLdrWindow,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00400000,00000000), ref: 0040A131
                                                                                                                                                                                                      • SetWindowLongA.USER32(0002040C,000000FC,00409918), ref: 0040A148
                                                                                                                                                                                                        • Part of subcall function 00406B7C: GetCommandLineA.KERNEL32(00000000,00406BC0,?,?,?,?,00000000,?,0040A1B9,?), ref: 00406B94
                                                                                                                                                                                                        • Part of subcall function 004099A4: CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409A9C,020704F0,00409A90,00000000,00409A77), ref: 00409A14
                                                                                                                                                                                                        • Part of subcall function 004099A4: CloseHandle.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409A9C,020704F0,00409A90,00000000), ref: 00409A28
                                                                                                                                                                                                        • Part of subcall function 004099A4: MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000FF), ref: 00409A41
                                                                                                                                                                                                        • Part of subcall function 004099A4: GetExitCodeProcess.KERNEL32(?,0040B240), ref: 00409A53
                                                                                                                                                                                                        • Part of subcall function 004099A4: CloseHandle.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409A9C,020704F0,00409A90), ref: 00409A5C
                                                                                                                                                                                                      • RemoveDirectoryA.KERNEL32(00000000,0040A287,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040A234
                                                                                                                                                                                                      • DestroyWindow.USER32(0002040C,0040A287,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040A248
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.2688578704.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688548958.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688605236.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688635991.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Window$CloseCreateHandleProcess$CodeCommandDestroyDirectoryExitLineLongMultipleObjectsRemoveWait
                                                                                                                                                                                                      • String ID: /SL5="$%x,%d,%d,$InnoSetupLdrWindow$STATIC$xXA
                                                                                                                                                                                                      • API String ID: 3586484885-4017149741
                                                                                                                                                                                                      • Opcode ID: a64027cc69530ce26e0d020b421cb23cd984c73ff13cd53596b8d38fe4c4ed4c
                                                                                                                                                                                                      • Instruction ID: bf8877be64b1eb53a955be5febe4cb156f3d413c702a3b20994545be7baf65d7
                                                                                                                                                                                                      • Opcode Fuzzy Hash: a64027cc69530ce26e0d020b421cb23cd984c73ff13cd53596b8d38fe4c4ed4c
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 75411A71604204DFD714EBA9EE86B5A77A4EB49304F10427EE514B73E1CBB8A810CB9D
                                                                                                                                                                                                      Function 004090A4 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 46libraryloaderCOMMON
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetModuleHandleA.KERNEL32(kernel32.dll,Wow64DisableWow64FsRedirection,00000000,0040913D,?,?,?,?,00000000,?,00409C74), ref: 004090C4
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 004090CA
                                                                                                                                                                                                      • GetModuleHandleA.KERNEL32(kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000,0040913D,?,?,?,?,00000000,?,00409C74), ref: 004090DE
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 004090E4
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.2688578704.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688548958.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688605236.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688635991.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: AddressHandleModuleProc
                                                                                                                                                                                                      • String ID: Wow64DisableWow64FsRedirection$Wow64RevertWow64FsRedirection$kernel32.dll$shell32.dll
                                                                                                                                                                                                      • API String ID: 1646373207-2130885113
                                                                                                                                                                                                      • Opcode ID: acfb4439f313785c2c2b120c37d6defef782ad7ac64c67e7eba3e924cf2abd75
                                                                                                                                                                                                      • Instruction ID: 4a4222b704d734fa8d0781b40c04fe9f9c76e7b4f133337d95099c0c8a01123f
                                                                                                                                                                                                      • Opcode Fuzzy Hash: acfb4439f313785c2c2b120c37d6defef782ad7ac64c67e7eba3e924cf2abd75
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 20017170748342AEFB00BB72DD4AB163A68E785704F50457BF5407A2D3DABD4C04DA6D
                                                                                                                                                                                                      Function 004099A4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 77processCOMMON
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409A9C,020704F0,00409A90,00000000,00409A77), ref: 00409A14
                                                                                                                                                                                                      • CloseHandle.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409A9C,020704F0,00409A90,00000000), ref: 00409A28
                                                                                                                                                                                                      • MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000FF), ref: 00409A41
                                                                                                                                                                                                      • GetExitCodeProcess.KERNEL32(?,0040B240), ref: 00409A53
                                                                                                                                                                                                      • CloseHandle.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409A9C,020704F0,00409A90), ref: 00409A5C
                                                                                                                                                                                                        • Part of subcall function 00409648: GetLastError.KERNEL32(00000000,004096EB,?,0040B240,?,020704F0), ref: 0040966C
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.2688578704.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688548958.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688605236.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688635991.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CloseHandleProcess$CodeCreateErrorExitLastMultipleObjectsWait
                                                                                                                                                                                                      • String ID: D
                                                                                                                                                                                                      • API String ID: 3356880605-2746444292
                                                                                                                                                                                                      • Opcode ID: 752074f715f169f8c9b0a2dfdb1d62babdf7ca20371da5ab86507c15e851728d
                                                                                                                                                                                                      • Instruction ID: 6ea97129cf5aa135a7f7046e3a99eae43c862e8aca722617c6144c18eae127a8
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 752074f715f169f8c9b0a2dfdb1d62babdf7ca20371da5ab86507c15e851728d
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 3A1142B17442486EDB10EBE68C42FAEB7ACEF49714F50017BB604F72C2DA785D048A69
                                                                                                                                                                                                      Function 004019DC Relevance: 9.1, APIs: 6, Instructions: 59COMMON
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                      control_flow_graph 116 4019dc-4019e7 117 401abb-401abd 116->117 118 4019ed-401a02 116->118 119 401a04-401a09 RtlEnterCriticalSection 118->119 120 401a0e-401a2d LocalFree 118->120 119->120 121 401a41-401a47 120->121 122 401a49-401a6e call 4012dc * 3 121->122 123 401a2f-401a3f VirtualFree 121->123 130 401a70-401a85 LocalFree 122->130 131 401a87-401a9d 122->131 123->121 130->130 130->131 133 401aa9-401ab3 RtlDeleteCriticalSection 131->133 134 401a9f-401aa4 RtlLeaveCriticalSection 131->134 134->133
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • RtlEnterCriticalSection.KERNEL32(0040C41C,00000000,00401AB4), ref: 00401A09
                                                                                                                                                                                                      • LocalFree.KERNEL32(00000000,00000000,00401AB4), ref: 00401A1B
                                                                                                                                                                                                      • VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,00000000,00401AB4), ref: 00401A3A
                                                                                                                                                                                                      • LocalFree.KERNEL32(00000000,00000000,00000000,00008000,00000000,00000000,00401AB4), ref: 00401A79
                                                                                                                                                                                                      • RtlLeaveCriticalSection.KERNEL32(0040C41C,00401ABB), ref: 00401AA4
                                                                                                                                                                                                      • RtlDeleteCriticalSection.KERNEL32(0040C41C,00401ABB), ref: 00401AAE
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.2688578704.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688548958.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688605236.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688635991.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CriticalFreeSection$Local$DeleteEnterLeaveVirtual
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 3782394904-0
                                                                                                                                                                                                      • Opcode ID: 2760f6fc436d2282df077fa3fe2c561b0ff429e9c23b98cc44d100e589fe962f
                                                                                                                                                                                                      • Instruction ID: 5447b05044442752c1d56c7733342563ab4b4f61826a3093f511f794066d9233
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 2760f6fc436d2282df077fa3fe2c561b0ff429e9c23b98cc44d100e589fe962f
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 91116330341280DAD711ABA59EE2F623668B785748F44437EF444B62F2C67C9840CA9D
                                                                                                                                                                                                      Function 00409E47 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 117windowCOMMON
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • MessageBoxA.USER32(00000000,00000000,00000000,00000024), ref: 00409EAB
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.2688578704.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688548958.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688605236.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688635991.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Message
                                                                                                                                                                                                      • String ID: .tmp$xXA$y@
                                                                                                                                                                                                      • API String ID: 2030045667-3131805391
                                                                                                                                                                                                      • Opcode ID: 025cb7c8070ceb0a973f57dc2423f3e96cefce6b80174f3a3145c26c436c6efd
                                                                                                                                                                                                      • Instruction ID: 436c98ae07f88f71ec52beeb6e72a39fdb1c754e3b127fd60db974180cd34f4e
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 025cb7c8070ceb0a973f57dc2423f3e96cefce6b80174f3a3145c26c436c6efd
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 7541AC30600200DFC715EF25DE96A5A77A5EB49304B50463AF804B73E2CBB9AC05CBAD
                                                                                                                                                                                                      Function 00409E62 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 113windowCOMMON
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • MessageBoxA.USER32(00000000,00000000,00000000,00000024), ref: 00409EAB
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.2688578704.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688548958.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688605236.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688635991.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Message
                                                                                                                                                                                                      • String ID: .tmp$xXA$y@
                                                                                                                                                                                                      • API String ID: 2030045667-3131805391
                                                                                                                                                                                                      • Opcode ID: cf567291c84692d100e5ec609b282d55b3c5af0b5f3d357f2e8f357a6d06844b
                                                                                                                                                                                                      • Instruction ID: effdcd9541676c6323f3fad609c54d18bb0bf767b5f2530b550772909ae59cb2
                                                                                                                                                                                                      • Opcode Fuzzy Hash: cf567291c84692d100e5ec609b282d55b3c5af0b5f3d357f2e8f357a6d06844b
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 1F418D70610204DFC715EF25DED6A5A77A5EB49308B50463AF804B73E2CBB9AC05CBAD
                                                                                                                                                                                                      Function 00403D02 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 72windowCOMMON
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                      control_flow_graph 250 403d02-403d10 251 403d12-403d19 250->251 252 403d29-403d30 250->252 255 403ddf-403de5 ExitProcess 251->255 256 403d1f 251->256 253 403d32-403d3c 252->253 254 403d3e-403d45 252->254 253->252 257 403d47-403d51 254->257 258 403db8-403dcc call 403cc8 * 2 call 4019dc 254->258 256->252 259 403d21-403d23 256->259 263 403d56-403d62 257->263 275 403dd1-403dd8 258->275 259->252 261 403dea-403e19 call 4030b4 259->261 263->263 265 403d64-403d6e 263->265 268 403d73-403d84 265->268 268->268 271 403d86-403d8d 268->271 273 403da4-403db3 call 403fe4 call 403f67 271->273 274 403d8f-403da2 MessageBoxA 271->274 273->258 274->258 275->261 277 403dda call 4030b4 275->277 277->255
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • MessageBoxA.USER32(00000000,Runtime error at 00000000,Error,00000000), ref: 00403D9D
                                                                                                                                                                                                      • ExitProcess.KERNEL32 ref: 00403DE5
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.2688578704.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688548958.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688605236.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688635991.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: ExitMessageProcess
                                                                                                                                                                                                      • String ID: Error$Runtime error at 00000000
                                                                                                                                                                                                      • API String ID: 1220098344-2970929446
                                                                                                                                                                                                      • Opcode ID: 0b7abc0913d0e9b6482778e2bb40dc1e8adb9ed549d30d0444a38b969016e341
                                                                                                                                                                                                      • Instruction ID: db3008c0e6bc5d60e05df0545d3e9f81ce91e923819fa2a9fb93000da4b6b716
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 0b7abc0913d0e9b6482778e2bb40dc1e8adb9ed549d30d0444a38b969016e341
                                                                                                                                                                                                      • Instruction Fuzzy Hash: B521F830A04341CAE714EFA59AD17153E98AB49349F04837BD500B73E3C77C8A45C76E
                                                                                                                                                                                                      Function 00401918 Relevance: 6.0, APIs: 4, Instructions: 48memoryCOMMON
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                      control_flow_graph 281 401918-40193a RtlInitializeCriticalSection 282 401946-40197c call 4012dc * 3 LocalAlloc 281->282 283 40193c-401941 RtlEnterCriticalSection 281->283 290 4019ad-4019c1 282->290 291 40197e 282->291 283->282 295 4019c3-4019c8 RtlLeaveCriticalSection 290->295 296 4019cd 290->296 292 401983-401995 291->292 292->292 294 401997-4019a6 292->294 294->290 295->296
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • RtlInitializeCriticalSection.KERNEL32(0040C41C,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 0040192E
                                                                                                                                                                                                      • RtlEnterCriticalSection.KERNEL32(0040C41C,0040C41C,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 00401941
                                                                                                                                                                                                      • LocalAlloc.KERNEL32(00000000,00000FF8,0040C41C,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 0040196B
                                                                                                                                                                                                      • RtlLeaveCriticalSection.KERNEL32(0040C41C,004019D5,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 004019C8
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.2688578704.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688548958.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688605236.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688635991.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CriticalSection$AllocEnterInitializeLeaveLocal
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 730355536-0
                                                                                                                                                                                                      • Opcode ID: 38709c719971e1168baf9cdc3c67f999ad3db3ab521e9349fb3b390a12b3c6f3
                                                                                                                                                                                                      • Instruction ID: 093a8b970c40f4dda7bd37408b901a2e20e4e29fb74a5496b56404d4d89a3717
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 38709c719971e1168baf9cdc3c67f999ad3db3ab521e9349fb3b390a12b3c6f3
                                                                                                                                                                                                      • Instruction Fuzzy Hash: CC0161B0684240DEE715ABA999E6B353AA4E786744F10427FF080F62F2C67C4450CB9D
                                                                                                                                                                                                      Function 00409330 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 83COMMON
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • CreateDirectoryA.KERNEL32(00000000,00000000,?,00000000,0040941F,?,?,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00409376
                                                                                                                                                                                                      • GetLastError.KERNEL32(00000000,00000000,?,00000000,0040941F,?,?,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0040937F
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.2688578704.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688548958.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688605236.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688635991.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CreateDirectoryErrorLast
                                                                                                                                                                                                      • String ID: .tmp
                                                                                                                                                                                                      • API String ID: 1375471231-2986845003
                                                                                                                                                                                                      • Opcode ID: 7ba2b511fbcbba0bdafc57409f78771f2ffb69bdc1885ec5b7c8c3418ce725e0
                                                                                                                                                                                                      • Instruction ID: 229665e4fb482f752e04f7b041ef1ce89d659938bfc828767b82506ffacbf3f4
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 7ba2b511fbcbba0bdafc57409f78771f2ffb69bdc1885ec5b7c8c3418ce725e0
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 7C213774A04208ABDB05EFA1C8429DFB7B9EF88304F50457BE901B73C2DA7C9E059A65
                                                                                                                                                                                                      Function 004094D8 Relevance: 5.0, APIs: 4, Instructions: 45sleepCOMMON
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                      control_flow_graph 387 4094d8-4094e9 388 409532-409537 387->388 389 4094eb-4094ec 387->389 390 4094ee-4094f1 389->390 391 4094f3-4094fc Sleep 390->391 392 4094fe-409501 390->392 393 40950c-409511 call 408fbc 391->393 392->393 394 409503-409507 Sleep 392->394 396 409516-409518 393->396 394->393 396->388 397 40951a-409522 GetLastError 396->397 397->388 398 409524-40952c GetLastError 397->398 398->388 399 40952e-409530 398->399 399->388 399->390
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • Sleep.KERNEL32(?,?,?,?,0000000D,?,0040A220,000000FA,00000032,0040A287), ref: 004094F7
                                                                                                                                                                                                      • Sleep.KERNEL32(?,?,?,?,0000000D,?,0040A220,000000FA,00000032,0040A287), ref: 00409507
                                                                                                                                                                                                      • GetLastError.KERNEL32(?,?,?,0000000D,?,0040A220,000000FA,00000032,0040A287), ref: 0040951A
                                                                                                                                                                                                      • GetLastError.KERNEL32(?,?,?,0000000D,?,0040A220,000000FA,00000032,0040A287), ref: 00409524
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.2688578704.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688548958.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688605236.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688635991.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: ErrorLastSleep
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 1458359878-0
                                                                                                                                                                                                      • Opcode ID: 597fcf42490b874720d4ad81cf19761f51130dad350fd41d24dc31ad960abd38
                                                                                                                                                                                                      • Instruction ID: cd4a420f7ace5638a97e0bdb8a1e9fccbb234b9240edd4770f97938e6011a3cc
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 597fcf42490b874720d4ad81cf19761f51130dad350fd41d24dc31ad960abd38
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 16F0967360451477CA35A5AF9D81A5F634DDAD1354B10813BE945F3283C538DD0142A9
                                                                                                                                                                                                      Function 00407749 Relevance: 3.3, APIs: 2, Instructions: 284fileCOMMON
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                      control_flow_graph 400 407749-40774a 401 4076dc-4076e6 WriteFile 400->401 402 40774c-40776f 400->402 404 4076e8-4076ea call 40748c 401->404 405 4076ef-4076f2 401->405 403 407770-407785 402->403 406 407787 403->406 407 4077f9 403->407 404->405 409 407700-407704 405->409 410 4076f4-4076fb call 4073ec 405->410 411 40778a-40778f 406->411 412 4077fd-407802 406->412 413 40783b-40783d 407->413 414 4077fb 407->414 410->409 418 407803-407819 411->418 420 407791-407792 411->420 412->418 416 407841-407843 413->416 414->412 419 40785b-40785c 416->419 418->419 429 40781b 418->429 421 4078d6-4078eb call 407890 InterlockedExchange 419->421 422 40785e-40788c 419->422 423 407724-407741 420->423 424 407794-4077b4 420->424 442 407912-407917 421->442 443 4078ed-407910 421->443 440 407820-407823 422->440 441 407890-407893 422->441 428 4077b5 423->428 430 407743 423->430 424->428 435 4077b6-4077b7 428->435 436 4077f7-4077f8 428->436 437 40781e-40781f 429->437 431 407746-407747 430->431 432 4077b9 430->432 431->400 438 4077bb-4077cd 431->438 432->438 435->432 436->407 437->440 438->416 444 4077cf-4077d4 438->444 445 407824 440->445 446 407898 440->446 441->446 443->442 443->443 444->413 451 4077d6-4077de 444->451 448 407825 445->448 449 40789a 445->449 446->449 452 407896-407897 448->452 453 407826-40782d 448->453 450 40789f 449->450 455 4078a1 450->455 451->403 462 4077e0 451->462 452->446 453->455 456 40782f 453->456 460 4078a3 455->460 461 4078ac 455->461 458 407832-407833 456->458 459 4078a5-4078aa 456->459 458->413 458->437 463 4078ae-4078af 459->463 460->459 461->463 462->436 463->450 464 4078b1-4078bd 463->464 464->446 465 4078bf-4078c0 464->465
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • WriteFile.KERNEL32(?,?,?,?,00000000), ref: 004076DF
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.2688578704.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688548958.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688605236.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688635991.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: FileWrite
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 3934441357-0
                                                                                                                                                                                                      • Opcode ID: 43d3196ec1ce5242573e8f450cfa6a0a1bc6604aabb0088ea34051851cbbaa4a
                                                                                                                                                                                                      • Instruction ID: 20d0a63744b7af467993d3e8aec565234b7be2d060ba20bf9fd199bb98bd5a4e
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 43d3196ec1ce5242573e8f450cfa6a0a1bc6604aabb0088ea34051851cbbaa4a
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 8251D12294D2910FC7126B7849685A53FE0FE5331132E92FBC5C1AB1A3D27CA847D35B
                                                                                                                                                                                                      Function 00401FD4 Relevance: 3.1, APIs: 2, Instructions: 122COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • RtlEnterCriticalSection.KERNEL32(0040C41C,00000000,00402148), ref: 00402017
                                                                                                                                                                                                        • Part of subcall function 00401918: RtlInitializeCriticalSection.KERNEL32(0040C41C,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 0040192E
                                                                                                                                                                                                        • Part of subcall function 00401918: RtlEnterCriticalSection.KERNEL32(0040C41C,0040C41C,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 00401941
                                                                                                                                                                                                        • Part of subcall function 00401918: LocalAlloc.KERNEL32(00000000,00000FF8,0040C41C,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 0040196B
                                                                                                                                                                                                        • Part of subcall function 00401918: RtlLeaveCriticalSection.KERNEL32(0040C41C,004019D5,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 004019C8
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.2688578704.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688548958.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688605236.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688635991.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CriticalSection$Enter$AllocInitializeLeaveLocal
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 296031713-0
                                                                                                                                                                                                      • Opcode ID: e41243de7c80276a36dcdd2c2c0e451bb1a6f3055e5ddec7aea90b49354f7273
                                                                                                                                                                                                      • Instruction ID: b272be6629c35a549fc4f1c5a19e6e0df2414f51bb24a7fd7fb800939d1160d0
                                                                                                                                                                                                      • Opcode Fuzzy Hash: e41243de7c80276a36dcdd2c2c0e451bb1a6f3055e5ddec7aea90b49354f7273
                                                                                                                                                                                                      • Instruction Fuzzy Hash: D4419CB2A40711DFDB108F69DEC562A77A0FB58314B25837AD984B73E1D378A842CB48
                                                                                                                                                                                                      Function 00408FBC Relevance: 3.0, APIs: 2, Instructions: 42fileCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • DeleteFileA.KERNEL32(00000000,00000000,00409019,?,0000000D,00000000), ref: 00408FF3
                                                                                                                                                                                                      • GetLastError.KERNEL32(00000000,00000000,00409019,?,0000000D,00000000), ref: 00408FFB
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.2688578704.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688548958.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688605236.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688635991.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: DeleteErrorFileLast
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 2018770650-0
                                                                                                                                                                                                      • Opcode ID: 51b14d3c2f7fde5c1a6bb776c84878c326085b2b0be15ffc15f9635c9f9f5f18
                                                                                                                                                                                                      • Instruction ID: 1f0403e6899a51d1d5356f81b6020870d4ad1054c4e625117792cee712869c3b
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 51b14d3c2f7fde5c1a6bb776c84878c326085b2b0be15ffc15f9635c9f9f5f18
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 16F0C871A04704ABCB01DF759D4159DB3E8DB8831475045BBF814F3682EA385E108599
                                                                                                                                                                                                      Function 0040A282 Relevance: 3.0, APIs: 2, Instructions: 33COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • RemoveDirectoryA.KERNEL32(00000000,0040A287,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040A234
                                                                                                                                                                                                      • DestroyWindow.USER32(0002040C,0040A287,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040A248
                                                                                                                                                                                                        • Part of subcall function 004094D8: Sleep.KERNEL32(?,?,?,?,0000000D,?,0040A220,000000FA,00000032,0040A287), ref: 004094F7
                                                                                                                                                                                                        • Part of subcall function 004094D8: GetLastError.KERNEL32(?,?,?,0000000D,?,0040A220,000000FA,00000032,0040A287), ref: 0040951A
                                                                                                                                                                                                        • Part of subcall function 004094D8: GetLastError.KERNEL32(?,?,?,0000000D,?,0040A220,000000FA,00000032,0040A287), ref: 00409524
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.2688578704.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688548958.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688605236.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688635991.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: ErrorLast$DestroyDirectoryRemoveSleepWindow
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 2192421792-0
                                                                                                                                                                                                      • Opcode ID: cfb4816e8e93690030a7db02d377f330bfa753c6875f065e2bcd958c08ae31af
                                                                                                                                                                                                      • Instruction ID: 660582e0dfefc282ab61bc82749075141bf2bb6394dcfcd8a4149d52366551bd
                                                                                                                                                                                                      • Opcode Fuzzy Hash: cfb4816e8e93690030a7db02d377f330bfa753c6875f065e2bcd958c08ae31af
                                                                                                                                                                                                      • Instruction Fuzzy Hash: EDF03C71601200DBD724EB69EEC9B1632A4A785349F14463FA504B63F1CBBC9CA1CBDE
                                                                                                                                                                                                      Function 00406FA0 Relevance: 3.0, APIs: 2, Instructions: 33libraryCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • SetErrorMode.KERNEL32(00008000), ref: 00406FAA
                                                                                                                                                                                                      • LoadLibraryA.KERNEL32(00000000,00000000,00406FF4,?,00000000,00407012,?,00008000), ref: 00406FD9
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.2688578704.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688548958.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688605236.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688635991.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: ErrorLibraryLoadMode
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 2987862817-0
                                                                                                                                                                                                      • Opcode ID: 9b48b29771c4fc6652b627c4d055133170331230f079557c80f3f4e2880abe46
                                                                                                                                                                                                      • Instruction ID: 292e1fc4e19851716b0ab93d2d43454b233f1d25ff8a05a0d03104374ea2dcbc
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 9b48b29771c4fc6652b627c4d055133170331230f079557c80f3f4e2880abe46
                                                                                                                                                                                                      • Instruction Fuzzy Hash: D6F08270A14704BEDB129FB68C5282ABBECEB4DB0475349BAF914A26D2E53C5C209568
                                                                                                                                                                                                      Function 0040766C Relevance: 3.0, APIs: 2, Instructions: 30COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • SetFilePointer.KERNEL32(?,?,?,00000000), ref: 0040768B
                                                                                                                                                                                                      • GetLastError.KERNEL32(?,?,?,00000000), ref: 00407693
                                                                                                                                                                                                        • Part of subcall function 0040748C: GetLastError.KERNEL32(0040738C,0040752A,?,?,020703AC,?,00409CCE,00000001,00000000,00000002,00000000,0040A2C5,?,00000000,0040A2FC), ref: 0040748F
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.2688578704.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688548958.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688605236.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688635991.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: ErrorLast$FilePointer
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 1156039329-0
                                                                                                                                                                                                      • Opcode ID: cf8b3d77442686d6cce32677ffa2556d95a4d660bd32a6059a32509021572d83
                                                                                                                                                                                                      • Instruction ID: 64daf3b7b2b4cd691f255a674f922558070816022eb0a012369b73df1192a31e
                                                                                                                                                                                                      • Opcode Fuzzy Hash: cf8b3d77442686d6cce32677ffa2556d95a4d660bd32a6059a32509021572d83
                                                                                                                                                                                                      • Instruction Fuzzy Hash: B2E092766081016FD600D55EC881B9B37DCDFC5364F104536B654EB2D1D679EC108776
                                                                                                                                                                                                      Function 0040762C Relevance: 3.0, APIs: 2, Instructions: 30fileCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • ReadFile.KERNEL32(?,?,?,?,00000000), ref: 00407643
                                                                                                                                                                                                      • GetLastError.KERNEL32(?,?,?,?,00000000), ref: 00407652
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.2688578704.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688548958.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688605236.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688635991.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: ErrorFileLastRead
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 1948546556-0
                                                                                                                                                                                                      • Opcode ID: 1b4aea639ae4b78e93b9ef79541d7064bf1f98a27d237b51b731e51654b8bdcb
                                                                                                                                                                                                      • Instruction ID: e2f452503b48da12a69c10a9d1416f2aa512a4714c212e67fea7d8588799396e
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 1b4aea639ae4b78e93b9ef79541d7064bf1f98a27d237b51b731e51654b8bdcb
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 69E012A1A081106ADB24A66E9CC5F6B6BDCCBC5724F14457BF504DB382D678DC0487BB
                                                                                                                                                                                                      Function 004075C4 Relevance: 3.0, APIs: 2, Instructions: 24COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • SetFilePointer.KERNEL32(?,00000000,?,00000001), ref: 004075DB
                                                                                                                                                                                                      • GetLastError.KERNEL32(?,00000000,?,00000001), ref: 004075E7
                                                                                                                                                                                                        • Part of subcall function 0040748C: GetLastError.KERNEL32(0040738C,0040752A,?,?,020703AC,?,00409CCE,00000001,00000000,00000002,00000000,0040A2C5,?,00000000,0040A2FC), ref: 0040748F
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.2688578704.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688548958.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688605236.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688635991.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: ErrorLast$FilePointer
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 1156039329-0
                                                                                                                                                                                                      • Opcode ID: 7730a1f6a5d1c383143cef2e1ec1cb69b5af0836910a757b2920ce96cbe13b7f
                                                                                                                                                                                                      • Instruction ID: 74cf86129294d2faf5969c20f66175129728110ffa3c668ef2bae8a95e28f18b
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 7730a1f6a5d1c383143cef2e1ec1cb69b5af0836910a757b2920ce96cbe13b7f
                                                                                                                                                                                                      • Instruction Fuzzy Hash: C4E04FB1600210AFDB10EEB98D81B9676D89F48364F0485B6EA14DF2C6D274DC00C766
                                                                                                                                                                                                      Function 00401430 Relevance: 2.5, APIs: 2, Instructions: 37memoryCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • VirtualAlloc.KERNEL32(00000000,?,00002000,00000001,?,?,?,00401739), ref: 0040145F
                                                                                                                                                                                                      • VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,?,00002000,00000001,?,?,?,00401739), ref: 00401486
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.2688578704.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688548958.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688605236.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688635991.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Virtual$AllocFree
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 2087232378-0
                                                                                                                                                                                                      • Opcode ID: efc6f27fa4c1f0416fcf42a0cb9c981ca4ea103f0f96f52908972bf4ed8d2b74
                                                                                                                                                                                                      • Instruction ID: 29306f1da17679ce7d7d3cecb65679b0075e6f6f2ddca0a826851c871ac90975
                                                                                                                                                                                                      • Opcode Fuzzy Hash: efc6f27fa4c1f0416fcf42a0cb9c981ca4ea103f0f96f52908972bf4ed8d2b74
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 57F02772B0032057DB206A6A0CC1B636AC59F85B90F1541BBFA4CFF3F9D2B98C0042A9
                                                                                                                                                                                                      Function 00405280 Relevance: 1.6, APIs: 1, Instructions: 99COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetSystemDefaultLCID.KERNEL32(00000000,004053B6), ref: 0040529F
                                                                                                                                                                                                        • Part of subcall function 00404CDC: LoadStringA.USER32(00400000,0000FF87,?,00000400), ref: 00404CF9
                                                                                                                                                                                                        • Part of subcall function 0040520C: GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0040C4BC,00000001,?,004052D7,?,00000000,004053B6), ref: 0040522A
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.2688578704.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688548958.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688605236.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688635991.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: DefaultInfoLoadLocaleStringSystem
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 1658689577-0
                                                                                                                                                                                                      • Opcode ID: ef449c44a2a61a26d18614e24c7ade2666283ce56a0d8fcdc2eeed56ad2c4646
                                                                                                                                                                                                      • Instruction ID: b95c725f163960c8622ba1b0af82130980b93a97e76f79286a035b518bc8de08
                                                                                                                                                                                                      • Opcode Fuzzy Hash: ef449c44a2a61a26d18614e24c7ade2666283ce56a0d8fcdc2eeed56ad2c4646
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 90314F75E01509ABCB00DF95C8C19EEB379FF84304F158577E815BB286E739AE068B98
                                                                                                                                                                                                      Function 00407576 Relevance: 1.5, APIs: 1, Instructions: 30fileCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • CreateFileA.KERNEL32(00000000,?,?,00000000,?,00000080,00000000), ref: 004075B8
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.2688578704.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688548958.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688605236.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688635991.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CreateFile
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 823142352-0
                                                                                                                                                                                                      • Opcode ID: c8aa5b1e1f382d9b7ab40d46c96f796d669d4b8c7333918930cf1677525ebce7
                                                                                                                                                                                                      • Instruction ID: d860c9bcffbd3325f9178b4d72e9b59b5a3ff3896166b15a891a1a6cde46a7a7
                                                                                                                                                                                                      • Opcode Fuzzy Hash: c8aa5b1e1f382d9b7ab40d46c96f796d669d4b8c7333918930cf1677525ebce7
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 6EE06D713442082EE3409AEC6C51FA277DCD309354F008032B988DB342D5719D108BE8
                                                                                                                                                                                                      Function 00407578 Relevance: 1.5, APIs: 1, Instructions: 29fileCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • CreateFileA.KERNEL32(00000000,?,?,00000000,?,00000080,00000000), ref: 004075B8
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.2688578704.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688548958.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688605236.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688635991.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CreateFile
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 823142352-0
                                                                                                                                                                                                      • Opcode ID: 3bd7282c13d8f152a8301508d2aa72b6e2817799d08f3caede8a9fdcd0036c45
                                                                                                                                                                                                      • Instruction ID: d44512077142226ebef1615cfdb59f208ea4aebd3ed4d24446e2b73eb7949d4a
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 3bd7282c13d8f152a8301508d2aa72b6e2817799d08f3caede8a9fdcd0036c45
                                                                                                                                                                                                      • Instruction Fuzzy Hash: A7E06D713442082ED2409AEC6C51F92779C9309354F008022B988DB342D5719D108BE8
                                                                                                                                                                                                      Function 004069DC Relevance: 1.5, APIs: 1, Instructions: 29COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetFileAttributesA.KERNEL32(00000000,00000000,00406A24,?,?,?,?,00000000,?,00406A39,00406D67,00000000,00406DAC,?,?,?), ref: 00406A07
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.2688578704.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688548958.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688605236.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688635991.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: AttributesFile
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 3188754299-0
                                                                                                                                                                                                      • Opcode ID: 2f6b808c0a98facf9b4219f47e50352985dbcf5de86cc118cb6830f30f21a29b
                                                                                                                                                                                                      • Instruction ID: ccd219c895c276d3a4f2ed408fb3af00451e62210c6f1137e8185e88dac79a2a
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 2f6b808c0a98facf9b4219f47e50352985dbcf5de86cc118cb6830f30f21a29b
                                                                                                                                                                                                      • Instruction Fuzzy Hash: A0E0ED30300304BBD301FBA6CC42E4ABBECDB8A708BA28476B400B2682D6786E108428
                                                                                                                                                                                                      Function 004076C8 Relevance: 1.5, APIs: 1, Instructions: 29fileCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • WriteFile.KERNEL32(?,?,?,?,00000000), ref: 004076DF
                                                                                                                                                                                                        • Part of subcall function 0040748C: GetLastError.KERNEL32(0040738C,0040752A,?,?,020703AC,?,00409CCE,00000001,00000000,00000002,00000000,0040A2C5,?,00000000,0040A2FC), ref: 0040748F
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.2688578704.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688548958.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688605236.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688635991.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: ErrorFileLastWrite
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 442123175-0
                                                                                                                                                                                                      • Opcode ID: 8d2af3ab7a63a8387ab01b8eb17bee2761ee08039256abb6018552f25082062b
                                                                                                                                                                                                      • Instruction ID: d11fc940c1eb4d9ab9bd5ee1403c634941755763b259216c6d34bff68e3e8731
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 8d2af3ab7a63a8387ab01b8eb17bee2761ee08039256abb6018552f25082062b
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 6DE0ED766081106BD710A65AD880EAB67DCDFC5764F00407BF904DB291D574AC049676
                                                                                                                                                                                                      Function 00407284 Relevance: 1.5, APIs: 1, Instructions: 28windowCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • FormatMessageA.KERNEL32(00003200,00000000,4C783AFB,00000000,?,00000400,00000000,?,00409127,00000000,kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000), ref: 004072A3
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.2688578704.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688548958.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688605236.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688635991.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: FormatMessage
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 1306739567-0
                                                                                                                                                                                                      • Opcode ID: 7ef42d69529baecca532a801bf1eab389dc79dba057db81877db687b261eaad4
                                                                                                                                                                                                      • Instruction ID: 7b38442d06f496379890204edef453c821f476d6c52b93f329ea0e63e965d40b
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 7ef42d69529baecca532a801bf1eab389dc79dba057db81877db687b261eaad4
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 17E0D8A0B8830136F22414544C87B77220E47C0700F10807E7700ED3C6D6BEA906815F
                                                                                                                                                                                                      Function 004076AC Relevance: 1.5, APIs: 1, Instructions: 11fileCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • SetEndOfFile.KERNEL32(?,020A0000,0040A08C,00000000), ref: 004076B3
                                                                                                                                                                                                        • Part of subcall function 0040748C: GetLastError.KERNEL32(0040738C,0040752A,?,?,020703AC,?,00409CCE,00000001,00000000,00000002,00000000,0040A2C5,?,00000000,0040A2FC), ref: 0040748F
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.2688578704.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688548958.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688605236.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688635991.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: ErrorFileLast
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 734332943-0
                                                                                                                                                                                                      • Opcode ID: 3c9e02bda174eefd6a6752df40b73b0cbe28e66d981a9881f8e50d89b6fd2d40
                                                                                                                                                                                                      • Instruction ID: f788b2e916ece263959a2b362e6cc5638f15ca068e5e6b6e193a7bb405067b9b
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 3c9e02bda174eefd6a6752df40b73b0cbe28e66d981a9881f8e50d89b6fd2d40
                                                                                                                                                                                                      • Instruction Fuzzy Hash: BEC04CA1A1410047CB40A6BE89C1A1666D85A4821530485B6B908DB297D679E8004666
                                                                                                                                                                                                      Function 00406FFB Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • SetErrorMode.KERNEL32(?,00407019), ref: 0040700C
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.2688578704.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688548958.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688605236.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688635991.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: ErrorMode
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 2340568224-0
                                                                                                                                                                                                      • Opcode ID: 070e151ae7371931e812c23e1680e2574253ea8634671ff6451d3f815f7c1847
                                                                                                                                                                                                      • Instruction ID: c47f2f618e2971e07f5b1abb1c43dc6c143ad8b034d1ddbdae76011a93498253
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 070e151ae7371931e812c23e1680e2574253ea8634671ff6451d3f815f7c1847
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 54B09B76A1C2415DE705DAD5745153863D4D7C47143A14977F104D35C0D53DA4144519
                                                                                                                                                                                                      Function 00407017 Relevance: 1.5, APIs: 1, Instructions: 5COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • SetErrorMode.KERNEL32(?,00407019), ref: 0040700C
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.2688578704.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688548958.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688605236.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688635991.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: ErrorMode
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 2340568224-0
                                                                                                                                                                                                      • Opcode ID: 258b7047379ce46b8540a294da6ad57472ce1849ceeb23a1b4b516eeda09cad2
                                                                                                                                                                                                      • Instruction ID: a55afa0689d716a84ca499c05243e055e04a08b2ab071a0afeb25d409e08decd
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 258b7047379ce46b8540a294da6ad57472ce1849ceeb23a1b4b516eeda09cad2
                                                                                                                                                                                                      • Instruction Fuzzy Hash: FFA022A8C08000B2CE00E2E08080A3C23283A88308BC08BA2320CB20C0C03CE008020B
                                                                                                                                                                                                      Function 00406970 Relevance: 1.5, APIs: 1, Instructions: 4COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • CharPrevA.USER32(?,?,0040696C,?,00406649,?,?,00406D87,00000000,00406DAC,?,?,?,?,00000000,00000000), ref: 00406972
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.2688578704.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688548958.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688605236.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688635991.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CharPrev
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 122130370-0
                                                                                                                                                                                                      • Opcode ID: 4f55c7aa95ee0cc6def6f8b84b07f7a00b4eea213dcaa2411b48aa5a82a0c27b
                                                                                                                                                                                                      • Instruction ID: 57bb655d476c0b104ac503b4dc16dcc9cc7d9309af7e6782790f501f1b0aeff9
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 4f55c7aa95ee0cc6def6f8b84b07f7a00b4eea213dcaa2411b48aa5a82a0c27b
                                                                                                                                                                                                      • Instruction Fuzzy Hash:
                                                                                                                                                                                                      Function 00407F10 Relevance: 1.3, APIs: 1, Instructions: 62memoryCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 00407FA0
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.2688578704.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688548958.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688605236.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688635991.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: AllocVirtual
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 4275171209-0
                                                                                                                                                                                                      • Opcode ID: 636722d4ca057b68616df378e1b8a5bd7f337355b9f7c137ab23b8dc1cafdb71
                                                                                                                                                                                                      • Instruction ID: 1e7236936b067224bcb0a7c190bcfb18a105a15b1652d3161176e1d0ad605fa4
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 636722d4ca057b68616df378e1b8a5bd7f337355b9f7c137ab23b8dc1cafdb71
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 43116371A042059BDB00EF19C881B5B7794AF44359F05807AF958AB2C6DB38E800CBAA
                                                                                                                                                                                                      Function 00401658 Relevance: 1.3, APIs: 1, Instructions: 48COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • VirtualFree.KERNEL32(00000000,00000000,00004000,?,0000000C,?,-00000008,00003FFB,004018BF), ref: 004016B2
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.2688578704.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688548958.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688605236.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688635991.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: FreeVirtual
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 1263568516-0
                                                                                                                                                                                                      • Opcode ID: a2f32dd8ef58eb042d1926e7c5d87192c2fb778a874e681f692e1318d4ea2181
                                                                                                                                                                                                      • Instruction ID: 63c8255cdd02620dd55efc6405714c3c0a63becca9b218cdeda95617091702f1
                                                                                                                                                                                                      • Opcode Fuzzy Hash: a2f32dd8ef58eb042d1926e7c5d87192c2fb778a874e681f692e1318d4ea2181
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 3601A7726442148BC310AF28DDC093A77D5EB85364F1A4A7ED985B73A1D23B6C0587A8
                                                                                                                                                                                                      Function 00407548 Relevance: 1.3, APIs: 1, Instructions: 20COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.2688578704.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688548958.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688605236.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688635991.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CloseHandle
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 2962429428-0
                                                                                                                                                                                                      • Opcode ID: fc6098dcd6b1504a072b68d3feaaa537492281b052079d944a979dec092e75e7
                                                                                                                                                                                                      • Instruction ID: e7ddd8f09f86228f97b62737e097d00c20d119481f2284b048c56b7aa048eabb
                                                                                                                                                                                                      • Opcode Fuzzy Hash: fc6098dcd6b1504a072b68d3feaaa537492281b052079d944a979dec092e75e7
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 41D05E82B00A6017D615F2BE4D8869692D85F89685B08843AF654E77D1D67CEC00838D
                                                                                                                                                                                                      Function 00407EB8 Relevance: 1.3, APIs: 1, Instructions: 15COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • VirtualFree.KERNEL32(?,00000000,00008000,?,00407E9D), ref: 00407ECF
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.2688578704.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688548958.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688605236.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688635991.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: FreeVirtual
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 1263568516-0
                                                                                                                                                                                                      • Opcode ID: c7bedad96efb848ea9f674ed311898bb29a23f2a16fc3a9de009753beeeb9dd9
                                                                                                                                                                                                      • Instruction ID: 622015b425f940adf6dc1d0f89e873b9c6d17cfe6f0c2733970da1323f12c917
                                                                                                                                                                                                      • Opcode Fuzzy Hash: c7bedad96efb848ea9f674ed311898bb29a23f2a16fc3a9de009753beeeb9dd9
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 3ED0E9B17553055BDB90EEB98CC1B0237D8BB48610F5044B66904EB296E674E8009654

                                                                                                                                                                                                      Non-executed Functions

                                                                                                                                                                                                      Function 00409448 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 41shutdownCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetCurrentProcess.KERNEL32(00000028), ref: 00409457
                                                                                                                                                                                                      • OpenProcessToken.ADVAPI32(00000000,00000028), ref: 0040945D
                                                                                                                                                                                                      • LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,00000028), ref: 00409476
                                                                                                                                                                                                      • AdjustTokenPrivileges.ADVAPI32(?,00000000,00000002,00000000,00000000,00000000), ref: 0040949D
                                                                                                                                                                                                      • GetLastError.KERNEL32(?,00000000,00000002,00000000,00000000,00000000), ref: 004094A2
                                                                                                                                                                                                      • ExitWindowsEx.USER32(00000002,00000000), ref: 004094B3
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.2688578704.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688548958.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688605236.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688635991.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: ProcessToken$AdjustCurrentErrorExitLastLookupOpenPrivilegePrivilegesValueWindows
                                                                                                                                                                                                      • String ID: SeShutdownPrivilege
                                                                                                                                                                                                      • API String ID: 107509674-3733053543
                                                                                                                                                                                                      • Opcode ID: 5d5c4cc2167cea31fe6e778ad900630fb502c4628614430f67a63468396a48bc
                                                                                                                                                                                                      • Instruction ID: 55e16e97e4c30333ef6e9d7cb44a764448f3c494fd9ead6bbbdf5d5bb2f9c1eb
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 5d5c4cc2167cea31fe6e778ad900630fb502c4628614430f67a63468396a48bc
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 61F012B069830179E610AAB18D07F6762885BC4B18F50493ABB15FA1C3D7BDD809466F
                                                                                                                                                                                                      Function 00409BEC Relevance: 6.0, APIs: 4, Instructions: 31COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • FindResourceA.KERNEL32(00000000,00002B67,0000000A), ref: 00409BF6
                                                                                                                                                                                                      • SizeofResource.KERNEL32(00000000,00000000,?,00409CE6,00000000,0040A27D,?,00000001,00000000,00000002,00000000,0040A2C5,?,00000000,0040A2FC), ref: 00409C09
                                                                                                                                                                                                      • LoadResource.KERNEL32(00000000,00000000,00000000,00000000,?,00409CE6,00000000,0040A27D,?,00000001,00000000,00000002,00000000,0040A2C5,?,00000000), ref: 00409C1B
                                                                                                                                                                                                      • LockResource.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00409CE6,00000000,0040A27D,?,00000001,00000000,00000002,00000000,0040A2C5), ref: 00409C2C
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.2688578704.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688548958.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688605236.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688635991.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Resource$FindLoadLockSizeof
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 3473537107-0
                                                                                                                                                                                                      • Opcode ID: ce7c2a79786de0a8682d58b31ceb4174bbddb2d24ae6ad16542ef9ae896a3e40
                                                                                                                                                                                                      • Instruction ID: ed04ed1443b666af2c347742ca0221af59beed1f1180006ed42e296f861e82c7
                                                                                                                                                                                                      • Opcode Fuzzy Hash: ce7c2a79786de0a8682d58b31ceb4174bbddb2d24ae6ad16542ef9ae896a3e40
                                                                                                                                                                                                      • Instruction Fuzzy Hash: ECE07EA0B483562AFA6076FB08C2B2A018C4BA671DF40003BB701B92C3DEBD8C14856E
                                                                                                                                                                                                      Function 00405258 Relevance: 1.5, APIs: 1, Instructions: 23COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetLocaleInfoA.KERNEL32(00000000,0000000F,?,00000002,0000002C,?,?,00000000,0040545A,?,?,?,00000000,0040560C), ref: 0040526B
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.2688578704.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688548958.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688605236.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688635991.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: InfoLocale
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 2299586839-0
                                                                                                                                                                                                      • Opcode ID: b79b605a6dbd2dbd76dc5df923bc970e8acc9169766131cf64cabc826e101d13
                                                                                                                                                                                                      • Instruction ID: 1db3d1c1bb6fab5f91442dea8a08a829cd161d84d3a7e1f0c2fe21aaaafd944f
                                                                                                                                                                                                      • Opcode Fuzzy Hash: b79b605a6dbd2dbd76dc5df923bc970e8acc9169766131cf64cabc826e101d13
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 9ED02EA230E2006AE210808B2C84EBB4A9CCEC53A0F00007FF648C3242D2208C029B76
                                                                                                                                                                                                      Function 004026C4 Relevance: 1.5, APIs: 1, Instructions: 20timeCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetSystemTime.KERNEL32(?), ref: 004026CE
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.2688578704.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688548958.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688605236.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688635991.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: SystemTime
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 2656138-0
                                                                                                                                                                                                      • Opcode ID: 1c1586f040ad907c453502297459692aa8199981632c93951a31d41848eff65d
                                                                                                                                                                                                      • Instruction ID: 69442b1fa125f02c17f5f00667ba5619268a94e84ed87230136e9e38920861ba
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 1c1586f040ad907c453502297459692aa8199981632c93951a31d41848eff65d
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 14E04F21E0010A82C704ABA5CD435EDF7AEAB95600B044272A418E92E0F631C251C748
                                                                                                                                                                                                      Function 00405CF4 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetVersionExA.KERNEL32(?,004065F0,00000000,004065FE,?,?,?,?,?,00409C6A), ref: 00405D02
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.2688578704.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688548958.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688605236.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688635991.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Version
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 1889659487-0
                                                                                                                                                                                                      • Opcode ID: 804cda8d473c4c61bcc63f12479ba9190822d5c554409fc9a119c77cb0a2aa37
                                                                                                                                                                                                      • Instruction ID: 4c33b40dd65743d8d98a5ffd827b1eb297e5dd4f71424004bfe2d5ab9b26ea54
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 804cda8d473c4c61bcc63f12479ba9190822d5c554409fc9a119c77cb0a2aa37
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 00C0126040070186D7109B31DC02B1672D4AB44310F4405396DA4963C2E73C80018A6E
                                                                                                                                                                                                      Function 0040840C Relevance: .5, Instructions: 545COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.2688578704.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688548958.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688605236.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688635991.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                                      • Opcode ID: 7cb438cf7f0ff76753a1d16800e3023f3e313fbbfbb21f985cf38b771b24bb28
                                                                                                                                                                                                      • Instruction ID: 7dc6dc86846b3232beed044054ddb30c9891ac2fec336679fba6e94018ae2b4c
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 7cb438cf7f0ff76753a1d16800e3023f3e313fbbfbb21f985cf38b771b24bb28
                                                                                                                                                                                                      • Instruction Fuzzy Hash: C032D775E00219DFCB14CF99CA80AADB7B2BF88314F24816AD855B7385DB34AE42CF55
                                                                                                                                                                                                      Function 00407024 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 86registrylibraryloaderCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetModuleHandleA.KERNEL32(kernel32.dll,GetUserDefaultUILanguage,00000000,00407129,?,00000000,004098D0), ref: 0040704D
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00407053
                                                                                                                                                                                                      • RegCloseKey.ADVAPI32(?,?,00000001,00000000,00000000,kernel32.dll,GetUserDefaultUILanguage,00000000,00407129,?,00000000,004098D0), ref: 004070A1
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.2688578704.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688548958.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688605236.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688635991.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: AddressCloseHandleModuleProc
                                                                                                                                                                                                      • String ID: .DEFAULT\Control Panel\International$Control Panel\Desktop\ResourceLocale$GetUserDefaultUILanguage$Locale$kernel32.dll
                                                                                                                                                                                                      • API String ID: 4190037839-2401316094
                                                                                                                                                                                                      • Opcode ID: 84283e8ecd5f01446eeee6c4ca3ac4597d6d061694d9d4138b3ca6e7d0b19e25
                                                                                                                                                                                                      • Instruction ID: c068e7fb85b52830e378cef5638f1cf195f9e270113e5aa630163df598a56aa7
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 84283e8ecd5f01446eeee6c4ca3ac4597d6d061694d9d4138b3ca6e7d0b19e25
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 72214170E04209ABDB10EAB5CC55A9E77A9EB48304F60847BA510FB3C1D7BCAE01875E
                                                                                                                                                                                                      Function 00403A97 Relevance: 15.1, APIs: 10, Instructions: 122fileCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • CreateFileA.KERNEL32(00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00403B1E
                                                                                                                                                                                                      • GetFileSize.KERNEL32(?,00000000,00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00403B42
                                                                                                                                                                                                      • SetFilePointer.KERNEL32(?,-00000080,00000000,00000000,?,00000000,00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00403B5E
                                                                                                                                                                                                      • ReadFile.KERNEL32(?,?,00000080,?,00000000,00000000,?,-00000080,00000000,00000000,?,00000000,00000000,80000000,00000002,00000000), ref: 00403B7F
                                                                                                                                                                                                      • SetFilePointer.KERNEL32(?,00000000,00000000,00000002), ref: 00403BA8
                                                                                                                                                                                                      • SetEndOfFile.KERNEL32(?,?,00000000,00000000,00000002), ref: 00403BB2
                                                                                                                                                                                                      • GetStdHandle.KERNEL32(000000F5), ref: 00403BD2
                                                                                                                                                                                                      • GetFileType.KERNEL32(?,000000F5), ref: 00403BE9
                                                                                                                                                                                                      • CloseHandle.KERNEL32(?,?,000000F5), ref: 00403C04
                                                                                                                                                                                                      • GetLastError.KERNEL32(000000F5), ref: 00403C1E
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.2688578704.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688548958.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688605236.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688635991.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: File$HandlePointer$CloseCreateErrorLastReadSizeType
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 1694776339-0
                                                                                                                                                                                                      • Opcode ID: bd0a662ad2dd38144def4530256030cdb08cf53568247c3ffcddd32d1ed1ea18
                                                                                                                                                                                                      • Instruction ID: 6684f6b4d1923fa93cc5777a7ebe0ca766b8c5f16b1f456132d2f0a6dbb27d3d
                                                                                                                                                                                                      • Opcode Fuzzy Hash: bd0a662ad2dd38144def4530256030cdb08cf53568247c3ffcddd32d1ed1ea18
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 444194302042009EF7305F258805B237DEDEB4571AF208A3FA1D6BA6E1E77DAE419B5D
                                                                                                                                                                                                      Function 004053C4 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 167COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetSystemDefaultLCID.KERNEL32(00000000,0040560C,?,?,?,?,00000000,00000000,00000000,?,004065EB,00000000,004065FE), ref: 004053DE
                                                                                                                                                                                                        • Part of subcall function 0040520C: GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0040C4BC,00000001,?,004052D7,?,00000000,004053B6), ref: 0040522A
                                                                                                                                                                                                        • Part of subcall function 00405258: GetLocaleInfoA.KERNEL32(00000000,0000000F,?,00000002,0000002C,?,?,00000000,0040545A,?,?,?,00000000,0040560C), ref: 0040526B
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.2688578704.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688548958.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688605236.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688635991.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: InfoLocale$DefaultSystem
                                                                                                                                                                                                      • String ID: AMPM$:mm$:mm:ss$m/d/yy$mmmm d, yyyy
                                                                                                                                                                                                      • API String ID: 1044490935-665933166
                                                                                                                                                                                                      • Opcode ID: 2becd82198b95216644133442ecc563e5ef80f5327bc31795fb041598c227e39
                                                                                                                                                                                                      • Instruction ID: cc137df54ae1fcbb63b87987e69a719e9c27c4b31815d0debc5c9b1d2781c89a
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 2becd82198b95216644133442ecc563e5ef80f5327bc31795fb041598c227e39
                                                                                                                                                                                                      • Instruction Fuzzy Hash: F8515374B00548ABDB00EBA59891A5F7769DB88304F50D5BBB515BB3C6CA3DCA058F1C
                                                                                                                                                                                                      Function 004036B8 Relevance: 7.6, APIs: 5, Instructions: 55memoryCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000400), ref: 004036F2
                                                                                                                                                                                                      • SysAllocStringLen.OLEAUT32(?,00000000), ref: 004036FD
                                                                                                                                                                                                      • MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000,00000000,00000000), ref: 00403710
                                                                                                                                                                                                      • SysAllocStringLen.OLEAUT32(00000000,00000000), ref: 0040371A
                                                                                                                                                                                                      • MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 00403729
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.2688578704.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688548958.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688605236.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688635991.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: ByteCharMultiWide$AllocString
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 262959230-0
                                                                                                                                                                                                      • Opcode ID: 759139aa8138bb4f1b890a81a570935fc2f09484a8ccbcda4eb7e9d11bc9ffe5
                                                                                                                                                                                                      • Instruction ID: 1285967c487f36a4f1f77a8b8e1f1fe351824cacfdb80e5859a13ebcd08b75b2
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 759139aa8138bb4f1b890a81a570935fc2f09484a8ccbcda4eb7e9d11bc9ffe5
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 17F068A13442543AF56075A75C43FAB198CCB45BAEF10457FF704FA2C2D8B89D0492BD
                                                                                                                                                                                                      Function 00406E10 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 113registryCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,00000000,?,00000000,00406F48,?,00000000,004098D0,00000000), ref: 00406E4C
                                                                                                                                                                                                      • RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,00000000,70000000,?,?,00000000,00000000,00000000,?,00000000,00406F48,?,00000000), ref: 00406EBC
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.2688578704.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688548958.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688605236.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688635991.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: QueryValue
                                                                                                                                                                                                      • String ID: )q@
                                                                                                                                                                                                      • API String ID: 3660427363-2284170586
                                                                                                                                                                                                      • Opcode ID: 32d2d681139902fa63b50b1e86c1c6042aee641263ad409bd5d16b68eaa8278f
                                                                                                                                                                                                      • Instruction ID: 22a93fbabe645b78fd14ced98f65bd4bcb22fe3fd6f8222f7fa8e6a3c98f8dfc
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 32d2d681139902fa63b50b1e86c1c6042aee641263ad409bd5d16b68eaa8278f
                                                                                                                                                                                                      • Instruction Fuzzy Hash: E6415E31D0021AAFDB21DF95C881BAFB7B8EB04704F56447AE901F7280D738AF108B99
                                                                                                                                                                                                      Function 004030DC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 9COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetModuleHandleA.KERNEL32(00000000,00409C56), ref: 004030E3
                                                                                                                                                                                                      • GetCommandLineA.KERNEL32(00000000,00409C56), ref: 004030EE
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.2688578704.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688548958.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688605236.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2688635991.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CommandHandleLineModule
                                                                                                                                                                                                      • String ID: U1hd.@
                                                                                                                                                                                                      • API String ID: 2123368496-2904493091
                                                                                                                                                                                                      • Opcode ID: ab44cebb113f23cc453db0582047ce3f33ed2b100303cb8959b7892e21e32e4b
                                                                                                                                                                                                      • Instruction ID: 0f926add87520dc699e98d27074396f9fab16295c11a520b4b5863bd90c7cb52
                                                                                                                                                                                                      • Opcode Fuzzy Hash: ab44cebb113f23cc453db0582047ce3f33ed2b100303cb8959b7892e21e32e4b
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 03C01274541300CAD328AFF69E8A304B990A385349F40823FA608BA2F1CA7C4201EBDD

                                                                                                                                                                                                      Execution Graph

                                                                                                                                                                                                      Execution Coverage:17.5%
                                                                                                                                                                                                      Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                                                      Signature Coverage:6%
                                                                                                                                                                                                      Total number of Nodes:2000
                                                                                                                                                                                                      Total number of Limit Nodes:97
                                                                                                                                                                                                      execution_graph 49867 46b984 49868 46be21 49867->49868 49869 46b9b8 49867->49869 50257 403400 49868->50257 49871 46b9f4 49869->49871 49874 46ba50 49869->49874 49875 46ba2e 49869->49875 49876 46ba3f 49869->49876 49877 46ba0c 49869->49877 49878 46ba1d 49869->49878 49871->49868 49957 468ae8 49871->49957 50220 46b914 45 API calls 49874->50220 49922 46b544 49875->49922 50219 46b704 68 API calls 49876->50219 50217 46b294 47 API calls 49877->50217 50218 46b3fc 42 API calls 49878->50218 49882 403400 4 API calls 49886 46be68 49882->49886 49885 46ba12 49885->49868 49885->49871 49887 46ba8c 49887->49868 49901 46bacf 49887->49901 50221 494910 49887->50221 49890 414ae8 LocalAlloc TlsSetValue TlsGetValue TlsGetValue 49890->49901 49894 42cbc0 6 API calls 49894->49901 49895 403450 LocalAlloc TlsSetValue TlsGetValue TlsGetValue 49895->49901 49896 46addc 23 API calls 49896->49901 49899 46bc4b 50000 469d90 49899->50000 49900 46addc 23 API calls 49900->49868 49901->49868 49901->49890 49901->49894 49901->49895 49901->49896 49901->49899 49913 46bd13 49901->49913 49960 468a24 49901->49960 49968 483070 49901->49968 49993 46ab48 49901->49993 50144 482b68 49901->50144 50256 46b050 19 API calls 49901->50256 49903 46bcb1 50061 403450 49903->50061 49906 46bd1d 49909 46bddf 49906->49909 50067 46addc 49906->50067 49907 46bccd 50240 457d6c 49907->50240 49913->49900 50261 46c298 49922->50261 49925 46b6c6 50294 403420 49925->50294 49958 468a24 19 API calls 49957->49958 49959 468af7 49958->49959 49959->49887 49964 468a53 49960->49964 49961 4078f4 19 API calls 49962 468a8c 49961->49962 50644 453344 LocalAlloc TlsSetValue TlsGetValue TlsGetValue 49962->50644 49964->49961 49965 468a94 49964->49965 49966 403400 4 API calls 49965->49966 49967 468aac 49966->49967 49967->49901 50645 4181e0 49968->50645 49970 4830a7 GetForegroundWindow 49971 4830b2 SetActiveWindow 49970->49971 49972 4830c0 49970->49972 49971->49972 49973 4830e1 49972->49973 50647 482f6c 49972->50647 49976 48310d 49973->49976 49980 48316c 49973->49980 49981 4831a2 49973->49981 49975 4830dc KiUserCallbackDispatcher 49975->49973 49977 4831e4 49976->49977 50671 457b60 49976->50671 50657 481f98 49977->50657 50661 466674 49980->50661 49983 466674 20 API calls 49981->49983 49986 4831a0 49983->49986 49984 4831f0 50692 481750 PostMessageA 49984->50692 50670 47eab4 42 API calls 49986->50670 49990 483220 49991 403420 4 API calls 49990->49991 49992 46bc0d KiUserCallbackDispatcher 49991->49992 49992->49901 49994 46ab54 49993->49994 49995 46ab59 49993->49995 49996 46ab57 49994->49996 51386 46a5b4 49994->51386 51471 4698f4 46 API calls 49995->51471 49996->49901 49998 46ab61 49998->49901 50001 403400 4 API calls 50000->50001 50002 469dbe 50001->50002 51494 47d7f0 50002->51494 50004 469e21 50005 469e25 50004->50005 50006 469e3e 50004->50006 50007 466674 20 API calls 50005->50007 50008 469e2f 50006->50008 51501 494800 LocalAlloc TlsSetValue TlsGetValue TlsGetValue 50006->51501 50007->50008 50009 46a0d2 50008->50009 50011 469f5d 50008->50011 50012 469fc8 50008->50012 50013 403420 4 API calls 50009->50013 50015 403494 4 API calls 50011->50015 50016 403494 4 API calls 50012->50016 50017 46a0fc 50013->50017 50014 469e5a 50014->50008 50018 469e62 50014->50018 50020 469f6a 50015->50020 50021 469fd5 50016->50021 50017->49903 50019 46addc 23 API calls 50018->50019 50028 469e6f 50019->50028 50022 40357c 4 API calls 50020->50022 50023 40357c 4 API calls 50021->50023 50024 469f77 50022->50024 50025 469fe2 50023->50025 50026 40357c 4 API calls 50024->50026 50027 40357c 4 API calls 50025->50027 50029 469f84 50026->50029 50030 469fef 50027->50030 50033 469eb0 50028->50033 50034 469e98 SetActiveWindow 50028->50034 50031 40357c 4 API calls 50029->50031 50032 40357c 4 API calls 50030->50032 50035 469f91 50031->50035 50036 469ffc 50032->50036 50043 42f560 14 API calls 50033->50043 50034->50033 50037 466674 20 API calls 50035->50037 50038 40357c 4 API calls 50036->50038 50040 469f9f 50037->50040 50039 46a00a 50038->50039 50046 469ec6 50043->50046 51502 494aac 18 API calls 50046->51502 50051 469f01 50053 46ac58 21 API calls 50051->50053 50054 469f33 50053->50054 50054->49903 50062 403454 50061->50062 50065 403464 50061->50065 50064 4034bc 4 API calls 50062->50064 50062->50065 50063 403490 50063->49906 50063->49907 50064->50065 50065->50063 50066 402660 4 API calls 50065->50066 50066->50063 50068 468ae8 19 API calls 50067->50068 50069 46adf4 50068->50069 50145 46c298 48 API calls 50144->50145 50146 482bab 50145->50146 50147 482bb4 50146->50147 51952 408be0 LocalAlloc TlsSetValue TlsGetValue TlsGetValue LoadStringA 50146->51952 50149 414ae8 4 API calls 50147->50149 50150 482bc4 50149->50150 50151 403450 4 API calls 50150->50151 50152 482bd1 50151->50152 51732 46c5f0 50152->51732 50155 482be1 50157 414ae8 4 API calls 50155->50157 50158 482bf1 50157->50158 50159 403450 4 API calls 50158->50159 50160 482bfe 50159->50160 50161 4696dc SendMessageA 50160->50161 50162 482c17 50161->50162 50217->49885 50218->49871 50219->49871 50220->49871 50222 43d9c8 4 API calls 50221->50222 50223 494931 50222->50223 50224 49493c 50223->50224 50225 4949c2 50223->50225 50227 431bd0 4 API calls 50224->50227 50226 4949d1 50225->50226 53700 494138 LocalAlloc TlsSetValue TlsGetValue TlsGetValue 50225->53700 50226->49901 50229 494948 50227->50229 50230 494368 4 API calls 50229->50230 50231 494969 50230->50231 53692 494480 50231->53692 50234 43d594 18 API calls 50235 494986 50234->50235 53698 4941cc LocalAlloc TlsSetValue TlsGetValue TlsGetValue 50235->53698 50237 49499a 53699 433dd0 LocalAlloc TlsSetValue TlsGetValue TlsGetValue 50237->53699 50241 457d91 50240->50241 50242 457db1 50241->50242 50243 4078f4 19 API calls 50241->50243 50256->49901 50258 403406 50257->50258 50259 40341f 50257->50259 50258->50259 50260 402660 4 API calls 50258->50260 50259->49882 50260->50259 50298 46c330 50261->50298 50264 414ae8 50265 414af6 50264->50265 50266 4034e0 4 API calls 50265->50266 50267 414b03 50266->50267 50296 403426 50294->50296 50295 40344b 50296->50295 50297 402660 4 API calls 50296->50297 50297->50296 50299 414ae8 4 API calls 50298->50299 50300 46c364 50299->50300 50359 46670c 50300->50359 50304 46c376 50305 46c385 50304->50305 50310 46c39e 50304->50310 50428 47eab4 42 API calls 50305->50428 50307 46c399 50308 403420 4 API calls 50307->50308 50309 46b576 50308->50309 50309->49925 50309->50264 50311 46c3e5 50310->50311 50313 46c3cc 50310->50313 50312 46c44a 50311->50312 50326 46c3e9 50311->50326 50431 42cb4c CharNextA 50312->50431 50429 47eab4 42 API calls 50313->50429 50316 46c459 50317 46c45d 50316->50317 50321 46c476 50316->50321 50432 47eab4 42 API calls 50317->50432 50319 46c431 50430 47eab4 42 API calls 50319->50430 50322 46c49a 50321->50322 50373 46687c 50321->50373 50433 47eab4 42 API calls 50322->50433 50326->50319 50326->50321 50364 466726 50359->50364 50360 406bb0 LocalAlloc TlsSetValue TlsGetValue TlsGetValue 50360->50364 50362 42cbc0 6 API calls 50362->50364 50363 403450 4 API calls 50363->50364 50364->50360 50364->50362 50364->50363 50365 46676f 50364->50365 50438 42caac 50364->50438 50366 403420 4 API calls 50365->50366 50367 466789 50366->50367 50368 414b18 50367->50368 50369 414ae8 4 API calls 50368->50369 50370 414b3c 50369->50370 50371 403400 4 API calls 50370->50371 50372 414b6d 50371->50372 50372->50304 50374 466886 50373->50374 50375 466899 50374->50375 50487 42cb3c CharNextA 50374->50487 50375->50322 50377 4668ac 50375->50377 50378 4668b6 50377->50378 50428->50307 50429->50307 50430->50307 50431->50316 50432->50307 50433->50307 50447 403494 50438->50447 50440 42cabc 50444 42caf2 50440->50444 50451 403744 50440->50451 50455 42c444 IsDBCSLeadByte 50440->50455 50443 42cb36 50443->50364 50444->50443 50456 4037b8 50444->50456 50461 42c444 IsDBCSLeadByte 50444->50461 50448 403498 50447->50448 50449 4034ba 50448->50449 50462 402660 50448->50462 50449->50440 50452 40374a 50451->50452 50454 40375b 50451->50454 50452->50454 50467 4034bc 50452->50467 50454->50440 50455->50440 50457 403744 4 API calls 50456->50457 50458 4037c6 50457->50458 50459 4037fc 50458->50459 50477 4038a4 50458->50477 50459->50444 50461->50444 50463 402664 50462->50463 50464 40266e 50462->50464 50463->50464 50466 4033bc LocalAlloc TlsSetValue TlsGetValue TlsGetValue 50463->50466 50464->50449 50464->50464 50466->50464 50468 4034c0 50467->50468 50469 4034dc 50467->50469 50472 402648 50468->50472 50469->50454 50471 4034c9 50471->50454 50473 40264c 50472->50473 50474 402656 50472->50474 50473->50474 50476 4033bc LocalAlloc TlsSetValue TlsGetValue TlsGetValue 50473->50476 50474->50471 50474->50474 50476->50474 50478 4038b1 50477->50478 50485 4038e1 50477->50485 50479 4038da 50478->50479 50482 4038bd 50478->50482 50483 4034bc 4 API calls 50479->50483 50480 403400 4 API calls 50481 4038cb 50480->50481 50481->50459 50486 402678 LocalAlloc TlsSetValue TlsGetValue TlsGetValue 50482->50486 50483->50485 50485->50480 50486->50481 50487->50374 50644->49965 50646 4181ea 50645->50646 50646->49970 50651 482fa2 50647->50651 50648 48303f 50649 48304a 50648->50649 50806 482f34 GetTickCount 50648->50806 50649->49975 50651->50648 50693 42f560 50651->50693 50709 47dc9c 50651->50709 50713 478dc4 50651->50713 50716 482244 50651->50716 50813 478df0 19 API calls 50651->50813 50658 481fe9 50657->50658 50659 481fbb 50657->50659 50658->49984 51256 49485c 50659->51256 51350 466588 50661->51350 50670->49976 50672 457b8c 50671->50672 50687 457c94 50671->50687 51381 45785c GetSystemTimeAsFileTime FileTimeToSystemTime 50672->51381 50673 457ce5 50676 403400 4 API calls 50673->50676 50678 457cfa 50676->50678 50677 457b94 50679 4078f4 19 API calls 50677->50679 50678->49977 50680 457c05 50679->50680 51382 457b50 20 API calls 50680->51382 50682 457c5b 50683 457c8a 50682->50683 50689 403778 4 API calls 50682->50689 51384 457b50 20 API calls 50683->51384 50684 403778 4 API calls 50685 457c0d 50684->50685 50685->50682 50685->50684 50688 457b50 20 API calls 50685->50688 50687->50673 51385 4573c8 6 API calls 50687->51385 50688->50685 50690 457c82 50689->50690 51383 457b50 20 API calls 50690->51383 50692->49990 50694 42f56c 50693->50694 50695 42f58f GetActiveWindow GetFocus 50694->50695 50696 41eea4 2 API calls 50695->50696 50697 42f5a6 50696->50697 50698 42f5c3 50697->50698 50699 42f5b3 RegisterClassA 50697->50699 50700 42f652 SetFocus 50698->50700 50701 42f5d1 CreateWindowExA 50698->50701 50699->50698 50702 403400 4 API calls 50700->50702 50701->50700 50703 42f604 50701->50703 50704 42f66e 50702->50704 50814 42427c 50703->50814 50704->50651 50706 42f62c 50710 47dd43 50709->50710 50711 47dcb0 50709->50711 50710->50651 50711->50710 50820 4572bc 15 API calls 50711->50820 50821 478d20 50713->50821 50717 457b60 24 API calls 50716->50717 50718 482289 50717->50718 50719 4822a0 50718->50719 50720 482294 50718->50720 50722 457b60 24 API calls 50719->50722 50721 457b60 24 API calls 50720->50721 50723 48229e 50721->50723 50722->50723 50724 4822bc 50723->50724 50725 4822b0 50723->50725 50727 457b60 24 API calls 50724->50727 50726 457b60 24 API calls 50725->50726 50728 4822ba 50726->50728 50727->50728 50829 47bd90 50728->50829 50811 482f4c 50806->50811 50808 482f69 50808->50649 50809 482f3e GetTickCount 50809->50808 50809->50811 50810 481f8c 12 API calls 50810->50811 50811->50808 50811->50809 50811->50810 51251 42ec74 MsgWaitForMultipleObjects 50811->51251 51252 482f00 GetForegroundWindow 50811->51252 50813->50651 50815 4242ae 50814->50815 50816 42428e GetWindowTextA 50814->50816 50818 403494 4 API calls 50815->50818 50817 4034e0 4 API calls 50816->50817 50819 4242ac 50817->50819 50818->50819 50819->50706 50820->50710 50822 478d54 50821->50822 50823 478d2c 50821->50823 50822->50651 50824 478d4d 50823->50824 50827 453344 LocalAlloc TlsSetValue TlsGetValue TlsGetValue 50823->50827 50828 478be0 19 API calls 50824->50828 50827->50824 50828->50822 50878 47bdb0 50829->50878 50879 403494 4 API calls 50878->50879 50887 47bde3 50879->50887 51251->50811 51253 482f2c 51252->51253 51254 482f13 GetWindowThreadProcessId 51252->51254 51253->50811 51254->51253 51255 482f21 GetCurrentProcessId 51254->51255 51255->51253 51271 43d9c8 51256->51271 51259 4948f5 51260 494885 51303 431eec 51271->51303 51273 403400 4 API calls 51274 43da76 51273->51274 51274->51259 51274->51260 51275 43d9f2 51275->51273 51304 403494 4 API calls 51303->51304 51306 431efb 51304->51306 51305 431f25 51305->51275 51306->51305 51307 403744 4 API calls 51306->51307 51307->51306 51351 403494 4 API calls 51350->51351 51352 4665b6 51351->51352 51367 42dbc8 51352->51367 51355 42dbc8 5 API calls 51356 4665da 51355->51356 51357 466474 19 API calls 51356->51357 51358 4665e4 51357->51358 51359 42dbc8 5 API calls 51358->51359 51360 4665f3 51359->51360 51374 42db10 51367->51374 51375 42db30 51374->51375 51376 42dbbb 51374->51376 51375->51376 51377 4037b8 4 API calls 51375->51377 51379 403800 4 API calls 51375->51379 51380 42c444 IsDBCSLeadByte 51375->51380 51376->51355 51377->51375 51379->51375 51380->51375 51381->50677 51382->50685 51383->50683 51384->50687 51385->50673 51388 46a5fb 51386->51388 51387 46aa73 51389 46aa8e 51387->51389 51390 46aabf 51387->51390 51388->51387 51391 46a6b6 51388->51391 51395 403494 4 API calls 51388->51395 51394 403494 4 API calls 51389->51394 51392 403494 4 API calls 51390->51392 51393 46a6d7 51391->51393 51397 46a718 51391->51397 51396 46aacd 51392->51396 51398 403494 4 API calls 51393->51398 51399 46aa9c 51394->51399 51400 46a63a 51395->51400 51490 468fd0 12 API calls 51396->51490 51401 403400 4 API calls 51397->51401 51403 46a6e5 51398->51403 51489 468fd0 12 API calls 51399->51489 51405 414ae8 4 API calls 51400->51405 51407 46a716 51401->51407 51409 414ae8 4 API calls 51403->51409 51406 46a65b 51405->51406 51411 403634 4 API calls 51406->51411 51430 46a7fc 51407->51430 51472 4696dc 51407->51472 51408 46aaaa 51412 403400 4 API calls 51408->51412 51410 46a706 51409->51410 51413 403634 4 API calls 51410->51413 51414 46a66b 51411->51414 51416 46aaf0 51412->51416 51413->51407 51418 414ae8 4 API calls 51414->51418 51421 403400 4 API calls 51416->51421 51417 46a884 51419 403400 4 API calls 51417->51419 51422 46a67f 51418->51422 51423 46a882 51419->51423 51420 46a738 51424 46a776 51420->51424 51425 46a73e 51420->51425 51426 46aaf8 51421->51426 51422->51391 51432 414ae8 4 API calls 51422->51432 51484 469b18 43 API calls 51423->51484 51427 403400 4 API calls 51424->51427 51428 403494 4 API calls 51425->51428 51429 403420 4 API calls 51426->51429 51431 46a774 51427->51431 51433 46a74c 51428->51433 51434 46ab05 51429->51434 51430->51417 51435 46a843 51430->51435 51478 4699d0 51431->51478 51437 46a6a6 51432->51437 51439 47bd90 43 API calls 51433->51439 51434->49996 51436 403494 4 API calls 51435->51436 51440 46a851 51436->51440 51441 403634 4 API calls 51437->51441 51443 46a764 51439->51443 51444 414ae8 4 API calls 51440->51444 51441->51391 51442 46a8ad 51450 46a90e 51442->51450 51451 46a8b8 51442->51451 51446 403634 4 API calls 51443->51446 51447 46a872 51444->51447 51446->51431 51449 403634 4 API calls 51447->51449 51449->51423 51453 403400 4 API calls 51450->51453 51452 403494 4 API calls 51451->51452 51461 46a8c6 51452->51461 51456 46a916 51453->51456 51459 46a90c 51456->51459 51470 46a9bf 51456->51470 51459->51456 51485 494800 LocalAlloc TlsSetValue TlsGetValue TlsGetValue 51459->51485 51461->51456 51461->51459 51465 403634 4 API calls 51461->51465 51462 46a939 51462->51470 51465->51461 51468 46aa60 51487 4290f4 SendMessageA 51470->51487 51471->49998 51491 42a040 SendMessageA 51472->51491 51474 4696eb 51475 46970b 51474->51475 51492 42a040 SendMessageA 51474->51492 51475->51420 51477 4696fb 51477->51420 51482 4699fd 51478->51482 51479 469a5f 51480 403400 4 API calls 51479->51480 51482->51479 51493 469954 43 API calls 51482->51493 51484->51442 51485->51462 51487->51468 51489->51408 51490->51408 51491->51474 51492->51477 51493->51482 51495 47d809 51494->51495 51499 47d846 51494->51499 51507 455d0c 51495->51507 51499->50004 51500 47d85d 51500->50004 51501->50014 51502->50051 51508 455d1d 51507->51508 51509 455d21 51508->51509 51510 455d2a 51508->51510 51532 455a10 51509->51532 51540 455af0 29 API calls 51510->51540 51513 455d27 51513->51499 51514 47d460 51513->51514 51519 47d4a0 51514->51519 51520 47d55c 51514->51520 51515 403420 4 API calls 51516 47d63f 51515->51516 51516->51500 51519->51520 51524 47bd90 43 API calls 51519->51524 51526 47d4ff 51519->51526 51529 47d508 51519->51529 51569 479290 51519->51569 51580 4793f4 51519->51580 51522 47bd90 43 API calls 51520->51522 51523 454100 20 API calls 51520->51523 51520->51526 51595 479150 51520->51595 51522->51520 51523->51520 51524->51519 51525 47bd90 43 API calls 51525->51529 51526->51515 51529->51519 51529->51525 51531 47d549 51529->51531 51584 42c92c 51529->51584 51589 42c954 51529->51589 51594 47d16c 52 API calls 51529->51594 51531->51526 51541 42de1c 51532->51541 51534 455a2d 51535 455a7b 51534->51535 51544 455944 51534->51544 51535->51513 51540->51513 51542 42de27 51541->51542 51543 42de2d RegOpenKeyExA 51541->51543 51542->51543 51543->51534 51549 42dd58 51544->51549 51552 42dc00 51549->51552 51553 42dc26 RegQueryValueExA 51552->51553 51554 42dc6b 51553->51554 51559 42dc49 51553->51559 51555 403400 4 API calls 51554->51555 51557 42dd37 51555->51557 51556 42dc63 51558 403400 4 API calls 51556->51558 51558->51554 51559->51554 51559->51556 51560 4034e0 4 API calls 51559->51560 51561 403744 4 API calls 51559->51561 51560->51559 51562 42dca0 RegQueryValueExA 51561->51562 51562->51553 51570 4792a6 51569->51570 51571 4792a2 51569->51571 51572 403450 4 API calls 51570->51572 51571->51519 51573 4792b3 51572->51573 51574 4792d3 51573->51574 51575 4792b9 51573->51575 51576 479150 19 API calls 51574->51576 51577 479150 19 API calls 51575->51577 51578 4792cf 51576->51578 51577->51578 51581 479400 51580->51581 51582 47941b 51581->51582 51607 453344 LocalAlloc TlsSetValue TlsGetValue TlsGetValue 51581->51607 51582->51519 51585 42c79c IsDBCSLeadByte 51584->51585 51586 42c93c 51585->51586 51587 403778 4 API calls 51586->51587 51588 42c94e 51587->51588 51588->51529 51590 42c79c IsDBCSLeadByte 51589->51590 51591 42c964 51590->51591 51592 403778 4 API calls 51591->51592 51593 42c975 51592->51593 51593->51529 51594->51529 51596 47916b 51595->51596 51599 47919c 51596->51599 51600 47922a 51596->51600 51608 479004 19 API calls 51596->51608 51598 4791c1 51603 4791e2 51598->51603 51610 479004 19 API calls 51598->51610 51599->51598 51609 479004 19 API calls 51599->51609 51600->51520 51603->51600 51604 479222 51603->51604 51611 453344 LocalAlloc TlsSetValue TlsGetValue TlsGetValue 51603->51611 51612 478e88 19 API calls 51604->51612 51607->51582 51608->51599 51609->51598 51610->51603 51611->51604 51612->51600 51733 46c619 51732->51733 51734 414ae8 4 API calls 51733->51734 51744 46c666 51733->51744 51736 46c62f 51734->51736 51735 403420 4 API calls 51738 46c710 51735->51738 51958 466798 6 API calls 51736->51958 51738->50155 51953 408be0 LocalAlloc TlsSetValue TlsGetValue TlsGetValue LoadStringA 51738->51953 51739 46c637 51740 414b18 4 API calls 51739->51740 51741 46c645 51740->51741 51742 46c652 51741->51742 51745 46c66b 51741->51745 51959 47eab4 42 API calls 51742->51959 51744->51735 51746 46c683 51745->51746 51748 46687c CharNextA 51745->51748 51960 47eab4 42 API calls 51746->51960 51749 46c67f 51748->51749 51749->51746 51750 46c699 51749->51750 51958->51739 51959->51744 51960->51744 53693 49449c 53692->53693 53701 433d6c 53693->53701 53695 4944a1 53696 431ca0 4 API calls 53695->53696 53697 4944ac 53696->53697 53697->50234 53698->50237 53700->50226 53702 402648 4 API calls 53701->53702 53703 433d7b 53702->53703 53703->53695 53705 416b42 53706 416bea 53705->53706 53707 416b5a 53705->53707 53724 41531c LocalAlloc TlsSetValue TlsGetValue TlsGetValue 53706->53724 53709 416b74 SendMessageA 53707->53709 53710 416b68 53707->53710 53720 416bc8 53709->53720 53711 416b72 CallWindowProcA 53710->53711 53712 416b8e 53710->53712 53711->53720 53721 41a058 GetSysColor 53712->53721 53715 416b99 SetTextColor 53716 416bae 53715->53716 53722 41a058 GetSysColor 53716->53722 53718 416bb3 SetBkColor 53723 41a6e0 GetSysColor CreateBrushIndirect 53718->53723 53721->53715 53722->53718 53723->53720 53724->53720 53725 402584 53726 402598 53725->53726 53727 4025ab 53725->53727 53755 4019cc RtlInitializeCriticalSection RtlEnterCriticalSection LocalAlloc RtlLeaveCriticalSection 53726->53755 53729 4025c2 RtlEnterCriticalSection 53727->53729 53730 4025cc 53727->53730 53729->53730 53741 4023b4 13 API calls 53730->53741 53731 40259d 53731->53727 53733 4025a1 53731->53733 53734 4025d5 53735 4025d9 53734->53735 53742 402088 53734->53742 53737 402635 53735->53737 53738 40262b RtlLeaveCriticalSection 53735->53738 53738->53737 53739 4025e5 53739->53735 53756 402210 9 API calls 53739->53756 53741->53734 53743 40209c 53742->53743 53744 4020af 53742->53744 53763 4019cc RtlInitializeCriticalSection RtlEnterCriticalSection LocalAlloc RtlLeaveCriticalSection 53743->53763 53745 4020c6 RtlEnterCriticalSection 53744->53745 53749 4020d0 53744->53749 53745->53749 53747 4020a1 53747->53744 53748 4020a5 53747->53748 53752 402106 53748->53752 53749->53752 53757 401f94 53749->53757 53752->53739 53753 4021f1 RtlLeaveCriticalSection 53754 4021fb 53753->53754 53754->53739 53755->53731 53756->53735 53760 401fa4 53757->53760 53758 401fd0 53762 401ff4 53758->53762 53769 401db4 53758->53769 53760->53758 53760->53762 53764 401f0c 53760->53764 53762->53753 53762->53754 53763->53747 53773 40178c 53764->53773 53768 401f29 53768->53760 53770 401e02 53769->53770 53771 401dd2 53769->53771 53770->53771 53796 401d1c 53770->53796 53771->53762 53774 4017a8 53773->53774 53776 4017b2 53774->53776 53778 40180f 53774->53778 53780 401803 53774->53780 53784 4014e4 53774->53784 53793 4013e0 LocalAlloc 53774->53793 53792 401678 VirtualAlloc 53776->53792 53778->53768 53783 401e80 9 API calls 53778->53783 53794 4015c0 VirtualFree 53780->53794 53781 4017be 53781->53778 53783->53768 53785 4014f3 VirtualAlloc 53784->53785 53787 401520 53785->53787 53788 401543 53785->53788 53795 401398 LocalAlloc 53787->53795 53788->53774 53790 40152c 53790->53788 53791 401530 VirtualFree 53790->53791 53791->53788 53792->53781 53793->53774 53794->53778 53795->53790 53797 401d2e 53796->53797 53798 401d51 53797->53798 53799 401d63 53797->53799 53809 401940 53798->53809 53801 401940 3 API calls 53799->53801 53802 401d61 53801->53802 53808 401d79 53802->53808 53819 401bf8 9 API calls 53802->53819 53804 401d88 53805 401da2 53804->53805 53820 401c4c 9 API calls 53804->53820 53821 401454 LocalAlloc 53805->53821 53808->53771 53810 401966 53809->53810 53812 4019bf 53809->53812 53822 40170c 53810->53822 53812->53802 53815 401983 53816 40199a 53815->53816 53827 4015c0 VirtualFree 53815->53827 53816->53812 53828 401454 LocalAlloc 53816->53828 53819->53804 53820->53805 53821->53808 53824 401743 53822->53824 53823 401783 53826 4013e0 LocalAlloc 53823->53826 53824->53823 53825 40175d VirtualFree 53824->53825 53825->53824 53826->53815 53827->53816 53828->53812 53829 416644 53830 416651 53829->53830 53831 4166ab 53829->53831 53836 416550 CreateWindowExA 53830->53836 53832 416658 SetPropA SetPropA 53832->53831 53833 41668b 53832->53833 53834 41669e SetWindowPos 53833->53834 53834->53831 53836->53832 53837 44364c 53838 403494 4 API calls 53837->53838 53839 44367c 53838->53839 53840 443689 53839->53840 53841 4037b8 4 API calls 53839->53841 53842 403400 4 API calls 53840->53842 53844 4436aa 53841->53844 53843 4438b9 53842->53843 53844->53840 53845 431bd0 4 API calls 53844->53845 53846 44371d 53845->53846 53847 431ca0 4 API calls 53846->53847 53854 44373d 53846->53854 53847->53846 53848 44379a 53851 4437dc 53848->53851 53852 4437bb 53848->53852 53850 443780 53850->53848 53873 4435d0 LocalAlloc TlsSetValue TlsGetValue TlsGetValue 53850->53873 53857 442334 4 API calls 53851->53857 53861 442334 53852->53861 53854->53850 53872 4435d0 LocalAlloc TlsSetValue TlsGetValue TlsGetValue 53854->53872 53856 4437d8 53874 443610 LocalAlloc TlsSetValue TlsGetValue TlsGetValue 53856->53874 53857->53856 53859 44389c 53875 443620 LocalAlloc TlsSetValue TlsGetValue TlsGetValue 53859->53875 53862 443312 53861->53862 53863 44236d 53861->53863 53865 403400 4 API calls 53862->53865 53864 403400 4 API calls 53863->53864 53866 442375 53864->53866 53867 443327 53865->53867 53868 431bd0 4 API calls 53866->53868 53867->53856 53870 442381 53868->53870 53869 443302 53869->53856 53870->53869 53876 441a0c LocalAlloc TlsSetValue TlsGetValue TlsGetValue 53870->53876 53872->53854 53873->53848 53874->53859 53875->53840 53876->53870 53877 480441 53882 451004 53877->53882 53879 480455 53892 47f4f0 53879->53892 53881 480479 53883 451011 53882->53883 53885 451065 53883->53885 53898 408c0c LocalAlloc TlsSetValue TlsGetValue TlsGetValue 53883->53898 53886 450e88 InterlockedExchange 53885->53886 53887 451077 53886->53887 53889 45108d 53887->53889 53899 408c0c LocalAlloc TlsSetValue TlsGetValue TlsGetValue 53887->53899 53890 4510d0 53889->53890 53900 408c0c LocalAlloc TlsSetValue TlsGetValue TlsGetValue 53889->53900 53890->53879 53901 40b3c8 53892->53901 53894 47f512 53895 47f55d 53894->53895 53896 4069dc 4 API calls 53894->53896 53905 4764b4 53894->53905 53895->53881 53896->53894 53898->53885 53899->53889 53900->53890 53902 40b3d3 53901->53902 53903 40b3f3 53902->53903 53921 402678 LocalAlloc TlsSetValue TlsGetValue TlsGetValue 53902->53921 53903->53894 53907 4764e5 53905->53907 53909 47652e 53905->53909 53906 476579 53922 451294 53906->53922 53907->53909 53910 4038a4 4 API calls 53907->53910 53915 403744 4 API calls 53907->53915 53916 403450 4 API calls 53907->53916 53919 451294 21 API calls 53907->53919 53909->53906 53912 4038a4 4 API calls 53909->53912 53917 403744 4 API calls 53909->53917 53918 403450 4 API calls 53909->53918 53920 451294 21 API calls 53909->53920 53910->53907 53911 476590 53913 403420 4 API calls 53911->53913 53912->53909 53914 4765aa 53913->53914 53914->53894 53915->53907 53916->53907 53917->53909 53918->53909 53919->53907 53920->53909 53921->53903 53923 4512af 53922->53923 53927 4512a4 53922->53927 53928 451238 21 API calls 53923->53928 53925 4512ba 53925->53927 53929 408c0c LocalAlloc TlsSetValue TlsGetValue TlsGetValue 53925->53929 53927->53911 53928->53925 53929->53927 53930 423c0c 53935 423c42 53930->53935 53933 423cec 53936 423cf3 53933->53936 53937 423d27 53933->53937 53934 423c8d 53938 423c93 53934->53938 53939 423d50 53934->53939 53957 423c63 53935->53957 54024 423b68 53935->54024 53940 423cf9 53936->53940 53985 423fb1 53936->53985 53943 423d32 53937->53943 53944 42409a IsIconic 53937->53944 53941 423cc5 53938->53941 53942 423c98 53938->53942 53945 423d62 53939->53945 53946 423d6b 53939->53946 53948 423f13 SendMessageA 53940->53948 53949 423d07 53940->53949 53941->53957 53973 423cde 53941->53973 53974 423e3f 53941->53974 53951 423df6 53942->53951 53952 423c9e 53942->53952 53953 4240d6 53943->53953 53954 423d3b 53943->53954 53950 4240ae GetFocus 53944->53950 53944->53957 53955 423d78 53945->53955 53956 423d69 53945->53956 54038 424194 11 API calls 53946->54038 53948->53957 53949->53957 53976 423cc0 53949->53976 53977 423f56 53949->53977 53950->53957 53961 4240bf 53950->53961 54043 423b84 NtdllDefWindowProc_A 53951->54043 53962 423ca7 53952->53962 53963 423e1e PostMessageA 53952->53963 54056 424850 WinHelpA PostMessageA 53953->54056 53959 4240ed 53954->53959 53954->53976 53960 4241dc 11 API calls 53955->53960 54039 423b84 NtdllDefWindowProc_A 53956->54039 53971 4240f6 53959->53971 53972 42410b 53959->53972 53960->53957 54054 41eff4 GetCurrentThreadId EnumThreadWindows 53961->54054 53968 423cb0 53962->53968 53969 423ea5 53962->53969 54049 423b84 NtdllDefWindowProc_A 53963->54049 53980 423cb9 53968->53980 53981 423dce IsIconic 53968->53981 53982 423eae 53969->53982 53983 423edf 53969->53983 53970 423e39 53970->53957 54057 4244d4 53971->54057 54063 42452c LocalAlloc TlsSetValue TlsGetValue TlsGetValue SendMessageA 53972->54063 53973->53976 53986 423e0b 53973->53986 54028 423b84 NtdllDefWindowProc_A 53974->54028 53976->53957 54037 423b84 NtdllDefWindowProc_A 53976->54037 53977->53957 54012 423f78 IsWindowEnabled 53977->54012 53980->53976 53994 423d91 53980->53994 53987 423dea 53981->53987 53988 423dde 53981->53988 53995 423b14 5 API calls 53982->53995 54036 423b84 NtdllDefWindowProc_A 53983->54036 53985->53957 53996 423fd7 IsWindowEnabled 53985->53996 54044 424178 53986->54044 54042 423b84 NtdllDefWindowProc_A 53987->54042 54041 423bc0 15 API calls 53988->54041 53992 423e45 53999 423e83 53992->53999 54000 423e61 53992->54000 53993 4240ce SetFocus 53993->53957 53994->53957 54040 422c4c ShowWindow PostMessageA PostQuitMessage 53994->54040 54007 423eb6 53995->54007 53996->53957 54009 423fe5 53996->54009 54029 423a84 53999->54029 54003 423b14 5 API calls 54000->54003 54001 423ee5 54002 423efd 54001->54002 54010 41eea4 2 API calls 54001->54010 54011 423a84 6 API calls 54002->54011 54013 423e69 PostMessageA 54003->54013 54006 423ec8 54050 423b84 NtdllDefWindowProc_A 54006->54050 54007->54006 54015 41ef58 6 API calls 54007->54015 54016 423fec IsWindowVisible 54009->54016 54010->54002 54011->53957 54012->53957 54017 423f86 54012->54017 54013->53957 54015->54006 54016->53957 54018 423ffa GetFocus 54016->54018 54051 412310 7 API calls 54017->54051 54020 4181e0 54018->54020 54021 42400f SetFocus 54020->54021 54052 415240 54021->54052 54025 423b72 54024->54025 54026 423b7d 54024->54026 54025->54026 54064 408720 GetSystemDefaultLCID 54025->54064 54026->53933 54026->53934 54028->53992 54030 423a94 54029->54030 54032 423b0d PostMessageA 54029->54032 54031 423a9a EnumWindows 54030->54031 54030->54032 54031->54032 54033 423ab6 GetWindow GetWindowLongA 54031->54033 54127 423a1c GetWindow 54031->54127 54032->53957 54034 423ad5 54033->54034 54034->54032 54035 423b01 SetWindowPos 54034->54035 54035->54032 54035->54034 54036->54001 54037->53957 54038->53957 54039->53957 54040->53957 54041->53957 54042->53957 54043->53957 54130 41db30 54044->54130 54047 424190 54047->53957 54048 424184 LoadIconA 54048->54047 54049->53970 54050->53957 54051->53957 54053 41525b SetFocus 54052->54053 54053->53957 54055 41f022 54054->54055 54055->53957 54055->53993 54056->53970 54058 4244e0 54057->54058 54060 4244fa 54057->54060 54059 4244e7 SendMessageA 54058->54059 54062 42450f 54058->54062 54059->54062 54061 402648 4 API calls 54060->54061 54061->54062 54062->53957 54063->53970 54119 408568 GetLocaleInfoA 54064->54119 54067 403450 4 API calls 54068 408760 54067->54068 54069 408568 5 API calls 54068->54069 54070 408775 54069->54070 54071 408568 5 API calls 54070->54071 54072 408799 54071->54072 54125 4085b4 GetLocaleInfoA 54072->54125 54075 4085b4 GetLocaleInfoA 54076 4087c9 54075->54076 54077 408568 5 API calls 54076->54077 54078 4087e3 54077->54078 54079 4085b4 GetLocaleInfoA 54078->54079 54080 408800 54079->54080 54081 408568 5 API calls 54080->54081 54082 40881a 54081->54082 54083 403450 4 API calls 54082->54083 54084 408827 54083->54084 54085 408568 5 API calls 54084->54085 54120 4085a1 54119->54120 54121 40858f 54119->54121 54123 403494 4 API calls 54120->54123 54122 4034e0 4 API calls 54121->54122 54124 40859f 54122->54124 54123->54124 54124->54067 54126 4085d0 54125->54126 54126->54075 54128 423a3d GetWindowLongA 54127->54128 54129 423a49 54127->54129 54128->54129 54133 41db54 54130->54133 54134 41db3a 54133->54134 54135 41db61 54133->54135 54134->54047 54134->54048 54135->54134 54142 40ca80 LocalAlloc TlsSetValue TlsGetValue TlsGetValue LoadStringA 54135->54142 54137 41db7e 54137->54134 54138 41db98 54137->54138 54139 41db8b 54137->54139 54143 41bd8c 11 API calls 54138->54143 54144 41b388 LocalAlloc TlsSetValue TlsGetValue TlsGetValue LoadStringA 54139->54144 54142->54137 54143->54134 54144->54134 54145 416410 54146 416422 54145->54146 54147 416462 GetClassInfoA 54146->54147 54165 408d2c 19 API calls 54146->54165 54148 41648e 54147->54148 54149 4164b0 RegisterClassA 54148->54149 54150 4164a0 UnregisterClassA 54148->54150 54152 4164e9 54148->54152 54149->54152 54153 4164d8 54149->54153 54150->54149 54156 416506 54152->54156 54157 416517 54152->54157 54155 408cbc 5 API calls 54153->54155 54154 41645d 54154->54147 54155->54152 54156->54152 54158 408cbc 5 API calls 54156->54158 54166 407544 54157->54166 54158->54157 54162 416530 54163 41a1e8 5 API calls 54162->54163 54164 41653a 54163->54164 54165->54154 54167 407552 54166->54167 54168 407548 54166->54168 54170 418384 7 API calls 54167->54170 54169 402660 4 API calls 54168->54169 54169->54167 54170->54162 54171 498718 54229 403344 54171->54229 54173 498726 54232 4056a0 54173->54232 54175 49872b 54235 40631c GetModuleHandleA GetProcAddress 54175->54235 54179 498735 54243 40994c 54179->54243 54541 4032fc 54229->54541 54231 403349 GetModuleHandleA GetCommandLineA 54231->54173 54234 4056db 54232->54234 54542 4033bc LocalAlloc TlsSetValue TlsGetValue TlsGetValue 54232->54542 54234->54175 54236 406338 54235->54236 54237 40633f GetProcAddress 54235->54237 54236->54237 54238 406355 GetProcAddress 54237->54238 54239 40634e 54237->54239 54240 406364 SetProcessDEPPolicy 54238->54240 54241 406368 54238->54241 54239->54238 54240->54241 54242 4063c4 6F9C1CD0 54241->54242 54242->54179 54543 409024 54243->54543 54248 408720 7 API calls 54249 40996f 54248->54249 54558 409070 GetVersionExA 54249->54558 54541->54231 54542->54234 54544 408cbc 5 API calls 54543->54544 54545 409035 54544->54545 54546 4085dc GetSystemDefaultLCID 54545->54546 54550 408612 54546->54550 54547 406dec LocalAlloc TlsSetValue TlsGetValue TlsGetValue LoadStringA 54547->54550 54548 408568 LocalAlloc TlsSetValue TlsGetValue TlsGetValue GetLocaleInfoA 54548->54550 54549 403450 LocalAlloc TlsSetValue TlsGetValue TlsGetValue 54549->54550 54550->54547 54550->54548 54550->54549 54554 408674 54550->54554 54551 406dec LocalAlloc TlsSetValue TlsGetValue TlsGetValue LoadStringA 54551->54554 54552 408568 LocalAlloc TlsSetValue TlsGetValue TlsGetValue GetLocaleInfoA 54552->54554 54553 403450 LocalAlloc TlsSetValue TlsGetValue TlsGetValue 54553->54554 54554->54551 54554->54552 54554->54553 54555 4086f7 54554->54555 54556 403420 4 API calls 54555->54556 54557 408711 54556->54557 54557->54248 54559 409087 54558->54559 56012 4804db 56013 4804e4 56012->56013 56015 48050f 56012->56015 56014 480501 56013->56014 56013->56015 56364 476770 188 API calls 56014->56364 56017 48054e 56015->56017 56366 47ef88 LocalAlloc TlsSetValue TlsGetValue TlsGetValue 56015->56366 56016 480572 56026 4805ae 56016->56026 56027 480590 56016->56027 56017->56016 56020 480565 56017->56020 56021 480567 56017->56021 56030 47efcc 42 API calls 56020->56030 56368 47f060 42 API calls 56021->56368 56022 480506 56022->56015 56365 408be0 LocalAlloc TlsSetValue TlsGetValue TlsGetValue LoadStringA 56022->56365 56023 480541 56367 47eff0 42 API calls 56023->56367 56371 47ee20 24 API calls 56026->56371 56031 4805a5 56027->56031 56369 47eff0 42 API calls 56027->56369 56030->56016 56370 47ee20 24 API calls 56031->56370 56034 4805ac 56035 4805be 56034->56035 56036 4805c4 56034->56036 56037 4805c2 56035->56037 56041 47efcc 42 API calls 56035->56041 56036->56037 56039 47efcc 42 API calls 56036->56039 56138 47c15c 56037->56138 56039->56037 56041->56037 56139 42d898 GetWindowsDirectoryA 56138->56139 56140 47c180 56139->56140 56141 403450 4 API calls 56140->56141 56142 47c18d 56141->56142 56143 42d8c4 GetSystemDirectoryA 56142->56143 56144 47c195 56143->56144 56145 403450 4 API calls 56144->56145 56146 47c1a2 56145->56146 56147 42d8f0 6 API calls 56146->56147 56148 47c1aa 56147->56148 56149 403450 4 API calls 56148->56149 56150 47c1b7 56149->56150 56151 47c1c0 56150->56151 56152 47c1dc 56150->56152 56405 42d208 56151->56405 56154 403400 4 API calls 56152->56154 56155 47c1da 56154->56155 56157 47c221 56155->56157 56159 42c8cc 5 API calls 56155->56159 56385 47bfe4 56157->56385 56158 403450 4 API calls 56158->56155 56161 47c1fc 56159->56161 56163 403450 4 API calls 56161->56163 56364->56022 56366->56023 56367->56017 56368->56016 56369->56031 56370->56034 56371->56034 56386 42de1c RegOpenKeyExA 56385->56386 56406 4038a4 4 API calls 56405->56406 56407 42d21b 56406->56407 56408 42d232 GetEnvironmentVariableA 56407->56408 56412 42d245 56407->56412 56417 42dbd0 LocalAlloc TlsSetValue TlsGetValue TlsGetValue 56407->56417 56408->56407 56409 42d23e 56408->56409 56412->56158 56417->56407 57883 41ee54 57884 41ee63 IsWindowVisible 57883->57884 57885 41ee99 57883->57885 57884->57885 57886 41ee6d IsWindowEnabled 57884->57886 57886->57885 57887 41ee77 57886->57887 57888 402648 4 API calls 57887->57888 57889 41ee81 EnableWindow 57888->57889 57889->57885 57890 41fb58 57891 41fb61 57890->57891 57894 41fdfc 57891->57894 57893 41fb6e 57895 41feee 57894->57895 57896 41fe13 57894->57896 57895->57893 57896->57895 57915 41f9bc GetWindowLongA GetSystemMetrics GetSystemMetrics GetWindowLongA 57896->57915 57898 41fe49 57899 41fe73 57898->57899 57900 41fe4d 57898->57900 57925 41f9bc GetWindowLongA GetSystemMetrics GetSystemMetrics GetWindowLongA 57899->57925 57916 41fb9c 57900->57916 57904 41fe81 57906 41fe85 57904->57906 57907 41feab 57904->57907 57905 41fb9c 10 API calls 57909 41fe71 57905->57909 57910 41fb9c 10 API calls 57906->57910 57908 41fb9c 10 API calls 57907->57908 57911 41febd 57908->57911 57909->57893 57912 41fe97 57910->57912 57913 41fb9c 10 API calls 57911->57913 57914 41fb9c 10 API calls 57912->57914 57913->57909 57914->57909 57915->57898 57917 41fbb7 57916->57917 57918 41fbcd 57917->57918 57919 41f93c 4 API calls 57917->57919 57926 41f93c 57918->57926 57919->57918 57921 41fc15 57922 41fc38 SetScrollInfo 57921->57922 57934 41fa9c 57922->57934 57925->57904 57927 4181e0 57926->57927 57928 41f959 GetWindowLongA 57927->57928 57929 41f996 57928->57929 57930 41f976 57928->57930 57946 41f8c8 GetWindowLongA GetSystemMetrics GetSystemMetrics 57929->57946 57945 41f8c8 GetWindowLongA GetSystemMetrics GetSystemMetrics 57930->57945 57933 41f982 57933->57921 57935 41faaa 57934->57935 57936 41fab2 57934->57936 57935->57905 57937 41faef 57936->57937 57938 41faf1 57936->57938 57939 41fae1 57936->57939 57941 41fb31 GetScrollPos 57937->57941 57948 417e48 IsWindowVisible ScrollWindow SetWindowPos 57938->57948 57947 417e48 IsWindowVisible ScrollWindow SetWindowPos 57939->57947 57941->57935 57943 41fb3c 57941->57943 57944 41fb4b SetScrollPos 57943->57944 57944->57935 57945->57933 57946->57933 57947->57937 57948->57937 57949 420598 57950 4205ab 57949->57950 57970 415b30 57950->57970 57952 4205e6 57953 4206f2 57952->57953 57956 420651 57952->57956 57963 420642 MulDiv 57952->57963 57954 420709 57953->57954 57977 4146d4 KiUserCallbackDispatcher 57953->57977 57955 420720 57954->57955 57978 414718 KiUserCallbackDispatcher 57954->57978 57960 420742 57955->57960 57979 420060 12 API calls 57955->57979 57975 420848 20 API calls 57956->57975 57961 42066a 57961->57953 57976 420060 12 API calls 57961->57976 57974 41a304 LocalAlloc TlsSetValue TlsGetValue TlsGetValue DeleteObject 57963->57974 57966 420687 57967 4206a3 MulDiv 57966->57967 57968 4206c6 57966->57968 57967->57968 57968->57953 57969 4206cf MulDiv 57968->57969 57969->57953 57971 415b42 57970->57971 57980 414470 57971->57980 57973 415b5a 57973->57952 57974->57956 57975->57961 57976->57966 57977->57954 57978->57955 57979->57960 57981 41448a 57980->57981 57984 410458 57981->57984 57983 4144a0 57983->57973 57987 40dca4 57984->57987 57986 41045e 57986->57983 57988 40dd06 57987->57988 57989 40dcb7 57987->57989 57994 40dd14 57988->57994 57992 40dd14 19 API calls 57989->57992 57993 40dce1 57992->57993 57993->57986 57995 40dd24 57994->57995 57997 40dd3a 57995->57997 58006 40e09c 57995->58006 58022 40d5e0 57995->58022 58025 40df4c 57997->58025 58000 40dd42 58001 40d5e0 5 API calls 58000->58001 58002 40ddae 58000->58002 58028 40db60 58000->58028 58001->58000 58004 40df4c 5 API calls 58002->58004 58005 40dd10 58004->58005 58005->57986 58007 40e96c 5 API calls 58006->58007 58009 40e0d7 58007->58009 58008 403778 4 API calls 58008->58009 58009->58008 58010 40e18d 58009->58010 58096 40d774 LocalAlloc TlsSetValue TlsGetValue TlsGetValue LoadStringA 58009->58096 58097 40e080 LocalAlloc TlsSetValue TlsGetValue TlsGetValue LoadStringA 58009->58097 58011 40e1b7 58010->58011 58012 40e1a8 58010->58012 58093 40ba24 58011->58093 58042 40e3c0 58012->58042 58018 40e1b5 58019 403400 4 API calls 58018->58019 58020 40e25c 58019->58020 58020->57995 58023 40ea08 5 API calls 58022->58023 58024 40d5ea 58023->58024 58024->57995 58130 40d4bc 58025->58130 58029 40df54 5 API calls 58028->58029 58030 40db93 58029->58030 58031 40e96c 5 API calls 58030->58031 58032 40db9e 58031->58032 58033 40e96c 5 API calls 58032->58033 58034 40dba9 58033->58034 58035 40dbc4 58034->58035 58036 40dbbb 58034->58036 58041 40dbc1 58034->58041 58139 40d9d8 58035->58139 58142 40dac8 19 API calls 58036->58142 58039 403420 4 API calls 58040 40dc8f 58039->58040 58040->58000 58041->58039 58043 40e3f6 58042->58043 58044 40e3ec 58042->58044 58046 40e511 58043->58046 58047 40e495 58043->58047 58048 40e4f6 58043->58048 58049 40e576 58043->58049 58050 40e438 58043->58050 58051 40e4d9 58043->58051 58052 40e47a 58043->58052 58053 40e4bb 58043->58053 58086 40e45c 58043->58086 58099 40d440 LocalAlloc TlsSetValue TlsGetValue TlsGetValue LoadStringA 58044->58099 58061 40d764 5 API calls 58046->58061 58107 40de24 LocalAlloc TlsSetValue TlsGetValue TlsGetValue LoadStringA 58047->58107 58112 40e890 LocalAlloc TlsSetValue TlsGetValue TlsGetValue LoadStringA 58048->58112 58056 40d764 5 API calls 58049->58056 58100 40d764 58050->58100 58110 40e9a8 LocalAlloc TlsSetValue TlsGetValue TlsGetValue LoadStringA 58051->58110 58106 40d818 LocalAlloc TlsSetValue TlsGetValue TlsGetValue LoadStringA 58052->58106 58109 40dde4 LocalAlloc TlsSetValue TlsGetValue TlsGetValue LoadStringA 58053->58109 58055 403400 4 API calls 58063 40e5eb 58055->58063 58064 40e57e 58056->58064 58068 40e519 58061->58068 58063->58018 58069 40e582 58064->58069 58070 40e59b 58064->58070 58065 40e4e4 58111 409d38 LocalAlloc TlsSetValue TlsGetValue TlsGetValue 58065->58111 58067 40e4a0 58108 40d470 LocalAlloc TlsSetValue TlsGetValue TlsGetValue LoadStringA 58067->58108 58075 40e523 58068->58075 58076 40e51d 58068->58076 58078 40ea08 5 API calls 58069->58078 58119 40de24 LocalAlloc TlsSetValue TlsGetValue TlsGetValue LoadStringA 58070->58119 58072 40e461 58105 40ded8 LocalAlloc TlsSetValue TlsGetValue TlsGetValue LoadStringA 58072->58105 58073 40e444 58103 40de24 LocalAlloc TlsSetValue TlsGetValue TlsGetValue LoadStringA 58073->58103 58113 40ea08 58075->58113 58082 40e521 58076->58082 58083 40e53c 58076->58083 58078->58086 58117 40de24 LocalAlloc TlsSetValue TlsGetValue TlsGetValue LoadStringA 58082->58117 58084 40ea08 5 API calls 58083->58084 58087 40e544 58084->58087 58085 40e44f 58104 40e26c LocalAlloc TlsSetValue TlsGetValue TlsGetValue LoadStringA 58085->58104 58086->58055 58116 40d8a0 LocalAlloc TlsSetValue TlsGetValue TlsGetValue LoadStringA 58087->58116 58090 40e566 58118 40e2d4 LocalAlloc TlsSetValue TlsGetValue TlsGetValue 58090->58118 58125 40b9d0 58093->58125 58096->58009 58097->58009 58098 40d774 LocalAlloc TlsSetValue TlsGetValue TlsGetValue LoadStringA 58098->58018 58099->58043 58101 40ea08 5 API calls 58100->58101 58102 40d76e 58101->58102 58102->58072 58102->58073 58103->58085 58104->58086 58105->58086 58106->58086 58107->58067 58108->58086 58109->58086 58110->58065 58111->58086 58112->58086 58120 40d780 58113->58120 58116->58086 58117->58090 58118->58086 58119->58086 58123 40d78b 58120->58123 58121 40d7c5 58121->58086 58123->58121 58124 40d7cc LocalAlloc TlsSetValue TlsGetValue TlsGetValue LoadStringA 58123->58124 58124->58123 58126 40b9e2 58125->58126 58128 40ba07 58125->58128 58126->58128 58129 40ba84 LocalAlloc TlsSetValue TlsGetValue TlsGetValue 58126->58129 58128->58018 58128->58098 58129->58128 58131 40ea08 5 API calls 58130->58131 58132 40d4c9 58131->58132 58133 40d4dc 58132->58133 58137 40eb0c LocalAlloc TlsSetValue TlsGetValue TlsGetValue LoadStringA 58132->58137 58133->58000 58135 40d4d7 58138 40d458 LocalAlloc TlsSetValue TlsGetValue TlsGetValue LoadStringA 58135->58138 58137->58135 58138->58133 58143 40ab7c 19 API calls 58139->58143 58142->58041 58144 416a1c 58145 416a47 58144->58145 58146 416a2f 58144->58146 58158 416a42 58145->58158 58169 416990 PtInRect GetCapture 58145->58169 58147 416a31 58146->58147 58148 416a9a 58146->58148 58152 416a36 58147->58152 58153 416a64 58147->58153 58161 415270 58148->58161 58151 416ad1 58155 416b01 GetCapture 58152->58155 58152->58158 58153->58158 58160 421aec 6 API calls 58153->58160 58154 415270 59 API calls 58154->58151 58155->58158 58157 416aa3 58157->58151 58168 4168d0 PtInRect 58157->58168 58158->58151 58158->58154 58160->58158 58162 41527d 58161->58162 58163 4152e3 58162->58163 58164 4152d8 58162->58164 58167 4152e1 58162->58167 58170 424b8c 13 API calls 58163->58170 58164->58167 58171 41505c 46 API calls 58164->58171 58167->58157 58168->58151 58169->58158 58170->58167 58171->58167 58172 42285c 58173 42288c 58172->58173 58174 42286f 58172->58174 58176 4228c6 58173->58176 58177 422aa1 58173->58177 58180 422aff 58173->58180 58174->58173 58175 408cbc 5 API calls 58174->58175 58175->58173 58181 42291d 58176->58181 58212 4231a8 GetSystemMetrics 58176->58212 58178 422af3 58177->58178 58179 422ae9 58177->58179 58178->58180 58185 422b37 58178->58185 58186 422b18 58178->58186 58215 421e2c 11 API calls 58179->58215 58182 4229c9 58181->58182 58183 422a7c 58181->58183 58187 4229d5 58182->58187 58188 422a0b 58182->58188 58190 422a96 ShowWindow 58183->58190 58194 422b41 GetActiveWindow 58185->58194 58193 422b2f SetWindowPos 58186->58193 58195 4229df SendMessageA 58187->58195 58192 422a25 ShowWindow 58188->58192 58190->58180 58191 422961 58213 4231a0 GetSystemMetrics 58191->58213 58197 4181e0 58192->58197 58193->58180 58202 422b4c 58194->58202 58211 422b6b 58194->58211 58198 4181e0 58195->58198 58199 422a47 CallWindowProcA 58197->58199 58203 422a03 ShowWindow 58198->58203 58214 414cc4 58199->58214 58200 422b71 58207 422b88 SetWindowPos SetActiveWindow 58200->58207 58201 422b96 58208 422ba0 ShowWindow 58201->58208 58206 422b54 IsIconic 58202->58206 58204 422a5a SendMessageA 58203->58204 58204->58180 58209 422b5e 58206->58209 58206->58211 58207->58180 58208->58180 58210 41eff4 2 API calls 58209->58210 58210->58211 58211->58200 58211->58201 58212->58191 58213->58181 58214->58204 58215->58178 58216 4222e4 58217 4222f3 58216->58217 58222 421274 58217->58222 58220 422313 58223 4212e3 58222->58223 58237 421283 58222->58237 58226 4212f4 58223->58226 58247 4124d0 GetMenuItemCount GetMenuStringA GetMenuState 58223->58247 58225 421322 58229 421395 58225->58229 58235 42133d 58225->58235 58226->58225 58228 4213ba 58226->58228 58227 421393 58230 4213e6 58227->58230 58249 421e2c 11 API calls 58227->58249 58228->58227 58231 4213ce SetMenu 58228->58231 58229->58227 58236 4213a9 58229->58236 58250 4211bc 10 API calls 58230->58250 58231->58227 58234 4213ed 58234->58220 58245 4221e8 10 API calls 58234->58245 58235->58227 58240 421360 GetMenu 58235->58240 58239 4213b2 SetMenu 58236->58239 58237->58223 58246 408d2c 19 API calls 58237->58246 58239->58227 58241 421383 58240->58241 58242 42136a 58240->58242 58248 4124d0 GetMenuItemCount GetMenuStringA GetMenuState 58241->58248 58244 42137d SetMenu 58242->58244 58244->58241 58245->58220 58246->58237 58247->58226 58248->58227 58249->58230 58250->58234 58251 404d2a 58259 404d3a 58251->58259 58252 404e07 ExitProcess 58253 404de0 58267 404cf0 58253->58267 58254 404e12 58257 404cf0 4 API calls 58258 404df4 58257->58258 58271 401a90 58258->58271 58259->58252 58259->58253 58259->58254 58261 404db7 MessageBoxA 58259->58261 58262 404dcc 58259->58262 58261->58253 58283 40500c LocalAlloc TlsSetValue TlsGetValue TlsGetValue 58262->58283 58263 404df9 58263->58252 58263->58254 58269 404cfe 58267->58269 58268 404d13 58268->58257 58269->58268 58284 402728 LocalAlloc TlsSetValue TlsGetValue TlsGetValue 58269->58284 58272 401aa1 58271->58272 58273 401b6f 58271->58273 58274 401ac2 LocalFree 58272->58274 58275 401ab8 RtlEnterCriticalSection 58272->58275 58273->58263 58276 401af5 58274->58276 58275->58274 58277 401ae3 VirtualFree 58276->58277 58278 401afd 58276->58278 58277->58276 58279 401b24 LocalFree 58278->58279 58280 401b3b 58278->58280 58279->58279 58279->58280 58281 401b53 RtlLeaveCriticalSection 58280->58281 58282 401b5d RtlDeleteCriticalSection 58280->58282 58281->58282 58282->58263 58284->58268 58285 44b4a8 58286 44b4b6 58285->58286 58288 44b4d5 58285->58288 58287 44b38c 11 API calls 58286->58287 58286->58288 58287->58288 58289 4165ec DestroyWindow 58290 4915e4 58291 49161e 58290->58291 58292 49162a 58291->58292 58293 491620 58291->58293 58295 491639 58292->58295 58296 491662 58292->58296 58488 409098 MessageBeep 58293->58488 58298 446ff8 18 API calls 58295->58298 58301 49169a 58296->58301 58302 491671 58296->58302 58297 403420 4 API calls 58299 491c76 58297->58299 58300 491646 58298->58300 58303 403400 4 API calls 58299->58303 58304 406bb0 4 API calls 58300->58304 58311 4916a9 58301->58311 58312 4916d2 58301->58312 58305 446ff8 18 API calls 58302->58305 58306 491c7e 58303->58306 58307 491651 58304->58307 58308 49167e 58305->58308 58489 44734c LocalAlloc TlsSetValue TlsGetValue TlsGetValue VariantClear 58307->58489 58490 406c00 LocalAlloc TlsSetValue TlsGetValue TlsGetValue 58308->58490 58314 446ff8 18 API calls 58311->58314 58317 4916fa 58312->58317 58318 4916e1 58312->58318 58313 491689 58491 44734c LocalAlloc TlsSetValue TlsGetValue TlsGetValue VariantClear 58313->58491 58316 4916b6 58314->58316 58492 406c34 LocalAlloc TlsSetValue TlsGetValue TlsGetValue 58316->58492 58325 491709 58317->58325 58326 49172e 58317->58326 58494 407280 LocalAlloc TlsSetValue TlsGetValue TlsGetValue GetCurrentDirectoryA 58318->58494 58321 4916c1 58493 44734c LocalAlloc TlsSetValue TlsGetValue TlsGetValue VariantClear 58321->58493 58322 4916e9 58495 44734c LocalAlloc TlsSetValue TlsGetValue TlsGetValue VariantClear 58322->58495 58327 446ff8 18 API calls 58325->58327 58329 49173d 58326->58329 58330 491766 58326->58330 58328 491716 58327->58328 58331 4072a8 SetCurrentDirectoryA 58328->58331 58333 446ff8 18 API calls 58329->58333 58336 49179e 58330->58336 58337 491775 58330->58337 58332 49171e 58331->58332 58496 4470d0 LocalAlloc TlsSetValue TlsGetValue TlsGetValue VariantClear 58332->58496 58335 49174a 58333->58335 58338 42c804 5 API calls 58335->58338 58344 4917ad 58336->58344 58346 4917ea 58336->58346 58339 446ff8 18 API calls 58337->58339 58340 491755 58338->58340 58341 491782 58339->58341 58497 44734c LocalAlloc TlsSetValue TlsGetValue TlsGetValue VariantClear 58340->58497 58498 4071f8 8 API calls 58341->58498 58347 446ff8 18 API calls 58344->58347 58345 49178d 58499 44734c LocalAlloc TlsSetValue TlsGetValue TlsGetValue VariantClear 58345->58499 58351 4917f9 58346->58351 58352 491822 58346->58352 58349 4917bc 58347->58349 58353 446ff8 18 API calls 58349->58353 58350 491625 58350->58297 58354 446ff8 18 API calls 58351->58354 58358 49185a 58352->58358 58359 491831 58352->58359 58355 4917cd 58353->58355 58356 491806 58354->58356 58500 4912e8 8 API calls 58355->58500 58361 42c8a4 5 API calls 58356->58361 58368 491869 58358->58368 58369 491892 58358->58369 58362 446ff8 18 API calls 58359->58362 58360 4917d9 58501 44734c LocalAlloc TlsSetValue TlsGetValue TlsGetValue VariantClear 58360->58501 58364 491811 58361->58364 58365 49183e 58362->58365 58502 44734c LocalAlloc TlsSetValue TlsGetValue TlsGetValue VariantClear 58364->58502 58367 42c8cc 5 API calls 58365->58367 58370 491849 58367->58370 58371 446ff8 18 API calls 58368->58371 58374 4918ca 58369->58374 58375 4918a1 58369->58375 58503 44734c LocalAlloc TlsSetValue TlsGetValue TlsGetValue VariantClear 58370->58503 58373 491876 58371->58373 58504 42c8fc LocalAlloc TlsSetValue TlsGetValue TlsGetValue IsDBCSLeadByte 58373->58504 58382 4918d9 58374->58382 58383 491902 58374->58383 58377 446ff8 18 API calls 58375->58377 58379 4918ae 58377->58379 58378 491881 58505 44734c LocalAlloc TlsSetValue TlsGetValue TlsGetValue VariantClear 58378->58505 58381 42c92c 5 API calls 58379->58381 58384 4918b9 58381->58384 58385 446ff8 18 API calls 58382->58385 58389 49194e 58383->58389 58390 491911 58383->58390 58506 44734c LocalAlloc TlsSetValue TlsGetValue TlsGetValue VariantClear 58384->58506 58386 4918e6 58385->58386 58388 42c954 5 API calls 58386->58388 58391 4918f1 58388->58391 58395 49195d 58389->58395 58396 4919a0 58389->58396 58392 446ff8 18 API calls 58390->58392 58507 44734c LocalAlloc TlsSetValue TlsGetValue TlsGetValue VariantClear 58391->58507 58394 491920 58392->58394 58397 446ff8 18 API calls 58394->58397 58398 446ff8 18 API calls 58395->58398 58402 4919af 58396->58402 58403 491a13 58396->58403 58399 491931 58397->58399 58400 491970 58398->58400 58508 42c4f8 LocalAlloc TlsSetValue TlsGetValue TlsGetValue IsDBCSLeadByte 58399->58508 58404 446ff8 18 API calls 58400->58404 58477 446ff8 58402->58477 58411 491a52 58403->58411 58412 491a22 58403->58412 58407 491981 58404->58407 58405 49193d 58509 44734c LocalAlloc TlsSetValue TlsGetValue TlsGetValue VariantClear 58405->58509 58510 4914e0 12 API calls 58407->58510 58423 491a91 58411->58423 58424 491a61 58411->58424 58415 446ff8 18 API calls 58412->58415 58413 42c608 7 API calls 58416 4919ca 58413->58416 58414 49198f 58511 44734c LocalAlloc TlsSetValue TlsGetValue TlsGetValue VariantClear 58414->58511 58418 491a2f 58415->58418 58419 4919ce 58416->58419 58420 491a03 58416->58420 58421 452908 5 API calls 58418->58421 58426 491a3c 58421->58426 58432 491ad0 58423->58432 58433 491aa0 58423->58433 58428 446ff8 18 API calls 58424->58428 58514 4470d0 LocalAlloc TlsSetValue TlsGetValue TlsGetValue VariantClear 58426->58514 58431 491a6e 58428->58431 58435 452770 5 API calls 58431->58435 58441 491b18 58432->58441 58442 491adf 58432->58442 58437 446ff8 18 API calls 58433->58437 58436 491a7b 58435->58436 58515 4470d0 LocalAlloc TlsSetValue TlsGetValue TlsGetValue VariantClear 58436->58515 58440 491aad 58437->58440 58443 452e10 5 API calls 58440->58443 58449 491b60 58441->58449 58450 491b27 58441->58450 58444 446ff8 18 API calls 58442->58444 58445 491aba 58443->58445 58446 491aee 58444->58446 58516 4470d0 LocalAlloc TlsSetValue TlsGetValue TlsGetValue VariantClear 58445->58516 58448 446ff8 18 API calls 58446->58448 58451 491aff 58448->58451 58454 491b73 58449->58454 58461 491c29 58449->58461 58452 446ff8 18 API calls 58450->58452 58517 447278 LocalAlloc TlsSetValue TlsGetValue TlsGetValue VariantClear 58451->58517 58453 491b36 58452->58453 58455 446ff8 18 API calls 58453->58455 58458 446ff8 18 API calls 58454->58458 58456 491b47 58455->58456 58459 491ba0 58458->58459 58460 446ff8 18 API calls 58459->58460 58461->58350 58522 446f9c 58461->58522 58478 447000 58477->58478 58527 436078 58478->58527 58480 44701f 58480->58413 58488->58350 58489->58350 58490->58313 58491->58350 58492->58321 58493->58350 58494->58322 58495->58350 58496->58350 58497->58350 58498->58345 58499->58350 58500->58360 58501->58350 58502->58350 58503->58350 58504->58378 58505->58350 58506->58350 58507->58350 58508->58405 58509->58350 58510->58414 58511->58350 58514->58350 58515->58350 58516->58350 58517->58350 58523 446fa0 58522->58523 58550 435f9c 58523->58550 58528 436084 58527->58528 58538 4360a6 58527->58538 58528->58538 58547 408c0c LocalAlloc TlsSetValue TlsGetValue TlsGetValue 58528->58547 58529 436129 58549 408c0c LocalAlloc TlsSetValue TlsGetValue TlsGetValue 58529->58549 58531 436111 58537 403494 4 API calls 58531->58537 58532 436105 58532->58480 58533 4360f9 58542 403510 4 API calls 58533->58542 58534 4360ed 58540 403510 4 API calls 58534->58540 58535 43611d 58548 4040e8 18 API calls 58535->58548 58543 43611a 58537->58543 58538->58529 58538->58531 58538->58532 58538->58533 58538->58534 58538->58535 58545 4360f6 58540->58545 58541 43613a 58541->58480 58546 436102 58542->58546 58543->58480 58544 436126 58544->58480 58545->58480 58546->58480 58547->58538 58548->58544 58549->58541 58564 42e3ef SetErrorMode 58565 40cc34 58568 406f10 WriteFile 58565->58568 58569 406f2d 58568->58569 58570 4844fc 58571 484518 58570->58571 58572 484505 58570->58572 58576 44cb0c 7 API calls 58571->58576 58573 44cbdc 7 API calls 58572->58573 58575 484516 58573->58575 58576->58575 58577 48d9f0 58578 48da41 58577->58578 58579 48da6d 58578->58579 58580 48da43 58578->58580 58584 48da7c 58579->58584 58585 48daa6 58579->58585 58581 446ff8 18 API calls 58580->58581 58582 48da50 58581->58582 58583 452da0 5 API calls 58582->58583 58586 48da5d 58583->58586 58587 446ff8 18 API calls 58584->58587 58591 48dadf 58585->58591 58592 48dab5 58585->58592 59251 4470d0 LocalAlloc TlsSetValue TlsGetValue TlsGetValue VariantClear 58586->59251 58589 48da89 58587->58589 58590 452980 11 API calls 58589->58590 58593 48da96 58590->58593 58598 48daee 58591->58598 58599 48db53 58591->58599 58594 446ff8 18 API calls 58592->58594 59252 4470d0 LocalAlloc TlsSetValue TlsGetValue TlsGetValue VariantClear 58593->59252 58596 48dac2 58594->58596 58600 4529f0 11 API calls 58596->58600 58597 403420 4 API calls 58601 48f057 58597->58601 58602 446ff8 18 API calls 58598->58602 58608 48dbd8 58599->58608 58609 48db62 58599->58609 58603 48dacf 58600->58603 58604 403420 4 API calls 58601->58604 58605 48dafd 58602->58605 59253 4470d0 LocalAlloc TlsSetValue TlsGetValue TlsGetValue VariantClear 58603->59253 58607 48f064 58604->58607 58610 446ff8 18 API calls 58605->58610 58611 403400 4 API calls 58607->58611 58618 48dc43 58608->58618 58619 48dbe7 58608->58619 58612 446f9c 18 API calls 58609->58612 58613 48db14 58610->58613 58614 48f06c 58611->58614 58615 48db6e 58612->58615 58616 446ff8 18 API calls 58613->58616 58617 446f9c 18 API calls 58615->58617 58620 48db27 58616->58620 58621 48db7b 58617->58621 58627 48dc9f 58618->58627 58628 48dc52 58618->58628 58622 446ff8 18 API calls 58619->58622 58623 446ff8 18 API calls 58620->58623 58624 446ff8 18 API calls 58621->58624 58625 48dbf6 58622->58625 58626 48db38 58623->58626 58629 48db8b 58624->58629 58630 446ff8 18 API calls 58625->58630 59254 42cd94 6 API calls 58626->59254 58640 48dcae 58627->58640 58641 48dce7 58627->58641 58632 446ff8 18 API calls 58628->58632 58633 446ff8 18 API calls 58629->58633 58634 48dc09 58630->58634 58636 48dc61 58632->58636 58637 48db9e 58633->58637 58638 446ff8 18 API calls 58634->58638 58635 48db42 59255 44734c LocalAlloc TlsSetValue TlsGetValue TlsGetValue VariantClear 58635->59255 58642 446ff8 18 API calls 58636->58642 58643 446ff8 18 API calls 58637->58643 58644 48dc1a 58638->58644 58645 446ff8 18 API calls 58640->58645 58657 48dd56 58641->58657 58658 48dcf6 58641->58658 58646 48dc74 58642->58646 58647 48dbaf 58643->58647 59258 446f50 58644->59258 58649 48dcbd 58645->58649 58650 446ff8 18 API calls 58646->58650 58651 446f9c 18 API calls 58647->58651 58653 446ff8 18 API calls 58649->58653 58654 48dc85 58650->58654 58655 48dbbf 58651->58655 58660 48dcce 58653->58660 59264 42cfdc GetPrivateProfileStringA GetProfileStringA lstrcmp 58654->59264 59256 42ce98 6 API calls 58655->59256 58673 48ddc1 58657->58673 58674 48dd65 58657->58674 58659 446ff8 18 API calls 58658->58659 58665 48dd05 58659->58665 59266 42d028 GetPrivateProfileStringA GetProfileStringA 58660->59266 58663 48dc33 59263 4470d0 LocalAlloc TlsSetValue TlsGetValue TlsGetValue VariantClear 58663->59263 58670 446ff8 18 API calls 58665->58670 58667 48dc8f 59265 4470d0 LocalAlloc TlsSetValue TlsGetValue TlsGetValue VariantClear 58667->59265 58668 48dbc8 59257 447278 LocalAlloc TlsSetValue TlsGetValue TlsGetValue VariantClear 58668->59257 58676 48dd18 58670->58676 58671 48dcd7 59267 4470d0 LocalAlloc TlsSetValue TlsGetValue TlsGetValue VariantClear 58671->59267 58682 48de2c 58673->58682 58683 48ddd0 58673->58683 58675 446ff8 18 API calls 58674->58675 58678 48dd74 58675->58678 58679 446ff8 18 API calls 58676->58679 58680 446ff8 18 API calls 58678->58680 58681 48dd2b 58679->58681 58685 48dd87 58680->58685 58686 446ff8 18 API calls 58681->58686 58693 48de7a 58682->58693 58694 48de3b 58682->58694 58684 446ff8 18 API calls 58683->58684 58687 48dddf 58684->58687 58688 446ff8 18 API calls 58685->58688 58689 48dd3c 58686->58689 58690 446ff8 18 API calls 58687->58690 58691 48dd98 58688->58691 59268 42d098 WritePrivateProfileStringA WriteProfileStringA 58689->59268 58696 48ddf2 58690->58696 58697 446f9c 18 API calls 58691->58697 58706 48de89 58693->58706 58707 48deb4 58693->58707 58695 446ff8 18 API calls 58694->58695 58699 48de4a 58695->58699 58700 446ff8 18 API calls 58696->58700 58701 48dda8 58697->58701 58698 48dd46 59269 4470d0 LocalAlloc TlsSetValue TlsGetValue TlsGetValue VariantClear 58698->59269 58703 446ff8 18 API calls 58699->58703 58704 48de03 58700->58704 59270 42d108 21 API calls 58701->59270 58708 48de5b 58703->58708 58709 446f50 18 API calls 58704->58709 58711 446ff8 18 API calls 58706->58711 58717 48deec 58707->58717 58718 48dec3 58707->58718 58712 446ff8 18 API calls 58708->58712 58713 48de13 58709->58713 58710 48ddb1 59271 4470d0 LocalAlloc TlsSetValue TlsGetValue TlsGetValue VariantClear 58710->59271 58715 48de96 58711->58715 58716 48de6b 58712->58716 59272 42d168 21 API calls 58713->59272 58720 446ff8 18 API calls 58715->58720 59274 42d180 WritePrivateProfileStringA WriteProfileStringA 58716->59274 58729 48defb 58717->58729 58730 48df14 58717->58730 58722 446ff8 18 API calls 58718->58722 58724 48dea6 58720->58724 58726 48ded0 58722->58726 58723 48de1c 59273 4470d0 LocalAlloc TlsSetValue TlsGetValue TlsGetValue VariantClear 58723->59273 59275 42d1cc WritePrivateProfileStringA WriteProfileStringA 58724->59275 58728 42d208 5 API calls 58726->58728 58732 48dedb 58728->58732 58731 42d32c 5 API calls 58729->58731 58736 48df38 58730->58736 58737 48df23 58730->58737 58733 48df03 58731->58733 59276 44734c LocalAlloc TlsSetValue TlsGetValue TlsGetValue VariantClear 58732->59276 59277 44734c LocalAlloc TlsSetValue TlsGetValue TlsGetValue VariantClear 58733->59277 58741 48df6a 58736->58741 58742 48df47 58736->58742 58738 42d3f0 5 API calls 58737->58738 58739 48df28 58738->58739 59278 447278 LocalAlloc TlsSetValue TlsGetValue TlsGetValue VariantClear 58739->59278 58746 48df79 58741->58746 58747 48dfa2 58741->58747 58743 446f9c 18 API calls 58742->58743 58744 48df51 58743->58744 58745 42d44c 6 API calls 58744->58745 58748 48df59 58745->58748 58749 446ff8 18 API calls 58746->58749 58752 48dfda 58747->58752 58753 48dfb1 58747->58753 59279 44734c LocalAlloc TlsSetValue TlsGetValue TlsGetValue VariantClear 58748->59279 58751 48df86 58749->58751 58754 42c3fc 5 API calls 58751->58754 58760 48dfe9 58752->58760 58761 48e012 58752->58761 58755 446ff8 18 API calls 58753->58755 58756 48df91 58754->58756 58757 48dfbe 58755->58757 59280 44734c LocalAlloc TlsSetValue TlsGetValue TlsGetValue VariantClear 58756->59280 59281 42cb68 LocalAlloc TlsSetValue TlsGetValue TlsGetValue CharPrevA 58757->59281 58763 446ff8 18 API calls 58760->58763 58767 48e04a 58761->58767 58768 48e021 58761->58768 58762 48dfc9 59282 44734c LocalAlloc TlsSetValue TlsGetValue TlsGetValue VariantClear 58762->59282 58765 48dff6 58763->58765 58766 42cbc0 6 API calls 58765->58766 58769 48e001 58766->58769 58773 48e059 58767->58773 58774 48e082 58767->58774 58770 446ff8 18 API calls 58768->58770 59283 44734c LocalAlloc TlsSetValue TlsGetValue TlsGetValue VariantClear 58769->59283 58772 48e02e 58770->58772 59284 42d4e8 6 API calls 58772->59284 58776 446ff8 18 API calls 58773->58776 58781 48e0bf 58774->58781 58782 48e091 58774->58782 58778 48e066 58776->58778 58777 48e039 59285 44734c LocalAlloc TlsSetValue TlsGetValue TlsGetValue VariantClear 58777->59285 59286 42d540 LocalAlloc TlsSetValue TlsGetValue TlsGetValue CharPrevA 58778->59286 58787 48e0ce 58781->58787 58788 48e0e7 58781->58788 58784 446ff8 18 API calls 58782->58784 58783 48e071 58786 48e09e 58784->58786 59288 452b58 8 API calls 58786->59288 58790 42d898 GetWindowsDirectoryA 58787->58790 58795 48e10f 58788->58795 58796 48e0f6 58788->58796 58793 48e0d6 58790->58793 58791 48e0ae 59290 44734c LocalAlloc TlsSetValue TlsGetValue TlsGetValue VariantClear 58793->59290 58800 48e11e 58795->58800 58801 48e137 58795->58801 58797 42d8c4 GetSystemDirectoryA 58796->58797 58802 42d8f0 6 API calls 58800->58802 58805 48e164 58801->58805 58806 48e146 58801->58806 58839 48da68 58839->58597 59251->58839 59252->58839 59253->58839 59254->58635 59255->58839 59256->58668 59257->58839 59259 446f55 59258->59259 59367 435a40 59259->59367 59262 42cf2c 6 API calls 59262->58663 59263->58839 59264->58667 59265->58839 59266->58671 59267->58839 59268->58698 59269->58839 59270->58710 59271->58839 59272->58723 59273->58839 59274->58839 59275->58839 59276->58839 59277->58839 59278->58839 59279->58839 59280->58839 59281->58762 59282->58839 59283->58839 59284->58777 59285->58839 59286->58783 59288->58791 59290->58839 59368 435a80 59367->59368 59369 435a5e 59367->59369 59370 435b6a 59368->59370 59373 435b10 59368->59373 59374 435ad7 59368->59374 59369->59368 59386 408c0c LocalAlloc TlsSetValue TlsGetValue TlsGetValue 59369->59386 59391 408c0c LocalAlloc TlsSetValue TlsGetValue TlsGetValue 59370->59391 59376 435b5f 59373->59376 59377 435b1e 59373->59377 59375 403400 4 API calls 59374->59375 59378 435b95 59375->59378 59390 403f90 18 API calls 59376->59390 59387 40483c 18 API calls 59377->59387 59378->59262 59381 435b28 59382 435b33 59381->59382 59383 435b47 59381->59383 59388 40483c 18 API calls 59382->59388 59389 408c0c LocalAlloc TlsSetValue TlsGetValue TlsGetValue 59383->59389 59386->59368 59387->59381 59388->59374 59389->59374 59390->59374 59391->59374 59392 48f6b0 59393 48f6f2 59392->59393 59394 48f71d 59393->59394 59395 48f6f4 59393->59395 59398 48f7a9 59394->59398 59399 48f72c 59394->59399 59396 446ff8 18 API calls 59395->59396 59397 48f703 59396->59397 59400 4553b8 7 API calls 59397->59400 59408 48f7b8 59398->59408 59409 48f7f2 59398->59409 59401 446f50 18 API calls 59399->59401 59402 48f70b 59400->59402 59403 48f738 59401->59403 59648 4470d0 LocalAlloc TlsSetValue TlsGetValue TlsGetValue VariantClear 59402->59648 59406 48f77c 59403->59406 59407 48f73c 59403->59407 59405 48f718 59418 403420 4 API calls 59405->59418 59410 446ff8 18 API calls 59406->59410 59411 48f74f 59407->59411 59412 48f745 59407->59412 59413 446ff8 18 API calls 59408->59413 59420 48f801 59409->59420 59421 48f867 59409->59421 59414 48f78d 59410->59414 59416 446ff8 18 API calls 59411->59416 59649 453344 LocalAlloc TlsSetValue TlsGetValue TlsGetValue 59412->59649 59417 48f7d0 59413->59417 59652 454874 30 API calls 59414->59652 59422 48f760 59416->59422 59423 446f9c 18 API calls 59417->59423 59424 4900a8 59418->59424 59427 446f50 18 API calls 59420->59427 59436 48f8bf 59421->59436 59437 48f876 59421->59437 59650 454874 30 API calls 59422->59650 59429 48f7e0 59423->59429 59425 403400 4 API calls 59424->59425 59431 4900b0 59425->59431 59426 48f797 59653 4470d0 LocalAlloc TlsSetValue TlsGetValue TlsGetValue VariantClear 59426->59653 59433 48f80f 59427->59433 59654 455674 9 API calls 59429->59654 59438 446f50 18 API calls 59433->59438 59434 48f76a 59651 4470d0 LocalAlloc TlsSetValue TlsGetValue TlsGetValue VariantClear 59434->59651 59435 48f777 59435->59405 59444 48f8e9 59436->59444 59445 48f8ce 59436->59445 59440 446ff8 18 API calls 59437->59440 59441 48f81e 59438->59441 59442 48f88b 59440->59442 59443 446ff8 18 API calls 59441->59443 59446 446ff8 18 API calls 59442->59446 59447 48f836 59443->59447 59455 48f8f8 59444->59455 59456 48f935 59444->59456 59448 455560 5 API calls 59445->59448 59449 48f89e 59446->59449 59450 446f50 18 API calls 59447->59450 59451 48f8d6 59448->59451 59452 4537b0 11 API calls 59449->59452 59453 48f848 59450->59453 59657 44734c LocalAlloc TlsSetValue TlsGetValue TlsGetValue VariantClear 59451->59657 59457 48f8ac 59452->59457 59458 454100 20 API calls 59453->59458 59459 446ff8 18 API calls 59455->59459 59464 48f97c 59456->59464 59465 48f944 59456->59465 59656 44734c LocalAlloc TlsSetValue TlsGetValue TlsGetValue VariantClear 59457->59656 59461 48f855 59458->59461 59463 48f907 59459->59463 59655 4470d0 LocalAlloc TlsSetValue TlsGetValue TlsGetValue VariantClear 59461->59655 59658 454c40 26 API calls 59463->59658 59471 48f998 59464->59471 59472 48f98b 59464->59472 59661 48c764 18 API calls 59465->59661 59468 48f917 59659 4522e8 LocalAlloc TlsSetValue TlsGetValue TlsGetValue 59468->59659 59469 48f953 59662 4522e8 LocalAlloc TlsSetValue TlsGetValue TlsGetValue 59469->59662 59477 48f9e4 59471->59477 59478 48f9a7 59471->59478 59664 48c6b8 19 API calls 59472->59664 59473 48f922 59660 44734c LocalAlloc TlsSetValue TlsGetValue TlsGetValue VariantClear 59473->59660 59483 48fa2b 59477->59483 59484 48f9f3 59477->59484 59480 446ff8 18 API calls 59478->59480 59479 48f969 59663 44734c LocalAlloc TlsSetValue TlsGetValue TlsGetValue VariantClear 59479->59663 59482 48f9b6 59480->59482 59665 454ce8 26 API calls 59482->59665 59491 48fa3a 59483->59491 59492 48fa47 59483->59492 59668 48c764 18 API calls 59484->59668 59487 48f9c6 59666 431178 LocalAlloc TlsSetValue TlsGetValue TlsGetValue 59487->59666 59488 48fa02 59669 431178 LocalAlloc TlsSetValue TlsGetValue TlsGetValue 59488->59669 59490 48f9d1 59667 44734c LocalAlloc TlsSetValue TlsGetValue TlsGetValue VariantClear 59490->59667 59671 48c6b8 19 API calls 59491->59671 59496 48fa5a 59492->59496 59497 48fb1d 59492->59497 59499 446ff8 18 API calls 59496->59499 59502 48fb2c 59497->59502 59503 48fb47 59497->59503 59498 48fa18 59670 44734c LocalAlloc TlsSetValue TlsGetValue TlsGetValue VariantClear 59498->59670 59501 48fa6d 59499->59501 59504 455e0c 14 API calls 59501->59504 59505 45559c 5 API calls 59502->59505 59512 48fb5a 59503->59512 59516 48fbdc 59503->59516 59506 48fa7d 59504->59506 59507 48fb34 59505->59507 59508 48fb0b 59506->59508 59509 48fa85 59506->59509 59676 44734c LocalAlloc TlsSetValue TlsGetValue TlsGetValue VariantClear 59507->59676 59675 4470d0 LocalAlloc TlsSetValue TlsGetValue TlsGetValue VariantClear 59508->59675 59511 446f50 18 API calls 59509->59511 59520 48fa93 59511->59520 59514 446f50 18 API calls 59512->59514 59515 48fb65 59514->59515 59517 48fb69 59515->59517 59518 48fbac 59515->59518 59527 48fbfe 59516->59527 59539 48fd26 59516->59539 59519 48fb7c 59517->59519 59677 453344 LocalAlloc TlsSetValue TlsGetValue TlsGetValue 59517->59677 59521 446ff8 18 API calls 59518->59521 59523 446ff8 18 API calls 59519->59523 59672 4473b0 LocalAlloc TlsSetValue TlsGetValue TlsGetValue VariantClear 59520->59672 59524 48fbbb 59521->59524 59525 48fb8b 59523->59525 59528 446f50 18 API calls 59524->59528 59529 446f50 18 API calls 59525->59529 59526 48fc1e 59532 446ff8 18 API calls 59526->59532 59527->59526 59680 48c620 19 API calls 59527->59680 59533 48fbcd 59528->59533 59534 48fb9d 59529->59534 59536 48fc2d 59532->59536 59679 454528 29 API calls 59533->59679 59678 454528 29 API calls 59534->59678 59535 48fae8 59673 4473b0 LocalAlloc TlsSetValue TlsGetValue TlsGetValue VariantClear 59535->59673 59541 42c608 7 API calls 59536->59541 59549 48fe7e 59539->59549 59551 48fd48 59539->59551 59543 48fc3b 59541->59543 59542 48faf9 59674 4470d0 LocalAlloc TlsSetValue TlsGetValue TlsGetValue VariantClear 59542->59674 59544 48fd01 59543->59544 59545 48fc43 59543->59545 59683 4470d0 LocalAlloc TlsSetValue TlsGetValue TlsGetValue VariantClear 59544->59683 59547 42f560 14 API calls 59545->59547 59553 48fc4f 59547->59553 59559 48febb 59549->59559 59560 48fe8d 59549->59560 59550 48fd68 59554 446ff8 18 API calls 59550->59554 59551->59550 59685 48c620 19 API calls 59551->59685 59556 446ff8 18 API calls 59553->59556 59557 48fd79 59554->59557 59555 48fd0e 59684 447278 LocalAlloc TlsSetValue TlsGetValue TlsGetValue VariantClear 59555->59684 59561 48fc71 59556->59561 59562 42c608 7 API calls 59557->59562 59574 48feca 59559->59574 59575 48fef0 59559->59575 59563 446ff8 18 API calls 59560->59563 59565 48fd87 59562->59565 59566 48fe9c 59563->59566 59568 48fe59 59565->59568 59569 48fd8f 59565->59569 59570 454dd4 16 API calls 59566->59570 59687 4470d0 LocalAlloc TlsSetValue TlsGetValue TlsGetValue VariantClear 59568->59687 59572 42f560 14 API calls 59569->59572 59576 48fea9 59570->59576 59578 48fd9b 59572->59578 59580 4556d8 33 API calls 59574->59580 59586 48ff3a 59575->59586 59587 48feff 59575->59587 59689 4470d0 LocalAlloc TlsSetValue TlsGetValue TlsGetValue VariantClear 59576->59689 59583 446ff8 18 API calls 59578->59583 59579 48fe66 59688 447278 LocalAlloc TlsSetValue TlsGetValue TlsGetValue VariantClear 59579->59688 59585 48fed2 59580->59585 59690 4522e8 LocalAlloc TlsSetValue TlsGetValue TlsGetValue 59585->59690 59599 48ff49 59586->59599 59600 48ff85 59586->59600 59591 446ff8 18 API calls 59587->59591 59596 48ff0e 59591->59596 59594 48fedd 59691 44734c LocalAlloc TlsSetValue TlsGetValue TlsGetValue VariantClear 59594->59691 59601 446f50 18 API calls 59596->59601 59604 446f50 18 API calls 59599->59604 59614 49000f 59600->59614 59615 48ff94 59600->59615 59605 48ff20 59601->59605 59608 48ff57 59604->59608 59692 4554a8 26 API calls 59605->59692 59612 446ff8 18 API calls 59608->59612 59617 48ff67 59612->59617 59613 48ff28 59626 49001e 59614->59626 59635 49004a 59614->59635 59619 446f50 18 API calls 59615->59619 59621 446f50 18 API calls 59617->59621 59622 48ffb0 59619->59622 59623 446ff8 18 API calls 59622->59623 59627 48ffc2 59623->59627 59630 446ff8 18 API calls 59626->59630 59633 49002d 59630->59633 59637 446ff8 18 API calls 59633->59637 59635->59405 59639 446ff8 18 API calls 59635->59639 59643 490068 59639->59643 59645 446ff8 18 API calls 59643->59645 59648->59405 59649->59411 59650->59434 59651->59435 59652->59426 59653->59435 59654->59435 59655->59405 59656->59405 59657->59405 59658->59468 59659->59473 59660->59405 59661->59469 59662->59479 59663->59405 59664->59405 59665->59487 59666->59490 59667->59405 59668->59488 59669->59498 59670->59405 59671->59405 59672->59535 59673->59542 59674->59405 59675->59405 59676->59405 59677->59519 59678->59405 59679->59405 59680->59526 59683->59555 59684->59405 59685->59550 59687->59579 59688->59405 59689->59405 59690->59594 59691->59405 59692->59613 59699 416bf8 59702 4136f4 59699->59702 59701 416c04 59703 413724 59702->59703 59704 4136ff GetWindowThreadProcessId 59702->59704 59703->59701 59704->59703 59705 41370a GetCurrentProcessId 59704->59705 59705->59703 59706 413714 GetPropA 59705->59706 59706->59703 59707 41363c SetWindowLongA GetWindowLongA 59708 413699 SetPropA SetPropA 59707->59708 59709 41367b GetWindowLongA 59707->59709 59714 41f39c KiUserCallbackDispatcher 59708->59714 59709->59708 59710 41368a SetWindowLongA 59709->59710 59710->59708 59712 4136e9 59714->59712 59715 47c838 59716 47c843 59715->59716 59717 452908 5 API calls 59716->59717 59718 47c884 59716->59718 59719 47c859 GetLastError 59716->59719 59717->59716 59719->59718 59720 47c863 GetLastError 59719->59720 59720->59718 59721 47c86d GetTickCount 59720->59721 59721->59718 59722 47c87b Sleep 59721->59722 59722->59716

                                                                                                                                                                                                      Executed Functions

                                                                                                                                                                                                      Function 0048D9F0 Relevance: 138.4, APIs: 22, Strings: 56, Instructions: 1883COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                      • String ID: ADDBACKSLASH$ADDPERIOD$ADDQUOTES$CHARLENGTH$CONVERTPERCENTSTR$DELETEINIENTRY$DELETEINISECTION$DIREXISTS$FILECOPY$FILEEXISTS$FILEORDIREXISTS$FONTEXISTS$GETCMDTAIL$GETENV$GETINIBOOL$GETINIINT$GETINISTRING$GETSHORTNAME$GETSYSNATIVEDIR$GETSYSTEMDIR$GETSYSWOW64DIR$GETTEMPDIR$GETUILANGUAGE$GETWINDIR$INIKEYEXISTS$ISADMINLOGGEDON$ISINISECTIONEMPTY$ISPOWERUSERLOGGEDON$PARAMCOUNT$PARAMSTR$REGDELETEKEYIFEMPTY$REGDELETEKEYINCLUDINGSUBKEYS$REGDELETEVALUE$REGGETSUBKEYNAMES$REGGETVALUENAMES$REGKEYEXISTS$REGQUERYBINARYVALUE$REGQUERYDWORDVALUE$REGQUERYMULTISTRINGVALUE$REGQUERYSTRINGVALUE$REGVALUEEXISTS$REGWRITEBINARYVALUE$REGWRITEDWORDVALUE$REGWRITEEXPANDSTRINGVALUE$REGWRITEMULTISTRINGVALUE$REGWRITESTRINGVALUE$REMOVEBACKSLASH$REMOVEBACKSLASHUNLESSROOT$REMOVEQUOTES$SETINIBOOL$SETINIINT$SETINISTRING$SETNTFSCOMPRESSION$STRINGCHANGE$STRINGCHANGEEX$USINGWINNT
                                                                                                                                                                                                      • API String ID: 0-4234653879
                                                                                                                                                                                                      • Opcode ID: eda6cb1ab5b9bcad6d07cd3797869629dca565fde5cee0766de6f7858300ac3f
                                                                                                                                                                                                      • Instruction ID: 0a7367696f045dd65caf2204129730c4668569dd5f8684a104de3dc497ba1a28
                                                                                                                                                                                                      • Opcode Fuzzy Hash: eda6cb1ab5b9bcad6d07cd3797869629dca565fde5cee0766de6f7858300ac3f
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 0AD26270B002095BDB14FF7AD8815AEA7B5AF49704F60883FF451A7386DE38ED0A8759
                                                                                                                                                                                                      Function 0047051C Relevance: 78.0, APIs: 4, Strings: 40, Instructions: 965COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      • Non-default bitness: 32-bit, xrefs: 0047072F
                                                                                                                                                                                                      • @, xrefs: 00470624
                                                                                                                                                                                                      • Skipping due to "onlyifdestfileexists" flag., xrefs: 00470D6E
                                                                                                                                                                                                      • User opted not to strip the existing file's read-only attribute. Skipping., xrefs: 00470D0A
                                                                                                                                                                                                      • Installing the file., xrefs: 00470D7D
                                                                                                                                                                                                      • Time stamp of our file: %s, xrefs: 0047080F
                                                                                                                                                                                                      • Failed to read existing file's SHA-1 hash. Proceeding., xrefs: 00470B44
                                                                                                                                                                                                      • Existing file's SHA-1 hash matches our file. Skipping., xrefs: 00470B29
                                                                                                                                                                                                      • Version of existing file: (none), xrefs: 00470B6E
                                                                                                                                                                                                      • User opted not to overwrite the existing file. Skipping., xrefs: 00470CC1
                                                                                                                                                                                                      • Same version. Skipping., xrefs: 00470B59
                                                                                                                                                                                                      • Version of existing file: %u.%u.%u.%u, xrefs: 004709F0
                                                                                                                                                                                                      • Existing file is a newer version. Skipping., xrefs: 00470A76
                                                                                                                                                                                                      • Non-default bitness: 64-bit, xrefs: 00470723
                                                                                                                                                                                                      • Existing file's SHA-1 hash is different from our file. Proceeding., xrefs: 00470B38
                                                                                                                                                                                                      • Time stamp of our file: (failed to read), xrefs: 0047081B
                                                                                                                                                                                                      • Incrementing shared file count (32-bit)., xrefs: 00471419
                                                                                                                                                                                                      • Dest filename: %s, xrefs: 00470708
                                                                                                                                                                                                      • .tmp, xrefs: 00470E2B
                                                                                                                                                                                                      • , xrefs: 00470A43, 00470C14, 00470C92
                                                                                                                                                                                                      • Stripped read-only attribute., xrefs: 00470D3B
                                                                                                                                                                                                      • Version of our file: %u.%u.%u.%u, xrefs: 00470964
                                                                                                                                                                                                      • Dest file exists., xrefs: 0047082F
                                                                                                                                                                                                      • Couldn't read time stamp. Skipping., xrefs: 00470BA9
                                                                                                                                                                                                      • Existing file is protected by Windows File Protection. Skipping., xrefs: 00470C60
                                                                                                                                                                                                      • Existing file has a later time stamp. Skipping., xrefs: 00470C43
                                                                                                                                                                                                      • Time stamp of existing file: (failed to read), xrefs: 004708AB
                                                                                                                                                                                                      • Version of our file: (none), xrefs: 00470970
                                                                                                                                                                                                      • Dest file is protected by Windows File Protection., xrefs: 00470761
                                                                                                                                                                                                      • Time stamp of existing file: %s, xrefs: 0047089F
                                                                                                                                                                                                      • Installing into GAC, xrefs: 00471588
                                                                                                                                                                                                      • Incrementing shared file count (64-bit)., xrefs: 00471400
                                                                                                                                                                                                      • Same time stamp. Skipping., xrefs: 00470BC9
                                                                                                                                                                                                      • Skipping due to "onlyifdoesntexist" flag., xrefs: 00470842
                                                                                                                                                                                                      • Uninstaller requires administrator: %s, xrefs: 00471003
                                                                                                                                                                                                      • Will register the file (a type library) later., xrefs: 00471387
                                                                                                                                                                                                      • Will register the file (a DLL/OCX) later., xrefs: 00471393
                                                                                                                                                                                                      • InUn, xrefs: 00470FD3
                                                                                                                                                                                                      • Failed to strip read-only attribute., xrefs: 00470D47
                                                                                                                                                                                                      • -- File entry --, xrefs: 0047056F
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                      • String ID: $-- File entry --$.tmp$@$Couldn't read time stamp. Skipping.$Dest file exists.$Dest file is protected by Windows File Protection.$Dest filename: %s$Existing file has a later time stamp. Skipping.$Existing file is a newer version. Skipping.$Existing file is protected by Windows File Protection. Skipping.$Existing file's SHA-1 hash is different from our file. Proceeding.$Existing file's SHA-1 hash matches our file. Skipping.$Failed to read existing file's SHA-1 hash. Proceeding.$Failed to strip read-only attribute.$InUn$Incrementing shared file count (32-bit).$Incrementing shared file count (64-bit).$Installing into GAC$Installing the file.$Non-default bitness: 32-bit$Non-default bitness: 64-bit$Same time stamp. Skipping.$Same version. Skipping.$Skipping due to "onlyifdestfileexists" flag.$Skipping due to "onlyifdoesntexist" flag.$Stripped read-only attribute.$Time stamp of existing file: %s$Time stamp of existing file: (failed to read)$Time stamp of our file: %s$Time stamp of our file: (failed to read)$Uninstaller requires administrator: %s$User opted not to overwrite the existing file. Skipping.$User opted not to strip the existing file's read-only attribute. Skipping.$Version of existing file: %u.%u.%u.%u$Version of existing file: (none)$Version of our file: %u.%u.%u.%u$Version of our file: (none)$Will register the file (a DLL/OCX) later.$Will register the file (a type library) later.
                                                                                                                                                                                                      • API String ID: 0-4021121268
                                                                                                                                                                                                      • Opcode ID: 02e86e9558c3babbdfdd30fce75e81f67e315e8861ab5fe6a0b3992524575cbe
                                                                                                                                                                                                      • Instruction ID: b563e12d89f4af072a7005ff78b426759e5259748c8527a90f65f129335a0b73
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 02e86e9558c3babbdfdd30fce75e81f67e315e8861ab5fe6a0b3992524575cbe
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 0B925234A0424CDFDB11DFA9C485BDDBBB5AF05308F1480ABE848A7392D778AE45CB59
                                                                                                                                                                                                      Function 0042E09C Relevance: 33.4, APIs: 16, Strings: 3, Instructions: 178memorylibraryloaderCOMMON
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                      control_flow_graph 2655 42e09c-42e0ad 2656 42e0b8-42e0dd AllocateAndInitializeSid 2655->2656 2657 42e0af-42e0b3 2655->2657 2658 42e0e3-42e100 GetVersion 2656->2658 2659 42e287-42e28f 2656->2659 2657->2659 2660 42e102-42e117 GetModuleHandleA GetProcAddress 2658->2660 2661 42e119-42e11b 2658->2661 2660->2661 2662 42e142-42e15c GetCurrentThread OpenThreadToken 2661->2662 2663 42e11d-42e12b CheckTokenMembership 2661->2663 2666 42e193-42e1bb GetTokenInformation 2662->2666 2667 42e15e-42e168 GetLastError 2662->2667 2664 42e131-42e13d 2663->2664 2665 42e269-42e27f FreeSid 2663->2665 2664->2665 2670 42e1d6-42e1fa call 402648 GetTokenInformation 2666->2670 2671 42e1bd-42e1c5 GetLastError 2666->2671 2668 42e174-42e187 GetCurrentProcess OpenProcessToken 2667->2668 2669 42e16a-42e16f call 4031bc 2667->2669 2668->2666 2675 42e189-42e18e call 4031bc 2668->2675 2669->2659 2681 42e208-42e210 2670->2681 2682 42e1fc-42e206 call 4031bc * 2 2670->2682 2671->2670 2672 42e1c7-42e1d1 call 4031bc * 2 2671->2672 2672->2659 2675->2659 2686 42e212-42e213 2681->2686 2687 42e243-42e261 call 402660 CloseHandle 2681->2687 2682->2659 2691 42e215-42e228 EqualSid 2686->2691 2692 42e22a-42e237 2691->2692 2693 42e23f-42e241 2691->2693 2692->2693 2696 42e239-42e23d 2692->2696 2693->2687 2693->2691 2696->2687
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • AllocateAndInitializeSid.ADVAPI32(00499788,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0042E0D6
                                                                                                                                                                                                      • GetVersion.KERNEL32(00000000,0042E280,?,00499788,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0042E0F3
                                                                                                                                                                                                      • GetModuleHandleA.KERNEL32(advapi32.dll,CheckTokenMembership,00000000,0042E280,?,00499788,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0042E10C
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,advapi32.dll), ref: 0042E112
                                                                                                                                                                                                      • CheckTokenMembership.KERNELBASE(00000000,00000000,?,00000000,0042E280,?,00499788,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0042E127
                                                                                                                                                                                                      • FreeSid.ADVAPI32(00000000,0042E287,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0042E27A
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: AddressAllocateCheckFreeHandleInitializeMembershipModuleProcTokenVersion
                                                                                                                                                                                                      • String ID: 1{I$CheckTokenMembership$advapi32.dll
                                                                                                                                                                                                      • API String ID: 2252812187-4020693264
                                                                                                                                                                                                      • Opcode ID: 3fdce64b02ef6b05bf0689361cc85ba47b0238c2ef81d3d22328f3774a2b754b
                                                                                                                                                                                                      • Instruction ID: e5677345bf142a8b1d9111380f95962c8bb8cf61ba8e960ca5c3fd0f127139eb
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 3fdce64b02ef6b05bf0689361cc85ba47b0238c2ef81d3d22328f3774a2b754b
                                                                                                                                                                                                      • Instruction Fuzzy Hash: E351A271B44215EEEB10EAE69C42BBF77ACEB09704F9404BBB901F7281D57C99018B79
                                                                                                                                                                                                      Function 004502C0 Relevance: 26.3, APIs: 8, Strings: 7, Instructions: 45libraryloaderCOMMON
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                      control_flow_graph 2719 4502c0-4502cd 2720 4502d3-4502e0 GetVersion 2719->2720 2721 45037c-450386 2719->2721 2720->2721 2722 4502e6-4502fc LoadLibraryA 2720->2722 2722->2721 2723 4502fe-450377 GetProcAddress * 6 2722->2723 2723->2721
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetVersion.KERNEL32(00480636), ref: 004502D3
                                                                                                                                                                                                      • LoadLibraryA.KERNEL32(Rstrtmgr.dll,00480636), ref: 004502EB
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,RmStartSession), ref: 00450309
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,RmRegisterResources), ref: 0045031E
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,RmGetList), ref: 00450333
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,RmShutdown), ref: 00450348
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,RmRestart), ref: 0045035D
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,RmEndSession), ref: 00450372
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: AddressProc$LibraryLoadVersion
                                                                                                                                                                                                      • String ID: RmEndSession$RmGetList$RmRegisterResources$RmRestart$RmShutdown$RmStartSession$Rstrtmgr.dll
                                                                                                                                                                                                      • API String ID: 1968650500-3419246398
                                                                                                                                                                                                      • Opcode ID: 2681632e5309952c30eea3f8c2bf2722b4339596373eceda0d07b93e3cd0d7e4
                                                                                                                                                                                                      • Instruction ID: c77cef2ad5653e61b65a4477cbb73d0d56cf7b8a9d174f96be3e9b6947252677
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 2681632e5309952c30eea3f8c2bf2722b4339596373eceda0d07b93e3cd0d7e4
                                                                                                                                                                                                      • Instruction Fuzzy Hash: B211F7B4510301DBD710FB61BF45A2E36E9E728315B08063FE804961A2CB7C4844CF8C
                                                                                                                                                                                                      Function 00423C0C Relevance: 21.4, APIs: 14, Instructions: 395COMMON
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                      control_flow_graph 3074 423c0c-423c40 3075 423c42-423c43 3074->3075 3076 423c74-423c8b call 423b68 3074->3076 3078 423c45-423c61 call 40b24c 3075->3078 3081 423cec-423cf1 3076->3081 3082 423c8d 3076->3082 3111 423c63-423c6b 3078->3111 3112 423c70-423c72 3078->3112 3084 423cf3 3081->3084 3085 423d27-423d2c 3081->3085 3086 423c93-423c96 3082->3086 3087 423d50-423d60 3082->3087 3088 423fb1-423fb9 3084->3088 3089 423cf9-423d01 3084->3089 3092 423d32-423d35 3085->3092 3093 42409a-4240a8 IsIconic 3085->3093 3090 423cc5-423cc8 3086->3090 3091 423c98 3086->3091 3094 423d62-423d67 3087->3094 3095 423d6b-423d73 call 424194 3087->3095 3100 424152-42415a 3088->3100 3106 423fbf-423fca call 4181e0 3088->3106 3098 423f13-423f3a SendMessageA 3089->3098 3099 423d07-423d0c 3089->3099 3107 423da9-423db0 3090->3107 3108 423cce-423ccf 3090->3108 3102 423df6-423e06 call 423b84 3091->3102 3103 423c9e-423ca1 3091->3103 3104 4240d6-4240eb call 424850 3092->3104 3105 423d3b-423d3c 3092->3105 3093->3100 3101 4240ae-4240b9 GetFocus 3093->3101 3109 423d78-423d80 call 4241dc 3094->3109 3110 423d69-423d8c call 423b84 3094->3110 3095->3100 3098->3100 3113 423d12-423d13 3099->3113 3114 42404a-424055 3099->3114 3115 424171-424177 3100->3115 3101->3100 3122 4240bf-4240c8 call 41eff4 3101->3122 3102->3100 3123 423ca7-423caa 3103->3123 3124 423e1e-423e3a PostMessageA call 423b84 3103->3124 3104->3100 3117 423d42-423d45 3105->3117 3118 4240ed-4240f4 3105->3118 3106->3100 3167 423fd0-423fdf call 4181e0 IsWindowEnabled 3106->3167 3107->3100 3127 423db6-423dbd 3107->3127 3128 423cd5-423cd8 3108->3128 3129 423f3f-423f46 3108->3129 3109->3100 3110->3100 3111->3115 3112->3076 3112->3078 3130 424072-42407d 3113->3130 3131 423d19-423d1c 3113->3131 3114->3100 3133 42405b-42406d 3114->3133 3134 424120-424127 3117->3134 3135 423d4b 3117->3135 3144 4240f6-424109 call 4244d4 3118->3144 3145 42410b-42411e call 42452c 3118->3145 3122->3100 3182 4240ce-4240d4 SetFocus 3122->3182 3141 423cb0-423cb3 3123->3141 3142 423ea5-423eac 3123->3142 3124->3100 3127->3100 3147 423dc3-423dc9 3127->3147 3148 423cde-423ce1 3128->3148 3149 423e3f-423e5f call 423b84 3128->3149 3129->3100 3137 423f4c-423f51 call 404e54 3129->3137 3130->3100 3156 424083-424095 3130->3156 3153 423d22 3131->3153 3154 423f56-423f5e 3131->3154 3133->3100 3151 42413a-424149 3134->3151 3152 424129-424138 3134->3152 3155 42414b-42414c call 423b84 3135->3155 3137->3100 3162 423cb9-423cba 3141->3162 3163 423dce-423ddc IsIconic 3141->3163 3164 423eae-423ec1 call 423b14 3142->3164 3165 423edf-423ef0 call 423b84 3142->3165 3144->3100 3145->3100 3147->3100 3168 423ce7 3148->3168 3169 423e0b-423e19 call 424178 3148->3169 3195 423e83-423ea0 call 423a84 PostMessageA 3149->3195 3196 423e61-423e7e call 423b14 PostMessageA 3149->3196 3151->3100 3152->3100 3153->3155 3154->3100 3180 423f64-423f6b 3154->3180 3191 424151 3155->3191 3156->3100 3183 423cc0 3162->3183 3184 423d91-423d99 3162->3184 3173 423dea-423df1 call 423b84 3163->3173 3174 423dde-423de5 call 423bc0 3163->3174 3208 423ed3-423eda call 423b84 3164->3208 3209 423ec3-423ecd call 41ef58 3164->3209 3202 423ef2-423ef8 call 41eea4 3165->3202 3203 423f06-423f0e call 423a84 3165->3203 3167->3100 3199 423fe5-423ff4 call 4181e0 IsWindowVisible 3167->3199 3168->3155 3169->3100 3173->3100 3174->3100 3180->3100 3194 423f71-423f80 call 4181e0 IsWindowEnabled 3180->3194 3182->3100 3183->3155 3184->3100 3197 423d9f-423da4 call 422c4c 3184->3197 3191->3100 3194->3100 3224 423f86-423f9c call 412310 3194->3224 3195->3100 3196->3100 3197->3100 3199->3100 3225 423ffa-424045 GetFocus call 4181e0 SetFocus call 415240 SetFocus 3199->3225 3222 423efd-423f00 3202->3222 3203->3100 3208->3100 3209->3208 3222->3203 3224->3100 3230 423fa2-423fac 3224->3230 3225->3100 3230->3100
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                                      • Opcode ID: 73629d951967d7041b072be22cee358665a57f100223cceaa32614d05fdc63d3
                                                                                                                                                                                                      • Instruction ID: afb4f91cf4018cf9acc1c9974f14325182323c15c0e0405bd0f9b005e596376e
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 73629d951967d7041b072be22cee358665a57f100223cceaa32614d05fdc63d3
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 03E1AE31700124EFDB04DF69E989AADB7B5FB54300FA440AAE5559B352C73CEE81DB09
                                                                                                                                                                                                      Function 00456564 Relevance: 21.3, APIs: 4, Strings: 8, Instructions: 282comCOMMON
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                      control_flow_graph 3233 456564-456592 3234 456594-4565ab CoCreateInstance 3233->3234 3235 4565ad 3233->3235 3236 4565b2-4565b4 3234->3236 3235->3236 3237 4565b6-4565d3 CoCreateInstance 3236->3237 3238 4565e1-456626 call 403738 * 2 3236->3238 3237->3238 3240 4565d5-4565dc call 4534b0 3237->3240 3247 456633-456635 3238->3247 3248 456628-45662e call 456388 3238->3248 3240->3238 3250 456637-456647 call 403738 3247->3250 3251 45664c-45665b 3247->3251 3248->3247 3250->3251 3255 45665d-456669 call 403738 3251->3255 3256 45666e-456673 3251->3256 3255->3256 3258 456675-45667e 3256->3258 3259 456683-45668a call 456378 3256->3259 3258->3259 3263 456690-456698 3259->3263 3264 4567b3-4567c6 3259->3264 3265 4566a4-4566b7 3263->3265 3266 45669a-45669e 3263->3266 3269 4567d4-4567d8 3264->3269 3270 4567c8-4567cf call 4534b0 3264->3270 3271 4566c5-4566c9 3265->3271 3272 4566b9-4566c0 call 4534b0 3265->3272 3266->3264 3266->3265 3274 4567fd-456805 call 403ca4 3269->3274 3275 4567da-4567e1 call 456358 3269->3275 3270->3269 3278 4566f9-4566fb 3271->3278 3279 4566cb-4566eb 3271->3279 3272->3271 3285 456808-45680c 3274->3285 3275->3274 3289 4567e3-4567fb call 42c4f8 call 403ca4 3275->3289 3283 456766-45676a 3278->3283 3284 4566fd-456711 call 403ca4 3278->3284 3279->3278 3293 4566ed-4566f4 call 4534b0 3279->3293 3287 45676c-45678c 3283->3287 3288 45679a-4567a5 3283->3288 3301 456713 call 408c00 3284->3301 3302 456718-45673a 3284->3302 3291 456813-45681d 3285->3291 3292 45680e call 408c00 3285->3292 3287->3288 3304 45678e-456795 call 4534b0 3287->3304 3288->3264 3306 4567a7-4567ae call 4534b0 3288->3306 3289->3285 3303 456822-456824 3291->3303 3292->3291 3293->3278 3301->3302 3314 45673c-456743 call 4534b0 3302->3314 3315 456748-45675e SysFreeString 3302->3315 3310 456826-45682d call 4534b0 3303->3310 3311 456832-456851 call 45647c 3303->3311 3304->3288 3306->3264 3310->3311 3320 456853-456857 SysFreeString 3311->3320 3321 45685c-456860 3311->3321 3314->3315 3320->3321 3322 456862-456866 3321->3322 3323 45686b-45686f 3321->3323 3322->3323 3324 456871-456875 3323->3324 3325 45687a-456883 3323->3325 3324->3325
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • CoCreateInstance.OLE32(00499A74,00000000,00000001,00499774,?,00000000,004568A1), ref: 004565A6
                                                                                                                                                                                                      • CoCreateInstance.OLE32(00499764,00000000,00000001,00499774,?,00000000,004568A1), ref: 004565CC
                                                                                                                                                                                                      • SysFreeString.OLEAUT32(?), ref: 00456759
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      • IShellLink::QueryInterface(IID_IPropertyStore), xrefs: 004566BB
                                                                                                                                                                                                      • IPersistFile::Save, xrefs: 00456828
                                                                                                                                                                                                      • IShellLink::QueryInterface(IID_IPersistFile), xrefs: 004567CA
                                                                                                                                                                                                      • CoCreateInstance, xrefs: 004565D7
                                                                                                                                                                                                      • IPropertyStore::SetValue(PKEY_AppUserModel_ID), xrefs: 0045673E
                                                                                                                                                                                                      • IPropertyStore::SetValue(PKEY_AppUserModel_ExcludeFromShowInNewInstall), xrefs: 00456790
                                                                                                                                                                                                      • IPropertyStore::Commit, xrefs: 004567A9
                                                                                                                                                                                                      • IPropertyStore::SetValue(PKEY_AppUserModel_PreventPinning), xrefs: 004566EF
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CreateInstance$FreeString
                                                                                                                                                                                                      • String ID: CoCreateInstance$IPersistFile::Save$IPropertyStore::Commit$IPropertyStore::SetValue(PKEY_AppUserModel_ExcludeFromShowInNewInstall)$IPropertyStore::SetValue(PKEY_AppUserModel_ID)$IPropertyStore::SetValue(PKEY_AppUserModel_PreventPinning)$IShellLink::QueryInterface(IID_IPersistFile)$IShellLink::QueryInterface(IID_IPropertyStore)
                                                                                                                                                                                                      • API String ID: 308859552-3936712486
                                                                                                                                                                                                      • Opcode ID: c7f56109ac25412a34e90e84d93073be77b1fd03a977c51cd4d344b59776dac1
                                                                                                                                                                                                      • Instruction ID: 8ea5dda7a560ded85d07eb9974ca036a449deae5e5e286e87ef099e1c3d3d79c
                                                                                                                                                                                                      • Opcode Fuzzy Hash: c7f56109ac25412a34e90e84d93073be77b1fd03a977c51cd4d344b59776dac1
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 70A12171A00105AFDB50DFA9C885BAE77F8EF09306F55406AF904E7262DB38DD48CB69
                                                                                                                                                                                                      Function 0042285C Relevance: 18.3, APIs: 12, Instructions: 255windowCOMMON
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                      control_flow_graph 3493 42285c-42286d 3494 422891-4228b0 3493->3494 3495 42286f-422879 3493->3495 3497 422ba6-422bbd 3494->3497 3498 4228b6-4228c0 3494->3498 3495->3494 3496 42287b-42288c call 408cbc call 40311c 3495->3496 3496->3494 3500 422aa1-422ae7 call 402c00 3498->3500 3501 4228c6-42290b call 402c00 3498->3501 3512 422af3-422afd 3500->3512 3513 422ae9-422aee call 421e2c 3500->3513 3510 422911-42291b 3501->3510 3511 4229af-4229c3 3501->3511 3516 422957-42296b call 4231a8 3510->3516 3517 42291d-422934 call 4146bc 3510->3517 3518 4229c9-4229d3 3511->3518 3519 422a7c-422a9c call 4181e0 ShowWindow 3511->3519 3514 422aff-422b07 call 4166b0 3512->3514 3515 422b0c-422b16 3512->3515 3513->3512 3514->3497 3523 422b37-422b4a call 4181e0 GetActiveWindow 3515->3523 3524 422b18-422b35 call 4181e0 SetWindowPos 3515->3524 3543 422970-422984 call 4231a0 3516->3543 3544 42296d 3516->3544 3538 422936 3517->3538 3539 422939-422950 call 414700 3517->3539 3526 4229d5-422a09 call 4181e0 SendMessageA call 4181e0 ShowWindow 3518->3526 3527 422a0b-422a55 call 4181e0 ShowWindow call 4181e0 CallWindowProcA call 414cc4 3518->3527 3519->3497 3548 422b4c-422b5c call 4181e0 IsIconic 3523->3548 3549 422b6d-422b6f 3523->3549 3524->3497 3558 422a5a-422a77 SendMessageA 3526->3558 3527->3558 3538->3539 3560 422989-42298b 3539->3560 3564 422952-422955 3539->3564 3559 422986 3543->3559 3543->3560 3544->3543 3548->3549 3570 422b5e-422b6b call 4181e0 call 41eff4 3548->3570 3553 422b71-422b94 call 4181e0 SetWindowPos SetActiveWindow 3549->3553 3554 422b96-422ba1 call 4181e0 ShowWindow 3549->3554 3553->3497 3554->3497 3558->3497 3559->3560 3566 42298f-422991 3560->3566 3567 42298d 3560->3567 3564->3560 3571 422993 3566->3571 3572 422995-4229aa 3566->3572 3567->3566 3570->3549 3571->3572 3572->3511
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • SendMessageA.USER32(00000000,00000223,00000000,00000000), ref: 004229F4
                                                                                                                                                                                                      • ShowWindow.USER32(00000000,00000003,00000000,00000223,00000000,00000000,00000000,00422BBE), ref: 00422A04
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: MessageSendShowWindow
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 1631623395-0
                                                                                                                                                                                                      • Opcode ID: 1979ff772ff0fab5ce447f3cb23b8cf2d6b9a018f2cb5cdd5f7bee6f6eaf168b
                                                                                                                                                                                                      • Instruction ID: 9e9026b6a08d43f4c34b0c014f83afec13b9727198b5f0eb67f7172f0d04fbcb
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 1979ff772ff0fab5ce447f3cb23b8cf2d6b9a018f2cb5cdd5f7bee6f6eaf168b
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 90915171B04214BFDB11EFA9DA86F9D77F4AB04304F5500BAF504AB392CB78AE419B58
                                                                                                                                                                                                      Function 00467218 Relevance: 13.9, APIs: 4, Strings: 3, Instructions: 1649windowCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                        • Part of subcall function 0049543C: GetWindowRect.USER32(00000000), ref: 00495452
                                                                                                                                                                                                      • LoadBitmapA.USER32(00400000,STOPIMAGE), ref: 004675E7
                                                                                                                                                                                                        • Part of subcall function 0041D6B0: GetObjectA.GDI32(?,00000018,00467601), ref: 0041D6DB
                                                                                                                                                                                                        • Part of subcall function 00466FF4: SHGetFileInfo.SHELL32(c:\directory,00000010,?,00000160,00001010), ref: 00467097
                                                                                                                                                                                                        • Part of subcall function 00466FF4: ExtractIconA.SHELL32(00400000,00000000,?), ref: 004670BD
                                                                                                                                                                                                        • Part of subcall function 00466FF4: ExtractIconA.SHELL32(00400000,00000000,00000027), ref: 00467114
                                                                                                                                                                                                        • Part of subcall function 004669B4: KiUserCallbackDispatcher.NTDLL(?,?,00000000,?,0046769C,00000000,00000000,00000000,0000000C,00000000), ref: 004669CC
                                                                                                                                                                                                        • Part of subcall function 004956C0: MulDiv.KERNEL32(0000000D,?,0000000D), ref: 004956CA
                                                                                                                                                                                                        • Part of subcall function 0042ED38: GetProcAddress.KERNEL32(00000000,SHAutoComplete), ref: 0042EDA8
                                                                                                                                                                                                        • Part of subcall function 0042ED38: SHAutoComplete.SHLWAPI(00000000,00000001), ref: 0042EDC5
                                                                                                                                                                                                        • Part of subcall function 0049538C: GetDC.USER32(00000000), ref: 004953AE
                                                                                                                                                                                                        • Part of subcall function 0049538C: SelectObject.GDI32(?,00000000), ref: 004953D4
                                                                                                                                                                                                        • Part of subcall function 0049538C: ReleaseDC.USER32(00000000,?), ref: 00495425
                                                                                                                                                                                                        • Part of subcall function 004956B0: MulDiv.KERNEL32(0000004B,?,00000006), ref: 004956BA
                                                                                                                                                                                                      • GetSystemMenu.USER32(00000000,00000000,0000000C,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000,?,?,00000000,?), ref: 00468271
                                                                                                                                                                                                      • AppendMenuA.USER32(00000000,00000800,00000000,00000000), ref: 00468282
                                                                                                                                                                                                      • AppendMenuA.USER32(00000000,00000000,0000270F,00000000), ref: 0046829A
                                                                                                                                                                                                        • Part of subcall function 0042A05C: SendMessageA.USER32(00000000,0000014E,00000000,00000000), ref: 0042A072
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Menu$AppendExtractIconObject$AddressAutoBitmapCallbackCompleteDispatcherFileInfoLoadMessageProcRectReleaseSelectSendSystemUserWindow
                                                                                                                                                                                                      • String ID: $(Default)$STOPIMAGE
                                                                                                                                                                                                      • API String ID: 3231140908-770201673
                                                                                                                                                                                                      • Opcode ID: 764156b1e4c0ae0172233bdd44f50128ac9b4d5817ddcd348765005d70655970
                                                                                                                                                                                                      • Instruction ID: 95164e1e617b107b44698f642e4cc1154f551ad52f4085116ed94e07ec8bca55
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 764156b1e4c0ae0172233bdd44f50128ac9b4d5817ddcd348765005d70655970
                                                                                                                                                                                                      • Instruction Fuzzy Hash: BEF2C6786005148FCB00EB59D9D9F9973F1BF49304F1542BAE9049B36ADB74EC4ACB8A
                                                                                                                                                                                                      Function 00455E0C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 112libraryloaderCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetModuleHandleA.KERNEL32(kernel32.dll,GetDiskFreeSpaceExA,00000000,00455F4B), ref: 00455E3C
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00455E42
                                                                                                                                                                                                      • GetDiskFreeSpaceExA.KERNELBASE(00000000,?,?,00000000,00000000,00455F29,?,00000000,kernel32.dll,GetDiskFreeSpaceExA,00000000,00455F4B), ref: 00455E98
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: AddressDiskFreeHandleModuleProcSpace
                                                                                                                                                                                                      • String ID: GetDiskFreeSpaceExA$kernel32.dll
                                                                                                                                                                                                      • API String ID: 1197914913-3712701948
                                                                                                                                                                                                      • Opcode ID: 425acd45c57e1a90a14b519a9b70c26380c560e6a4faa307eedde0d31f767984
                                                                                                                                                                                                      • Instruction ID: d81c9a8c7c52065d28d66f53e81ce4f313aa74f068c2efe820cb9bfc493487ae
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 425acd45c57e1a90a14b519a9b70c26380c560e6a4faa307eedde0d31f767984
                                                                                                                                                                                                      • Instruction Fuzzy Hash: B0418671A04649AFCF01EFA5C8929EEB7B8EF48305F504567F804F7292D67C5E098B68
                                                                                                                                                                                                      Function 00474DFC Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 99fileCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • FindFirstFileA.KERNEL32(00000000,?,00000000,00474F66,?,?,0049C1DC,00000000), ref: 00474E55
                                                                                                                                                                                                      • FindNextFileA.KERNEL32(00000000,?,00000000,?,00000000,00474F66,?,?,0049C1DC,00000000), ref: 00474F32
                                                                                                                                                                                                      • FindClose.KERNEL32(00000000,00000000,?,00000000,?,00000000,00474F66,?,?,0049C1DC,00000000), ref: 00474F40
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Find$File$CloseFirstNext
                                                                                                                                                                                                      • String ID: unins$unins???.*
                                                                                                                                                                                                      • API String ID: 3541575487-1009660736
                                                                                                                                                                                                      • Opcode ID: 5e576b03208d2e259677c02318acd6f2ad4d278db2359f1cb77b12eb5b061527
                                                                                                                                                                                                      • Instruction ID: 31c653d7bd6b2cf4ad5ba67a359891eda5ad6ed959604e3cb46055c530bb22dc
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 5e576b03208d2e259677c02318acd6f2ad4d278db2359f1cb77b12eb5b061527
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 2A313370A001089FCB10EF65D991ADEB7A9DF85318F51C4B6F80CA76A2DB389F418B58
                                                                                                                                                                                                      Function 00452A60 Relevance: 3.0, APIs: 2, Instructions: 45fileCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • FindFirstFileA.KERNEL32(00000000,?,00000000,00452AC3,?,?,-00000001,00000000), ref: 00452A9D
                                                                                                                                                                                                      • GetLastError.KERNEL32(00000000,?,00000000,00452AC3,?,?,-00000001,00000000), ref: 00452AA5
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: ErrorFileFindFirstLast
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 873889042-0
                                                                                                                                                                                                      • Opcode ID: 77a4f9a42a9b182eca9a30cb1eee9c943385d3d0e7805387745d9337962f8593
                                                                                                                                                                                                      • Instruction ID: 3e58272229af866f17ac5928e9872a720c3be2d4903e778e839a846eb7d55d53
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 77a4f9a42a9b182eca9a30cb1eee9c943385d3d0e7805387745d9337962f8593
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 94F0F971A04604AB8B10EF669D4149EF7ACEB8672571046BBFC14E3282DAB84E0485A8
                                                                                                                                                                                                      Function 00408568 Relevance: 1.5, APIs: 1, Instructions: 29COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0049B4C0,00000001,?,00408633,?,00000000,00408712), ref: 00408586
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: InfoLocale
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 2299586839-0
                                                                                                                                                                                                      • Opcode ID: 64da881718ef9bfb5c3691e8182369eeaf442f2681d4624e7b5adc518b999176
                                                                                                                                                                                                      • Instruction ID: 8daab3ef8e56b0da8b8c23f45c5b5388ad46b50bd825570c2d348c61856efc62
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 64da881718ef9bfb5c3691e8182369eeaf442f2681d4624e7b5adc518b999176
                                                                                                                                                                                                      • Instruction Fuzzy Hash: BFE0223170021466C311AA2A9C86AEAB34C9758310F00427FB904E73C2EDB89E4042A8
                                                                                                                                                                                                      Function 00423B84 Relevance: 1.5, APIs: 1, Instructions: 24nativeCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • NtdllDefWindowProc_A.USER32(?,?,?,?,?,00424151,?,00000000,0042415C), ref: 00423BAE
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: NtdllProc_Window
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 4255912815-0
                                                                                                                                                                                                      • Opcode ID: 88ecfa13f3ee270e805d5ccef1650ee506ec8760b8390f8b6ad1d401d880426f
                                                                                                                                                                                                      • Instruction ID: a748582893d7571d6ac8bdbe819d0a8fbf5f36db2d3505b6f19a51c7a0bbae16
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 88ecfa13f3ee270e805d5ccef1650ee506ec8760b8390f8b6ad1d401d880426f
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 47F0B979205608AF8B40DF99C588D4ABBE8AB4C260B058195B988CB321C234ED808F90
                                                                                                                                                                                                      Function 0045559C Relevance: 1.5, APIs: 1, Instructions: 20COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: NameUser
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 2645101109-0
                                                                                                                                                                                                      • Opcode ID: 969018677e36c7ee3cac7a31a88a81c68082f6a067fe28717e4d5eb0c099a74a
                                                                                                                                                                                                      • Instruction ID: 9f318ec9847dd9a6abcb639c8bc611599857aea0b867fcad4bfaeec6bdb042bf
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 969018677e36c7ee3cac7a31a88a81c68082f6a067fe28717e4d5eb0c099a74a
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 8FD0C27230470473CB00AA689C825AA35CD8B84305F00483E3CC5DA2C3FABDDA485756
                                                                                                                                                                                                      Function 0046EECC Relevance: 72.2, APIs: 1, Strings: 40, Instructions: 500registryCOMMON
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                      control_flow_graph 1755 46eecc-46eefe 1756 46ef00-46ef07 1755->1756 1757 46ef1b 1755->1757 1758 46ef12-46ef19 1756->1758 1759 46ef09-46ef10 1756->1759 1760 46ef22-46ef5a call 403634 call 403738 call 42dec0 1757->1760 1758->1760 1759->1757 1759->1758 1767 46ef75-46ef9e call 403738 call 42dde4 1760->1767 1768 46ef5c-46ef70 call 403738 call 42dec0 1760->1768 1776 46efa0-46efa9 call 46eb9c 1767->1776 1777 46efae-46efd7 call 46ecb8 1767->1777 1768->1767 1776->1777 1781 46efe9-46efec call 403400 1777->1781 1782 46efd9-46efe7 call 403494 1777->1782 1786 46eff1-46f03c call 46ecb8 call 42c3fc call 46ed00 call 46ecb8 1781->1786 1782->1786 1795 46f052-46f073 call 45559c call 46ecb8 1786->1795 1796 46f03e-46f051 call 46ed28 1786->1796 1803 46f075-46f0c8 call 46ecb8 call 431404 call 46ecb8 call 431404 call 46ecb8 1795->1803 1804 46f0c9-46f0d0 1795->1804 1796->1795 1803->1804 1805 46f0d2-46f10a call 431404 call 46ecb8 call 431404 call 46ecb8 1804->1805 1806 46f110-46f117 1804->1806 1841 46f10f 1805->1841 1808 46f158-46f17d call 40b24c call 46ecb8 1806->1808 1809 46f119-46f157 call 46ecb8 * 3 1806->1809 1830 46f17f-46f18a call 47bd90 1808->1830 1831 46f18c-46f195 call 403494 1808->1831 1809->1808 1838 46f19a-46f1a5 call 478924 1830->1838 1831->1838 1845 46f1a7-46f1ac 1838->1845 1846 46f1ae 1838->1846 1841->1806 1847 46f1b3-46f37d call 403778 call 46ecb8 call 47bd90 call 46ed00 call 403494 call 40357c * 2 call 46ecb8 call 403494 call 40357c * 2 call 46ecb8 call 47bd90 call 46ed00 call 47bd90 call 46ed00 call 47bd90 call 46ed00 call 47bd90 call 46ed00 call 47bd90 call 46ed00 call 47bd90 call 46ed00 call 47bd90 call 46ed00 call 47bd90 call 46ed00 call 47bd90 call 46ed00 call 47bd90 1845->1847 1846->1847 1910 46f393-46f3a1 call 46ed28 1847->1910 1911 46f37f-46f391 call 46ecb8 1847->1911 1915 46f3a6 1910->1915 1916 46f3a7-46f3f0 call 46ed28 call 46ed5c call 46ecb8 call 47bd90 call 46edc0 1911->1916 1915->1916 1927 46f416-46f423 1916->1927 1928 46f3f2-46f415 call 46ed28 * 2 1916->1928 1930 46f4f2-46f4f9 1927->1930 1931 46f429-46f430 1927->1931 1928->1927 1932 46f553-46f569 RegCloseKey 1930->1932 1933 46f4fb-46f531 call 49485c 1930->1933 1935 46f432-46f439 1931->1935 1936 46f49d-46f4ac 1931->1936 1933->1932 1935->1936 1940 46f43b-46f45f call 430bcc 1935->1940 1939 46f4af-46f4bc 1936->1939 1943 46f4d3-46f4ec call 430c08 call 46ed28 1939->1943 1944 46f4be-46f4cb 1939->1944 1940->1939 1950 46f461-46f462 1940->1950 1953 46f4f1 1943->1953 1944->1943 1948 46f4cd-46f4d1 1944->1948 1948->1930 1948->1943 1952 46f464-46f48a call 40b24c call 479150 1950->1952 1958 46f497-46f499 1952->1958 1959 46f48c-46f492 call 430bcc 1952->1959 1953->1930 1958->1952 1961 46f49b 1958->1961 1959->1958 1961->1939
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                        • Part of subcall function 0046ECB8: RegSetValueExA.ADVAPI32(?,Inno Setup: Setup Version,00000000,00000001,00000000,00000001,00475FFE,?,0049C1DC,?,0046EFCF,?,00000000,0046F56A,?,_is1), ref: 0046ECDB
                                                                                                                                                                                                        • Part of subcall function 0046ED28: RegSetValueExA.ADVAPI32(?,NoModify,00000000,00000004,00000000,00000004,00000001,?,0046F3A6,?,?,00000000,0046F56A,?,_is1,?), ref: 0046ED3B
                                                                                                                                                                                                      • RegCloseKey.ADVAPI32(?,0046F571,?,_is1,?,Software\Microsoft\Windows\CurrentVersion\Uninstall\,00000000,0046F5BC,?,?,0049C1DC,00000000), ref: 0046F564
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Value$Close
                                                                                                                                                                                                      • String ID: " /SILENT$5.5.2 (a)$Comments$Contact$DisplayIcon$DisplayName$DisplayVersion$EstimatedSize$HelpLink$HelpTelephone$Inno Setup: App Path$Inno Setup: Deselected Components$Inno Setup: Deselected Tasks$Inno Setup: Icon Group$Inno Setup: Language$Inno Setup: No Icons$Inno Setup: Selected Components$Inno Setup: Selected Tasks$Inno Setup: Setup Type$Inno Setup: Setup Version$Inno Setup: User$Inno Setup: User Info: Name$Inno Setup: User Info: Organization$Inno Setup: User Info: Serial$InstallDate$InstallLocation$MajorVersion$MinorVersion$ModifyPath$NoModify$NoRepair$Publisher$QuietUninstallString$Readme$RegisterPreviousData$Software\Microsoft\Windows\CurrentVersion\Uninstall\$URLInfoAbout$URLUpdateInfo$UninstallString$_is1
                                                                                                                                                                                                      • API String ID: 3391052094-2734025597
                                                                                                                                                                                                      • Opcode ID: 701026e6426d21201a34c841e512404e7abd329cddefab7ade26ec7393da222c
                                                                                                                                                                                                      • Instruction ID: 41df9594f94a3a106a445eb875b77748a5d5020e54387338891d7450c5044d2a
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 701026e6426d21201a34c841e512404e7abd329cddefab7ade26ec7393da222c
                                                                                                                                                                                                      • Instruction Fuzzy Hash: CF123335A00109AFDB04EF55E981ADE73F5EB48304F60847BE840AB396EB78AD45CB5D
                                                                                                                                                                                                      Function 00483560 Relevance: 26.3, APIs: 9, Strings: 6, Instructions: 68libraryloaderCOMMON
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                      control_flow_graph 2698 483560-483585 GetModuleHandleA GetProcAddress 2699 4835ec-4835f1 GetSystemInfo 2698->2699 2700 483587-48359d GetNativeSystemInfo GetProcAddress 2698->2700 2702 4835f6-4835ff 2699->2702 2701 48359f-4835aa GetCurrentProcess 2700->2701 2700->2702 2701->2702 2709 4835ac-4835b0 2701->2709 2703 48360f-483616 2702->2703 2704 483601-483605 2702->2704 2705 483631-483636 2703->2705 2707 483618-48361f 2704->2707 2708 483607-48360b 2704->2708 2707->2705 2710 48360d-48362a 2708->2710 2711 483621-483628 2708->2711 2709->2702 2712 4835b2-4835b9 call 45271c 2709->2712 2710->2705 2711->2705 2712->2702 2716 4835bb-4835c8 GetProcAddress 2712->2716 2716->2702 2717 4835ca-4835e1 GetModuleHandleA GetProcAddress 2716->2717 2717->2702 2718 4835e3-4835ea 2717->2718 2718->2702
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetModuleHandleA.KERNEL32(kernel32.dll), ref: 00483571
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 0048357E
                                                                                                                                                                                                      • GetNativeSystemInfo.KERNELBASE(?,00000000,GetNativeSystemInfo,kernel32.dll), ref: 0048358C
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 00483594
                                                                                                                                                                                                      • GetCurrentProcess.KERNEL32(?,00000000,IsWow64Process), ref: 004835A0
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryA), ref: 004835C1
                                                                                                                                                                                                      • GetModuleHandleA.KERNEL32(advapi32.dll,RegDeleteKeyExA,00000000,GetSystemWow64DirectoryA,?,00000000,IsWow64Process), ref: 004835D4
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,advapi32.dll), ref: 004835DA
                                                                                                                                                                                                      • GetSystemInfo.KERNEL32(?,00000000,GetNativeSystemInfo,kernel32.dll), ref: 004835F1
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: AddressProc$HandleInfoModuleSystem$CurrentNativeProcess
                                                                                                                                                                                                      • String ID: GetNativeSystemInfo$GetSystemWow64DirectoryA$IsWow64Process$RegDeleteKeyExA$advapi32.dll$kernel32.dll
                                                                                                                                                                                                      • API String ID: 2230631259-2623177817
                                                                                                                                                                                                      • Opcode ID: ecd875b9fed982c6964d0a5895b6aed5fdd9f377785afaacdd435e2d250d9586
                                                                                                                                                                                                      • Instruction ID: 55e3f4d73e57614863bf74929b0f0177a2d28665cd9645ad6096ae2f13a54172
                                                                                                                                                                                                      • Opcode Fuzzy Hash: ecd875b9fed982c6964d0a5895b6aed5fdd9f377785afaacdd435e2d250d9586
                                                                                                                                                                                                      • Instruction Fuzzy Hash: D6113D81549782B4DA21BB7D8D5AB6F1A888B10F5AF140C3B7C40753C2E96DCE458B6E
                                                                                                                                                                                                      Function 004735F8 Relevance: 25.1, APIs: 9, Strings: 5, Instructions: 585registryCOMMON
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                      control_flow_graph 2724 4735f8-47362b 2725 473d16-473d4a call 46e338 call 403400 * 2 call 403420 2724->2725 2726 473631-473635 2724->2726 2727 47363c-473679 call 40b24c call 479150 2726->2727 2738 47367f-4736be call 47dc9c call 478dc4 call 47bd90 * 2 2727->2738 2739 473d0a-473d10 2727->2739 2750 4736c4-4736cb 2738->2750 2751 4736c0 2738->2751 2739->2725 2739->2727 2752 4736e4-4736fd 2750->2752 2753 4736cd-4736d4 2750->2753 2751->2750 2756 473723-47372a 2752->2756 2757 4736ff-473709 call 473428 2752->2757 2754 4736d6-4736db call 453344 2753->2754 2755 4736e0 2753->2755 2754->2755 2755->2752 2758 47372c-473733 2756->2758 2759 473739-473740 2756->2759 2757->2756 2766 47370b-47371e call 403738 call 42dec0 2757->2766 2758->2759 2762 473be7-473c1d 2758->2762 2763 473793-4737b3 call 47344c 2759->2763 2764 473742-473749 2759->2764 2762->2752 2772 473c23-473c2a 2762->2772 2775 473826-47382d 2763->2775 2776 4737b5-4737da call 403738 call 42dde4 2763->2776 2764->2763 2769 47374b-47376d call 403738 call 42de1c 2764->2769 2766->2756 2769->2762 2804 473773-47378e call 403738 RegDeleteValueA RegCloseKey 2769->2804 2777 473c5d-473c64 2772->2777 2778 473c2c-473c36 call 473428 2772->2778 2780 473876 2775->2780 2781 47382f-473853 call 403738 call 42de1c 2775->2781 2807 4737df-4737e3 2776->2807 2786 473c97-473c9e 2777->2786 2787 473c66-473c70 call 473428 2777->2787 2778->2777 2802 473c38-473c58 call 45a204 2778->2802 2793 47387b-47387d 2780->2793 2781->2793 2825 473855-473858 2781->2825 2789 473ca0-473cc6 call 45a204 2786->2789 2790 473ccb-473cd2 2786->2790 2787->2786 2805 473c72-473c92 call 45a204 2787->2805 2789->2790 2800 473cd4-473cfa call 45a204 2790->2800 2801 473cff-473d05 call 478df0 2790->2801 2793->2762 2803 473883-473898 2793->2803 2800->2801 2801->2739 2802->2777 2811 4738ac-4738b3 2803->2811 2812 47389a-4738a7 call 403738 RegDeleteValueA 2803->2812 2804->2762 2805->2786 2818 4737e5-4737e9 2807->2818 2819 47380a-473811 2807->2819 2815 473bc9-473bdf RegCloseKey 2811->2815 2816 4738b9-4738c0 2811->2816 2812->2811 2823 4738c2-4738d6 call 403738 call 42dd64 2816->2823 2824 4738dc-4738e9 2816->2824 2818->2793 2826 4737ef-473808 call 47344c 2818->2826 2819->2793 2827 473813-473824 call 46eb9c 2819->2827 2823->2815 2823->2824 2824->2815 2830 4738ef 2824->2830 2825->2793 2829 47385a-473861 2825->2829 2826->2793 2827->2793 2829->2793 2834 473863-473874 call 46eb9c 2829->2834 2830->2815 2835 473b16-473b31 call 47bd90 call 430c58 2830->2835 2836 473ab4-473aed call 47bd90 call 406d98 call 403738 RegSetValueExA 2830->2836 2837 473912-47391c 2830->2837 2838 473b7b-473bad call 403574 call 403738 * 2 RegSetValueExA 2830->2838 2834->2793 2866 473b33-473b38 call 453344 2835->2866 2867 473b3d-473b5d call 403738 RegSetValueExA 2835->2867 2836->2815 2884 473af3-473afa 2836->2884 2844 473925-47392a 2837->2844 2845 47391e-473921 2837->2845 2838->2815 2880 473baf-473bb6 2838->2880 2854 473931-473933 2844->2854 2851 473923 2845->2851 2852 47392c 2845->2852 2851->2854 2852->2854 2856 4739d0-4739e2 call 40385c 2854->2856 2857 473939-47394b call 40385c 2854->2857 2877 4739e4-4739fb call 403738 call 42dd58 2856->2877 2878 4739fd-473a00 call 403400 2856->2878 2874 473966-473969 call 403400 2857->2874 2875 47394d-473964 call 403738 call 42dd4c 2857->2875 2866->2867 2867->2815 2889 473b5f-473b66 2867->2889 2892 47396e-473975 2874->2892 2875->2874 2875->2892 2877->2878 2893 473a05-473a3e call 47bdb0 2877->2893 2878->2893 2880->2815 2887 473bb8-473bc4 call 46eb9c 2880->2887 2884->2815 2891 473b00-473b11 call 46eb9c 2884->2891 2887->2815 2889->2815 2896 473b68-473b79 call 46eb9c 2889->2896 2891->2815 2899 473977-473995 call 403738 RegQueryValueExA 2892->2899 2900 4739a6-4739cb call 47bdb0 2892->2900 2909 473a40-473a50 call 403574 2893->2909 2910 473a5f-473a8b call 403574 call 403738 * 2 RegSetValueExA 2893->2910 2896->2815 2899->2900 2916 473997-47399b 2899->2916 2900->2910 2909->2910 2921 473a52-473a5a call 40357c 2909->2921 2910->2815 2927 473a91-473a98 2910->2927 2919 4739a3 2916->2919 2920 47399d-4739a1 2916->2920 2919->2900 2920->2900 2920->2919 2921->2910 2927->2815 2928 473a9e-473aaf call 46eb9c 2927->2928 2928->2815
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • RegDeleteValueA.ADVAPI32(?,00000000,?,00000002,00000000,00000000,00473BF1,?,?,?,?,00000000,00473D4B,?,?,0049C1DC), ref: 00473780
                                                                                                                                                                                                      • RegCloseKey.ADVAPI32(?,?,00000000,?,00000002,00000000,00000000,00473BF1,?,?,?,?,00000000,00473D4B), ref: 00473789
                                                                                                                                                                                                        • Part of subcall function 0047344C: GetLastError.KERNEL32(00000000,00000000,00000000,00473520,?,?,0049C1DC,00000000), ref: 004734D9
                                                                                                                                                                                                      • RegDeleteValueA.ADVAPI32(?,00000000,00000000,00473BE0,?,?,00000000,00473BF1,?,?,?,?,00000000,00473D4B), ref: 004738A7
                                                                                                                                                                                                        • Part of subcall function 0042DDE4: RegCreateKeyExA.ADVAPI32(?,?,?,?,?,?,?,?,?), ref: 0042DE10
                                                                                                                                                                                                        • Part of subcall function 0047344C: GetLastError.KERNEL32(00000000,00000000,00000000,00473520,?,?,0049C1DC,00000000), ref: 004734EF
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: DeleteErrorLastValue$CloseCreate
                                                                                                                                                                                                      • String ID: Cannot access 64-bit registry keys on this version of Windows$Failed to parse "qword" value$break$olddata${olddata}
                                                                                                                                                                                                      • API String ID: 2638610037-3092547568
                                                                                                                                                                                                      • Opcode ID: d281d6ef7bed39c0c83b7981c0ab004329afbbd25accaeb8c14b0cdfc6455697
                                                                                                                                                                                                      • Instruction ID: d6cd59b22391c886a19e27fc48df71d6c98a85a240ed272f759ec14c408cfb09
                                                                                                                                                                                                      • Opcode Fuzzy Hash: d281d6ef7bed39c0c83b7981c0ab004329afbbd25accaeb8c14b0cdfc6455697
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 6E322E74A00248AFDB15DFA9D481BDEBBF4AF08305F008066F914BB3A2D778AD45DB59
                                                                                                                                                                                                      Function 00468BFC Relevance: 24.7, APIs: 1, Strings: 13, Instructions: 155registryCOMMON
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                      control_flow_graph 2931 468bfc-468c34 call 47bd90 2934 468e16-468e30 call 403420 2931->2934 2935 468c3a-468c4a call 478944 2931->2935 2940 468c4f-468c94 call 4078f4 call 403738 call 42de1c 2935->2940 2946 468c99-468c9b 2940->2946 2947 468ca1-468cb6 2946->2947 2948 468e0c-468e10 2946->2948 2949 468ccb-468cd2 2947->2949 2950 468cb8-468cc6 call 42dd4c 2947->2950 2948->2934 2948->2940 2951 468cd4-468cf6 call 42dd4c call 42dd64 2949->2951 2952 468cff-468d06 2949->2952 2950->2949 2951->2952 2971 468cf8 2951->2971 2955 468d5f-468d66 2952->2955 2956 468d08-468d2d call 42dd4c * 2 2952->2956 2958 468dac-468db3 2955->2958 2959 468d68-468d7a call 42dd4c 2955->2959 2978 468d2f-468d38 call 4314f8 2956->2978 2979 468d3d-468d4f call 42dd4c 2956->2979 2964 468db5-468de9 call 42dd4c * 3 2958->2964 2965 468dee-468e04 RegCloseKey 2958->2965 2972 468d7c-468d85 call 4314f8 2959->2972 2973 468d8a-468d9c call 42dd4c 2959->2973 2964->2965 2971->2952 2972->2973 2973->2958 2986 468d9e-468da7 call 4314f8 2973->2986 2978->2979 2979->2955 2987 468d51-468d5a call 4314f8 2979->2987 2986->2958 2987->2955
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                        • Part of subcall function 0042DE1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,004836C7,?,00000001,?,?,004836C7,?,00000001,00000000), ref: 0042DE38
                                                                                                                                                                                                      • RegCloseKey.ADVAPI32(?,00468E16,?,?,00000001,00000000,00000000,00468E31,?,00000000,00000000,?), ref: 00468DFF
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      • Inno Setup: Icon Group, xrefs: 00468CDA
                                                                                                                                                                                                      • Inno Setup: Selected Components, xrefs: 00468D1E
                                                                                                                                                                                                      • Inno Setup: Deselected Components, xrefs: 00468D40
                                                                                                                                                                                                      • Inno Setup: No Icons, xrefs: 00468CE7
                                                                                                                                                                                                      • Inno Setup: App Path, xrefs: 00468CBE
                                                                                                                                                                                                      • Inno Setup: User Info: Serial, xrefs: 00468DE1
                                                                                                                                                                                                      • Inno Setup: Setup Type, xrefs: 00468D0E
                                                                                                                                                                                                      • Inno Setup: Selected Tasks, xrefs: 00468D6B
                                                                                                                                                                                                      • Inno Setup: User Info: Organization, xrefs: 00468DCE
                                                                                                                                                                                                      • Inno Setup: Deselected Tasks, xrefs: 00468D8D
                                                                                                                                                                                                      • %s\%s_is1, xrefs: 00468C79
                                                                                                                                                                                                      • Inno Setup: User Info: Name, xrefs: 00468DBB
                                                                                                                                                                                                      • Software\Microsoft\Windows\CurrentVersion\Uninstall, xrefs: 00468C5B
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CloseOpen
                                                                                                                                                                                                      • String ID: %s\%s_is1$Inno Setup: App Path$Inno Setup: Deselected Components$Inno Setup: Deselected Tasks$Inno Setup: Icon Group$Inno Setup: No Icons$Inno Setup: Selected Components$Inno Setup: Selected Tasks$Inno Setup: Setup Type$Inno Setup: User Info: Name$Inno Setup: User Info: Organization$Inno Setup: User Info: Serial$Software\Microsoft\Windows\CurrentVersion\Uninstall
                                                                                                                                                                                                      • API String ID: 47109696-1093091907
                                                                                                                                                                                                      • Opcode ID: 477994bb8960d1965e10b40f61816eaf4c7b707db17a7ca4aa6169c09ca9eb9e
                                                                                                                                                                                                      • Instruction ID: 0c37994fccd001a995e494b6850b37eb05b7d5ed784e69181523ebf3a7e49158
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 477994bb8960d1965e10b40f61816eaf4c7b707db17a7ca4aa6169c09ca9eb9e
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 8D51C570A006049BCB10DB65C941BDEB7F5EF48304F50856EE840AB391EB38AF01CB6D
                                                                                                                                                                                                      Function 0047C15C Relevance: 22.9, APIs: 4, Strings: 9, Instructions: 187COMMON
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      APIs
                                                                                                                                                                                                        • Part of subcall function 0042D898: GetWindowsDirectoryA.KERNEL32(?,00000104,00000000,00453DB4,00000000,00454066,?,?,00000000,0049B628,00000004,00000000,00000000,00000000,?,00497F15), ref: 0042D8AB
                                                                                                                                                                                                        • Part of subcall function 0042D8C4: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0042D8D7
                                                                                                                                                                                                        • Part of subcall function 0042D8F0: GetModuleHandleA.KERNEL32(kernel32.dll,GetSystemWow64DirectoryA,?,00453B5A,00000000,00453BFD,?,?,00000000,00000000,00000000,00000000,00000000,?,00453FED,00000000), ref: 0042D90A
                                                                                                                                                                                                        • Part of subcall function 0042D8F0: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0042D910
                                                                                                                                                                                                      • SHGetKnownFolderPath.SHELL32(00499D1C,00008000,00000000,?,00000000,0047C432), ref: 0047C336
                                                                                                                                                                                                      • CoTaskMemFree.OLE32(?,0047C37B), ref: 0047C36E
                                                                                                                                                                                                        • Part of subcall function 0042D208: GetEnvironmentVariableA.KERNEL32(00000000,00000000,00000000,?,?,00000000,0042DA3E,00000000,0042DAD0,?,?,?,0049B628,00000000,00000000), ref: 0042D233
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Directory$AddressEnvironmentFolderFreeHandleKnownModulePathProcSystemTaskVariableWindows
                                                                                                                                                                                                      • String ID: COMMAND.COM$Common Files$CommonFilesDir$Failed to get path of 64-bit Common Files directory$Failed to get path of 64-bit Program Files directory$ProgramFilesDir$SystemDrive$\Program Files$cmd.exe
                                                                                                                                                                                                      • API String ID: 3771764029-544719455
                                                                                                                                                                                                      • Opcode ID: 458afd9a1cda60bc5c06d2a3f17cd4b8a975594a1455dcf27ea3d462b6d04529
                                                                                                                                                                                                      • Instruction ID: 599f5abe96f02a195e24b8b9203061af68f55c26e596fa95a84979d127ba116b
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 458afd9a1cda60bc5c06d2a3f17cd4b8a975594a1455dcf27ea3d462b6d04529
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 84619134A00204ABDB10EBA5E8D2A9E7B65EB54308F90C57FE804A7396C73C9E44CF5D
                                                                                                                                                                                                      Function 004729BC Relevance: 19.6, APIs: 4, Strings: 7, Instructions: 337COMMON
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                      control_flow_graph 3327 4729bc-472ab8 call 403728 call 403778 call 403684 call 47bd90 call 403494 * 2 call 40357c call 42c804 call 403494 call 40357c call 42c804 call 403494 call 40357c call 42c804 * 2 3358 472abf-472ac3 3327->3358 3359 472aba-472abd 3327->3359 3360 472ac8-472acc 3358->3360 3361 472ac5 3358->3361 3359->3360 3362 472adf-472aed call 47268c 3360->3362 3363 472ace-472ad9 call 478924 3360->3363 3361->3360 3369 472aef-472afa call 403494 3362->3369 3370 472afc-472b02 call 403494 3362->3370 3363->3362 3368 472adb 3363->3368 3368->3362 3374 472b07-472b63 call 457d6c call 46e094 call 42c8a4 call 46f950 call 406f50 * 2 call 42cd24 3369->3374 3370->3374 3389 472b65-472b74 call 403738 WritePrivateProfileStringA 3374->3389 3390 472b79-472b8d call 406f50 call 47286c 3374->3390 3389->3390 3397 472b93-472bc5 call 456564 3390->3397 3398 472c40-472c5b call 472728 call 403494 3390->3398 3401 472bca-472bce 3397->3401 3410 472c5f-472c6a 3398->3410 3403 472bd0-472bda call 42cd48 3401->3403 3404 472bdc-472bde 3401->3404 3403->3404 3412 472be0 3403->3412 3408 472be2-472be9 3404->3408 3408->3410 3411 472beb-472bef 3408->3411 3413 472c82-472c91 call 403738 SHChangeNotify 3410->3413 3414 472c6c-472c80 call 403738 SHChangeNotify 3410->3414 3411->3410 3415 472bf1-472c0b call 42c8fc call 406ac4 3411->3415 3412->3408 3422 472c96-472cbf call 42c8a4 call 403738 SHChangeNotify 3413->3422 3414->3422 3415->3410 3426 472c0d-472c32 call 4554a8 3415->3426 3432 472cc5-472cc9 3422->3432 3433 472dc3-472df7 call 46e338 call 403400 call 403420 call 403400 3422->3433 3426->3410 3434 472ccf-472d5c call 45a054 call 42c3fc call 40357c call 45a054 call 42c3fc call 40357c call 45a054 3432->3434 3435 472d5e-472d62 3432->3435 3434->3433 3437 472d85-472dbe call 45a054 * 2 3435->3437 3438 472d64-472d83 call 45a054 3435->3438 3437->3433 3438->3433
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                        • Part of subcall function 0042C804: GetFullPathNameA.KERNEL32(00000000,00001000,?), ref: 0042C828
                                                                                                                                                                                                      • WritePrivateProfileStringA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00472B74
                                                                                                                                                                                                      • SHChangeNotify.SHELL32(00000008,00000001,00000000,00000000), ref: 00472C7B
                                                                                                                                                                                                      • SHChangeNotify.SHELL32(00000002,00000001,00000000,00000000), ref: 00472C91
                                                                                                                                                                                                      • SHChangeNotify.SHELL32(00001000,00001001,00000000,00000000), ref: 00472CB6
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: ChangeNotify$FullNamePathPrivateProfileStringWrite
                                                                                                                                                                                                      • String ID: .lnk$.pif$.url$Desktop.ini$Filename: %s$target.lnk${group}\
                                                                                                                                                                                                      • API String ID: 971782779-3668018701
                                                                                                                                                                                                      • Opcode ID: b046c79e96e9d817a1462502981d649527d3070ce68e4ed9da1ec38afefc7a20
                                                                                                                                                                                                      • Instruction ID: 488d38facc3b5b4348deb9d7b7a0b4180c51b54c04cb4348039bcbbbcac6ad39
                                                                                                                                                                                                      • Opcode Fuzzy Hash: b046c79e96e9d817a1462502981d649527d3070ce68e4ed9da1ec38afefc7a20
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 62D13574A001499FDB11EFA9D981BDDBBF5AF08304F50806AF904B7392C778AE45CB69
                                                                                                                                                                                                      Function 00423874 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 98windowregistryCOMMON
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                      control_flow_graph 3465 423874-42387e 3466 4239a7-4239ab 3465->3466 3467 423884-4238a6 call 41f3c4 GetClassInfoA 3465->3467 3470 4238d7-4238e0 GetSystemMetrics 3467->3470 3471 4238a8-4238bf RegisterClassA 3467->3471 3472 4238e2 3470->3472 3473 4238e5-4238ef GetSystemMetrics 3470->3473 3471->3470 3474 4238c1-4238d2 call 408cbc call 40311c 3471->3474 3472->3473 3475 4238f1 3473->3475 3476 4238f4-423950 call 403738 call 4062e8 call 403400 call 42364c SetWindowLongA 3473->3476 3474->3470 3475->3476 3488 423952-423965 call 424178 SendMessageA 3476->3488 3489 42396a-423998 GetSystemMenu DeleteMenu * 2 3476->3489 3488->3489 3489->3466 3491 42399a-4239a2 DeleteMenu 3489->3491 3491->3466
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                        • Part of subcall function 0041F3C4: VirtualAlloc.KERNEL32(00000000,00001000,00001000,00000040,?,00000000,0041EDA4,?,0042388F,00423C0C,0041EDA4), ref: 0041F3E2
                                                                                                                                                                                                      • GetClassInfoA.USER32(00400000,0042367C), ref: 0042389F
                                                                                                                                                                                                      • RegisterClassA.USER32(00499630), ref: 004238B7
                                                                                                                                                                                                      • GetSystemMetrics.USER32(00000000), ref: 004238D9
                                                                                                                                                                                                      • GetSystemMetrics.USER32(00000001), ref: 004238E8
                                                                                                                                                                                                      • SetWindowLongA.USER32(00410460,000000FC,0042368C), ref: 00423944
                                                                                                                                                                                                      • SendMessageA.USER32(00410460,00000080,00000001,00000000), ref: 00423965
                                                                                                                                                                                                      • GetSystemMenu.USER32(00410460,00000000,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00423C0C,0041EDA4), ref: 00423970
                                                                                                                                                                                                      • DeleteMenu.USER32(00000000,0000F030,00000000,00410460,00000000,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00423C0C,0041EDA4), ref: 0042397F
                                                                                                                                                                                                      • DeleteMenu.USER32(00000000,0000F000,00000000,00000000,0000F030,00000000,00410460,00000000,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001), ref: 0042398C
                                                                                                                                                                                                      • DeleteMenu.USER32(00000000,0000F010,00000000,00000000,0000F000,00000000,00000000,0000F030,00000000,00410460,00000000,00000000,00400000,00000000,00000000,00000000), ref: 004239A2
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Menu$DeleteSystem$ClassMetrics$AllocInfoLongMessageRegisterSendVirtualWindow
                                                                                                                                                                                                      • String ID: |6B
                                                                                                                                                                                                      • API String ID: 183575631-3009739247
                                                                                                                                                                                                      • Opcode ID: 0318a091630d13b60d0a3e6aa49d41dd0f32c1053a4a49f7651c07b17dd5309d
                                                                                                                                                                                                      • Instruction ID: 5979ac727d64f3fe5c9a0a43452729076f54e0f9e4c251b9a4c28f9d6bed272f
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 0318a091630d13b60d0a3e6aa49d41dd0f32c1053a4a49f7651c07b17dd5309d
                                                                                                                                                                                                      • Instruction Fuzzy Hash: E63152B17402006AEB10AF69DC82F6A37989B14709F60017BFA44EF2D7C6BDED40876D
                                                                                                                                                                                                      Function 0047C968 Relevance: 17.6, APIs: 1, Strings: 9, Instructions: 95libraryloaderCOMMON
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                      control_flow_graph 3577 47c968-47c9be call 42c3fc call 4035c0 call 47c62c call 4525d8 3586 47c9c0-47c9c5 call 453344 3577->3586 3587 47c9ca-47c9d9 call 4525d8 3577->3587 3586->3587 3591 47c9f3-47c9f9 3587->3591 3592 47c9db-47c9e1 3587->3592 3595 47ca10-47ca38 call 42e394 * 2 3591->3595 3596 47c9fb-47ca01 3591->3596 3593 47ca03-47ca0b call 403494 3592->3593 3594 47c9e3-47c9e9 3592->3594 3593->3595 3594->3591 3597 47c9eb-47c9f1 3594->3597 3603 47ca5f-47ca79 GetProcAddress 3595->3603 3604 47ca3a-47ca5a call 4078f4 call 453344 3595->3604 3596->3593 3596->3595 3597->3591 3597->3593 3606 47ca85-47caa2 call 403400 * 2 3603->3606 3607 47ca7b-47ca80 call 453344 3603->3607 3604->3603 3607->3606
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,SHGetFolderPathA), ref: 0047CA6A
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: AddressProc
                                                                                                                                                                                                      • String ID: Failed to get address of SHGetFolderPath function$Failed to get version numbers of _shfoldr.dll$Failed to load DLL "%s"$SHFOLDERDLL$SHGetFolderPathA$_isetup\_shfoldr.dll$ptI$shell32.dll$shfolder.dll
                                                                                                                                                                                                      • API String ID: 190572456-2576699960
                                                                                                                                                                                                      • Opcode ID: de0f38486c819f413c08132c2c10785360ce7bb1d082894e1dd7e5610f115569
                                                                                                                                                                                                      • Instruction ID: 1b7f257eac351b2865de88edbb479a2ab4f4c09eb1d5ad9e3bfc9d6f8503b50a
                                                                                                                                                                                                      • Opcode Fuzzy Hash: de0f38486c819f413c08132c2c10785360ce7bb1d082894e1dd7e5610f115569
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 66310E70A001099BCB00EB95D5D2AEEB7B5EB44305F50847BE404F7241D778AE45CBAD
                                                                                                                                                                                                      Function 0040631C Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 27libraryloaderCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetModuleHandleA.KERNEL32(kernel32.dll,?,00498730), ref: 00406322
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 0040632F
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,SetSearchPathMode), ref: 00406345
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,SetProcessDEPPolicy), ref: 0040635B
                                                                                                                                                                                                      • SetProcessDEPPolicy.KERNEL32(00000001,00000000,SetProcessDEPPolicy,00000000,SetSearchPathMode,kernel32.dll,?,00498730), ref: 00406366
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: AddressProc$HandleModulePolicyProcess
                                                                                                                                                                                                      • String ID: SetDllDirectoryW$SetProcessDEPPolicy$SetSearchPathMode$kernel32.dll
                                                                                                                                                                                                      • API String ID: 3256987805-3653653586
                                                                                                                                                                                                      • Opcode ID: fb4db72500fb8039bf9e982fa136c472a352d03826636d66c2b82dec8efce00d
                                                                                                                                                                                                      • Instruction ID: 935c6a5f7b98c90e27654dc67135d8c1f882d2ad5d8c1b9d0efaf55941893a49
                                                                                                                                                                                                      • Opcode Fuzzy Hash: fb4db72500fb8039bf9e982fa136c472a352d03826636d66c2b82dec8efce00d
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 97E02D90380702ACEA1032B20D82F3B144C9B54B69B26543B7D56B51C7D9BDDD7059BD
                                                                                                                                                                                                      Function 0041321B Relevance: 14.6, APIs: 6, Strings: 2, Instructions: 633COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • SetWindowLongA.USER32(?,000000FC,?), ref: 00413664
                                                                                                                                                                                                      • GetWindowLongA.USER32(?,000000F0), ref: 0041366F
                                                                                                                                                                                                      • GetWindowLongA.USER32(?,000000F4), ref: 00413681
                                                                                                                                                                                                      • SetWindowLongA.USER32(?,000000F4,?), ref: 00413694
                                                                                                                                                                                                      • SetPropA.USER32(?,00000000,00000000), ref: 004136AB
                                                                                                                                                                                                      • SetPropA.USER32(?,00000000,00000000), ref: 004136C2
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: LongWindow$Prop
                                                                                                                                                                                                      • String ID: 3A$yA
                                                                                                                                                                                                      • API String ID: 3887896539-3278460822
                                                                                                                                                                                                      • Opcode ID: d9856cee796f57cc1685d9958f98130356579251106e4d85d69cc018d86e5275
                                                                                                                                                                                                      • Instruction ID: bcb4e109f9bb3244d1d15a250a8b19338fc20a7c4ef9bfc7c396c8b3ff51cb63
                                                                                                                                                                                                      • Opcode Fuzzy Hash: d9856cee796f57cc1685d9958f98130356579251106e4d85d69cc018d86e5275
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 8C22D06508E3C05FE31B9B74896A5D57FA0EE13325B1D45DFC4C28B1A3D21E8A8BC71A
                                                                                                                                                                                                      Function 00481338 Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 175windowCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • FreeLibrary.KERNEL32(00000000), ref: 004814F5
                                                                                                                                                                                                      • FreeLibrary.KERNEL32(00000000), ref: 00481509
                                                                                                                                                                                                      • SendNotifyMessageA.USER32(0002040C,00000496,00002710,00000000), ref: 0048157B
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      • DeinitializeSetup, xrefs: 004813F1
                                                                                                                                                                                                      • GetCustomSetupExitCode, xrefs: 00481395
                                                                                                                                                                                                      • Not restarting Windows because Setup is being run from the debugger., xrefs: 0048152A
                                                                                                                                                                                                      • Deinitializing Setup., xrefs: 00481356
                                                                                                                                                                                                      • Restarting Windows., xrefs: 00481556
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: FreeLibrary$MessageNotifySend
                                                                                                                                                                                                      • String ID: DeinitializeSetup$Deinitializing Setup.$GetCustomSetupExitCode$Not restarting Windows because Setup is being run from the debugger.$Restarting Windows.
                                                                                                                                                                                                      • API String ID: 3817813901-1884538726
                                                                                                                                                                                                      • Opcode ID: 5a98fa18b082e528a68d126a96bfd843e5cbf8212461ece878ed23c8c707586e
                                                                                                                                                                                                      • Instruction ID: a147a64e5fa7f59d2c1c0707bc10c89f769f7b05bbdcd0d826f9af474dd6dcab
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 5a98fa18b082e528a68d126a96bfd843e5cbf8212461ece878ed23c8c707586e
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 55519F30700240AFD311EB69E8D5B6E7BA8EB59714F50887BE805C73B1DB38AC46CB59
                                                                                                                                                                                                      Function 0042F560 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 90windowregistryCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetActiveWindow.USER32 ref: 0042F58F
                                                                                                                                                                                                      • GetFocus.USER32 ref: 0042F597
                                                                                                                                                                                                      • RegisterClassA.USER32(004997AC), ref: 0042F5B8
                                                                                                                                                                                                      • CreateWindowExA.USER32(00000000,TWindowDisabler-Window,0042F68C,88000000,00000000,00000000,00000000,00000000,00000000,00000000,00400000,00000000), ref: 0042F5F6
                                                                                                                                                                                                      • CreateWindowExA.USER32(00000000,TWindowDisabler-Window,00000000,80000000,00000000,00000000,00000000,00000000,61736944,00000000,00400000,00000000), ref: 0042F63C
                                                                                                                                                                                                      • ShowWindow.USER32(00000000,00000008,00000000,TWindowDisabler-Window,00000000,80000000,00000000,00000000,00000000,00000000,61736944,00000000,00400000,00000000,00000000,TWindowDisabler-Window), ref: 0042F64D
                                                                                                                                                                                                      • SetFocus.USER32(00000000,00000000,0042F66F,?,?,?,00000001,00000000,?,004581A2,00000000,0049B628), ref: 0042F654
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Window$CreateFocus$ActiveClassRegisterShow
                                                                                                                                                                                                      • String ID: TWindowDisabler-Window
                                                                                                                                                                                                      • API String ID: 3167913817-1824977358
                                                                                                                                                                                                      • Opcode ID: af2d58cb1d61aa5294d5b80584b5773ea49d3efeec85bd27a4eae10aec25b275
                                                                                                                                                                                                      • Instruction ID: c3989f54cd535b42bfd745bd8d6279a550c1ea008e6f4be51b2d228796931bcd
                                                                                                                                                                                                      • Opcode Fuzzy Hash: af2d58cb1d61aa5294d5b80584b5773ea49d3efeec85bd27a4eae10aec25b275
                                                                                                                                                                                                      • Instruction Fuzzy Hash: B021A170740710BAE310EF66AD43F1A76B8EB04B44F91853BF604AB2E1D7B86D0586AD
                                                                                                                                                                                                      Function 0047286C Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 67COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetFileAttributesA.KERNEL32(00000000,00000000,0047292D,?,?,?,00000008,00000000,00000000,00000000,?,00472B89,?,?,00000000,00472DF8), ref: 00472890
                                                                                                                                                                                                        • Part of subcall function 0042CD94: GetPrivateProfileStringA.KERNEL32(00000000,00000000,00000000,00000000,00000100,00000000), ref: 0042CE0A
                                                                                                                                                                                                        • Part of subcall function 00406F50: DeleteFileA.KERNEL32(00000000,0049B628,00498261,00000000,004982B6,?,?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000), ref: 00406F5B
                                                                                                                                                                                                      • SetFileAttributesA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,0047292D,?,?,?,00000008,00000000,00000000,00000000,?,00472B89), ref: 00472907
                                                                                                                                                                                                      • RemoveDirectoryA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,0047292D,?,?,?,00000008,00000000,00000000,00000000), ref: 0047290D
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: File$Attributes$DeleteDirectoryPrivateProfileRemoveString
                                                                                                                                                                                                      • String ID: .ShellClassInfo$CLSID2$desktop.ini$target.lnk${0AFACED1-E828-11D1-9187-B532F1E9575D}
                                                                                                                                                                                                      • API String ID: 884541143-1710247218
                                                                                                                                                                                                      • Opcode ID: d177b4c411a59576765d49bbbb2c7f244f2391cc52cad0a49d950d286a2bdf0f
                                                                                                                                                                                                      • Instruction ID: c9f0bcdda41dfe4bc4fb8c2ad9af4abf79d42ba832169be77a83c6f088ccd444
                                                                                                                                                                                                      • Opcode Fuzzy Hash: d177b4c411a59576765d49bbbb2c7f244f2391cc52cad0a49d950d286a2bdf0f
                                                                                                                                                                                                      • Instruction Fuzzy Hash: A711D0F07005147BD701F66A8D82BAFB2ACDB49714F65807BB604B72C1DB7CAE01865C
                                                                                                                                                                                                      Function 004531F0 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 46libraryloaderCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetModuleHandleA.KERNEL32(kernel32.dll,Wow64DisableWow64FsRedirection,00000000,00453289,?,?,?,?,00000000,?,00498776), ref: 00453210
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00453216
                                                                                                                                                                                                      • GetModuleHandleA.KERNEL32(kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000,00453289,?,?,?,?,00000000,?,00498776), ref: 0045322A
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00453230
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: AddressHandleModuleProc
                                                                                                                                                                                                      • String ID: Wow64DisableWow64FsRedirection$Wow64RevertWow64FsRedirection$kernel32.dll$shell32.dll
                                                                                                                                                                                                      • API String ID: 1646373207-2130885113
                                                                                                                                                                                                      • Opcode ID: 460e23cb00cf3424ad6d0c49a1f828097ca48bff1b05d8589e040c86aeca4b16
                                                                                                                                                                                                      • Instruction ID: 0cfad7ca53bf4133c716031d63a26ec494c9be7874946ed143d2344feace3e75
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 460e23cb00cf3424ad6d0c49a1f828097ca48bff1b05d8589e040c86aeca4b16
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 9F01D870240B04BED3016F63AD12F563A58E755B5BF5044BBFC1496582C77C4A088EAD
                                                                                                                                                                                                      Function 00466FF4 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 141windowCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • SHGetFileInfo.SHELL32(c:\directory,00000010,?,00000160,00001010), ref: 00467097
                                                                                                                                                                                                      • ExtractIconA.SHELL32(00400000,00000000,?), ref: 004670BD
                                                                                                                                                                                                        • Part of subcall function 00466F34: DrawIconEx.USER32(00000000,00000000,00000000,00000000,00000020,00000020,00000000,00000000,00000003), ref: 00466FCC
                                                                                                                                                                                                        • Part of subcall function 00466F34: DestroyCursor.USER32(00000000), ref: 00466FE2
                                                                                                                                                                                                      • ExtractIconA.SHELL32(00400000,00000000,00000027), ref: 00467114
                                                                                                                                                                                                      • SHGetFileInfo.SHELL32(00000000,00000000,?,00000160,00001000), ref: 00467175
                                                                                                                                                                                                      • ExtractIconA.SHELL32(00400000,00000000,?), ref: 0046719B
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Icon$Extract$FileInfo$CursorDestroyDraw
                                                                                                                                                                                                      • String ID: c:\directory$shell32.dll
                                                                                                                                                                                                      • API String ID: 3376378930-1375355148
                                                                                                                                                                                                      • Opcode ID: 6d041171d1007e38f1423e999fca6c8345fae3a72a3914b9ee39d1bb44a6fd6f
                                                                                                                                                                                                      • Instruction ID: 28e44f0b0ade20fd2fa41990bb26b25d2b6273e6e4b8387af8825f96a0abaac4
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 6d041171d1007e38f1423e999fca6c8345fae3a72a3914b9ee39d1bb44a6fd6f
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 65517E70604204AFD710DF65CD89FDFB7E8EB49308F1081A7F8089B351D6389E81CA69
                                                                                                                                                                                                      Function 00430940 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 23registryclipboardthreadCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • RegisterClipboardFormatA.USER32(commdlg_help), ref: 00430948
                                                                                                                                                                                                      • RegisterClipboardFormatA.USER32(commdlg_FindReplace), ref: 00430957
                                                                                                                                                                                                      • GetCurrentThreadId.KERNEL32 ref: 00430971
                                                                                                                                                                                                      • GlobalAddAtomA.KERNEL32(00000000), ref: 00430992
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: ClipboardFormatRegister$AtomCurrentGlobalThread
                                                                                                                                                                                                      • String ID: WndProcPtr%.8X%.8X$commdlg_FindReplace$commdlg_help
                                                                                                                                                                                                      • API String ID: 4130936913-2943970505
                                                                                                                                                                                                      • Opcode ID: 8a088dfdc0b2c62b7d21c5c596ec815df7ae76573c78c741c8a86d6eee6cb681
                                                                                                                                                                                                      • Instruction ID: 0bd92e6c8c1c5a5b8444157758b44b4e11dae02c37acc47d2edddbd1fb793b69
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 8a088dfdc0b2c62b7d21c5c596ec815df7ae76573c78c741c8a86d6eee6cb681
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 22F012B0458340DEE300EB65994271E7BD0EF58718F50467FF498A6392D7795904CB5F
                                                                                                                                                                                                      Function 00471FC8 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 272fileCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • FindNextFileA.KERNEL32(000000FF,?,00000000,00472199,?,00000000,?,0049C1DC,00000000,00472389,?,00000000,?,00000000,?,00472555), ref: 00472175
                                                                                                                                                                                                      • FindClose.KERNEL32(000000FF,004721A0,00472199,?,00000000,?,0049C1DC,00000000,00472389,?,00000000,?,00000000,?,00472555,?), ref: 00472193
                                                                                                                                                                                                      • FindNextFileA.KERNEL32(000000FF,?,00000000,004722BB,?,00000000,?,0049C1DC,00000000,00472389,?,00000000,?,00000000,?,00472555), ref: 00472297
                                                                                                                                                                                                      • FindClose.KERNEL32(000000FF,004722C2,004722BB,?,00000000,?,0049C1DC,00000000,00472389,?,00000000,?,00000000,?,00472555,?), ref: 004722B5
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Find$CloseFileNext
                                                                                                                                                                                                      • String ID: &&G$&&G
                                                                                                                                                                                                      • API String ID: 2066263336-852616326
                                                                                                                                                                                                      • Opcode ID: 3dbc4c9ca66f6f00f908031af205c66759fb0276e5a4a903ef2a2695fc9a95df
                                                                                                                                                                                                      • Instruction ID: 5d8f9e8498e1fb85c1a49ff99105bc28d4ff0fd985b73b461b66a4ef7da0b053
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 3dbc4c9ca66f6f00f908031af205c66759fb0276e5a4a903ef2a2695fc9a95df
                                                                                                                                                                                                      • Instruction Fuzzy Hash: F0C14C3490424D9FCF11DFA5C981BDEBBB9FF09304F5085AAE908A3291D7789A45CF64
                                                                                                                                                                                                      Function 0042368C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 96windowCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • LoadIconA.USER32(00400000,MAINICON), ref: 0042371C
                                                                                                                                                                                                      • GetModuleFileNameA.KERNEL32(00400000,?,00000100,00400000,MAINICON,?,?,?,00418FE6,00000000,?,?,?,00000001), ref: 00423749
                                                                                                                                                                                                      • OemToCharA.USER32(?,?), ref: 0042375C
                                                                                                                                                                                                      • CharLowerA.USER32(?,00400000,?,00000100,00400000,MAINICON,?,?,?,00418FE6,00000000,?,?,?,00000001), ref: 0042379C
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Char$FileIconLoadLowerModuleName
                                                                                                                                                                                                      • String ID: 2$MAINICON
                                                                                                                                                                                                      • API String ID: 3935243913-3181700818
                                                                                                                                                                                                      • Opcode ID: a0d1a492a3e1df344d79b5ede7937f80cf878dadafa44837ceada302c6d607ca
                                                                                                                                                                                                      • Instruction ID: 339a64ebbf2375270c19ef2cfa2d714624ee8dcb7e06b01b5ae6522dc3b50067
                                                                                                                                                                                                      • Opcode Fuzzy Hash: a0d1a492a3e1df344d79b5ede7937f80cf878dadafa44837ceada302c6d607ca
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 243181B0A042549ADF10EF29D8C57C67BA8AF14308F4441BAE844DB393D7BED988CB59
                                                                                                                                                                                                      Function 00418F38 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 55threadCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetCurrentProcessId.KERNEL32(00000000), ref: 00418F3D
                                                                                                                                                                                                      • GlobalAddAtomA.KERNEL32(00000000), ref: 00418F5E
                                                                                                                                                                                                      • GetCurrentThreadId.KERNEL32 ref: 00418F79
                                                                                                                                                                                                      • GlobalAddAtomA.KERNEL32(00000000), ref: 00418F9A
                                                                                                                                                                                                        • Part of subcall function 004230C8: GetDC.USER32(00000000), ref: 0042311E
                                                                                                                                                                                                        • Part of subcall function 004230C8: EnumFontsA.GDI32(00000000,00000000,00423068,00410460,00000000,?,?,00000000,?,00418FD3,00000000,?,?,?,00000001), ref: 00423131
                                                                                                                                                                                                        • Part of subcall function 004230C8: GetDeviceCaps.GDI32(00000000,0000005A), ref: 00423139
                                                                                                                                                                                                        • Part of subcall function 004230C8: ReleaseDC.USER32(00000000,00000000), ref: 00423144
                                                                                                                                                                                                        • Part of subcall function 0042368C: LoadIconA.USER32(00400000,MAINICON), ref: 0042371C
                                                                                                                                                                                                        • Part of subcall function 0042368C: GetModuleFileNameA.KERNEL32(00400000,?,00000100,00400000,MAINICON,?,?,?,00418FE6,00000000,?,?,?,00000001), ref: 00423749
                                                                                                                                                                                                        • Part of subcall function 0042368C: OemToCharA.USER32(?,?), ref: 0042375C
                                                                                                                                                                                                        • Part of subcall function 0042368C: CharLowerA.USER32(?,00400000,?,00000100,00400000,MAINICON,?,?,?,00418FE6,00000000,?,?,?,00000001), ref: 0042379C
                                                                                                                                                                                                        • Part of subcall function 0041F118: GetVersion.KERNEL32(?,00418FF0,00000000,?,?,?,00000001), ref: 0041F126
                                                                                                                                                                                                        • Part of subcall function 0041F118: SetErrorMode.KERNEL32(00008000,?,00418FF0,00000000,?,?,?,00000001), ref: 0041F142
                                                                                                                                                                                                        • Part of subcall function 0041F118: LoadLibraryA.KERNEL32(CTL3D32.DLL,00008000,?,00418FF0,00000000,?,?,?,00000001), ref: 0041F14E
                                                                                                                                                                                                        • Part of subcall function 0041F118: SetErrorMode.KERNEL32(00000000,CTL3D32.DLL,00008000,?,00418FF0,00000000,?,?,?,00000001), ref: 0041F15C
                                                                                                                                                                                                        • Part of subcall function 0041F118: GetProcAddress.KERNEL32(00000001,Ctl3dRegister), ref: 0041F18C
                                                                                                                                                                                                        • Part of subcall function 0041F118: GetProcAddress.KERNEL32(00000001,Ctl3dUnregister), ref: 0041F1B5
                                                                                                                                                                                                        • Part of subcall function 0041F118: GetProcAddress.KERNEL32(00000001,Ctl3dSubclassCtl), ref: 0041F1CA
                                                                                                                                                                                                        • Part of subcall function 0041F118: GetProcAddress.KERNEL32(00000001,Ctl3dSubclassDlgEx), ref: 0041F1DF
                                                                                                                                                                                                        • Part of subcall function 0041F118: GetProcAddress.KERNEL32(00000001,Ctl3dDlgFramePaint), ref: 0041F1F4
                                                                                                                                                                                                        • Part of subcall function 0041F118: GetProcAddress.KERNEL32(00000001,Ctl3dCtlColorEx), ref: 0041F209
                                                                                                                                                                                                        • Part of subcall function 0041F118: GetProcAddress.KERNEL32(00000001,Ctl3dAutoSubclass), ref: 0041F21E
                                                                                                                                                                                                        • Part of subcall function 0041F118: GetProcAddress.KERNEL32(00000001,Ctl3dUnAutoSubclass), ref: 0041F233
                                                                                                                                                                                                        • Part of subcall function 0041F118: GetProcAddress.KERNEL32(00000001,Ctl3DColorChange), ref: 0041F248
                                                                                                                                                                                                        • Part of subcall function 0041F118: GetProcAddress.KERNEL32(00000001,BtnWndProc3d), ref: 0041F25D
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: AddressProc$AtomCharCurrentErrorGlobalLoadMode$CapsDeviceEnumFileFontsIconLibraryLowerModuleNameProcessReleaseThreadVersion
                                                                                                                                                                                                      • String ID: ControlOfs%.8X%.8X$Delphi%.8X
                                                                                                                                                                                                      • API String ID: 316262546-2767913252
                                                                                                                                                                                                      • Opcode ID: b417f06b73a7dba032b12b865c8ed9bc6bb92a8bfb887f153b822e9fb73695be
                                                                                                                                                                                                      • Instruction ID: d883a59e21ed3b4d0722d018b4a025de81f9e45e1fd093e44b5ebaba0e30331f
                                                                                                                                                                                                      • Opcode Fuzzy Hash: b417f06b73a7dba032b12b865c8ed9bc6bb92a8bfb887f153b822e9fb73695be
                                                                                                                                                                                                      • Instruction Fuzzy Hash: AC115E706142419AD740FF76A94235A7BE1DF64308F40943FF448A7391DB3DA9448B5F
                                                                                                                                                                                                      Function 0041363C Relevance: 9.1, APIs: 6, Instructions: 60COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • SetWindowLongA.USER32(?,000000FC,?), ref: 00413664
                                                                                                                                                                                                      • GetWindowLongA.USER32(?,000000F0), ref: 0041366F
                                                                                                                                                                                                      • GetWindowLongA.USER32(?,000000F4), ref: 00413681
                                                                                                                                                                                                      • SetWindowLongA.USER32(?,000000F4,?), ref: 00413694
                                                                                                                                                                                                      • SetPropA.USER32(?,00000000,00000000), ref: 004136AB
                                                                                                                                                                                                      • SetPropA.USER32(?,00000000,00000000), ref: 004136C2
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: LongWindow$Prop
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 3887896539-0
                                                                                                                                                                                                      • Opcode ID: 7846fecbe383e6d7fdaea4169180c186d89bab15e88d328ea810806c298c4441
                                                                                                                                                                                                      • Instruction ID: 06abc153636d574f2b9d5b42ed2ef1d3d1989bf2b09c04f5b7aa0ee96fd2bcf7
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 7846fecbe383e6d7fdaea4169180c186d89bab15e88d328ea810806c298c4441
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 1011C975100244BFEF00DF9DDC84EDA37E8EB19364F144666B958DB2A2D738DD908B68
                                                                                                                                                                                                      Function 00401A90 Relevance: 9.1, APIs: 6, Instructions: 59COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • RtlEnterCriticalSection.KERNEL32(0049B420,00000000,00401B68), ref: 00401ABD
                                                                                                                                                                                                      • LocalFree.KERNEL32(00000000,00000000,00401B68), ref: 00401ACF
                                                                                                                                                                                                      • VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,00000000,00401B68), ref: 00401AEE
                                                                                                                                                                                                      • LocalFree.KERNEL32(00000000,00000000,00000000,00008000,00000000,00000000,00401B68), ref: 00401B2D
                                                                                                                                                                                                      • RtlLeaveCriticalSection.KERNEL32(0049B420,00401B6F), ref: 00401B58
                                                                                                                                                                                                      • RtlDeleteCriticalSection.KERNEL32(0049B420,00401B6F), ref: 00401B62
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CriticalFreeSection$Local$DeleteEnterLeaveVirtual
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 3782394904-0
                                                                                                                                                                                                      • Opcode ID: ef0d8b2142be7cf42810e170793bf0a6b8446fdea194a224c38922696d0a74e0
                                                                                                                                                                                                      • Instruction ID: 79795942c165c44483fb09e1962e32eaca51f8de38df00e9c029d8aa05623ce8
                                                                                                                                                                                                      • Opcode Fuzzy Hash: ef0d8b2142be7cf42810e170793bf0a6b8446fdea194a224c38922696d0a74e0
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 3B118E30A003405AEB15AB65BE85B263BA5D761B08F44407BF80067BF3D77C5850E7AE
                                                                                                                                                                                                      Function 004556D8 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 142registryCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                        • Part of subcall function 0042DE1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,004836C7,?,00000001,?,?,004836C7,?,00000001,00000000), ref: 0042DE38
                                                                                                                                                                                                      • RegCloseKey.ADVAPI32(?,?,00000001,00000000,00000000,0045586F,?,00000000,004558AF), ref: 004557B5
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      • WININIT.INI, xrefs: 004557E4
                                                                                                                                                                                                      • SYSTEM\CurrentControlSet\Control\Session Manager, xrefs: 00455738
                                                                                                                                                                                                      • PendingFileRenameOperations2, xrefs: 00455784
                                                                                                                                                                                                      • PendingFileRenameOperations, xrefs: 00455754
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CloseOpen
                                                                                                                                                                                                      • String ID: PendingFileRenameOperations$PendingFileRenameOperations2$SYSTEM\CurrentControlSet\Control\Session Manager$WININIT.INI
                                                                                                                                                                                                      • API String ID: 47109696-2199428270
                                                                                                                                                                                                      • Opcode ID: ff5e046778063e7c615d5c8ac9a6b1d801ca0d933ef60992733312df31d3558f
                                                                                                                                                                                                      • Instruction ID: 0fa1da25f67206326559771d92c7e47b52ca8d856d575cc5f046ac455f5bab2a
                                                                                                                                                                                                      • Opcode Fuzzy Hash: ff5e046778063e7c615d5c8ac9a6b1d801ca0d933ef60992733312df31d3558f
                                                                                                                                                                                                      • Instruction Fuzzy Hash: FF51A974E006089FDB10EF61DC51AEEB7B9EF44305F50857BEC04A7292DB78AE49CA58
                                                                                                                                                                                                      Function 0047C684 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 101COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • CreateDirectoryA.KERNEL32(00000000,00000000,00000000,0047C7DA,?,?,00000000,0049B628,00000000,00000000,?,004980A9,00000000,00498252,?,00000000), ref: 0047C717
                                                                                                                                                                                                      • GetLastError.KERNEL32(00000000,00000000,00000000,0047C7DA,?,?,00000000,0049B628,00000000,00000000,?,004980A9,00000000,00498252,?,00000000), ref: 0047C720
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CreateDirectoryErrorLast
                                                                                                                                                                                                      • String ID: Created temporary directory: $\_setup64.tmp$_isetup
                                                                                                                                                                                                      • API String ID: 1375471231-2952887711
                                                                                                                                                                                                      • Opcode ID: f23027273586d22dc91d36c163fda7c4d2bba8e67a2e92b27164e12e8a6d5fbf
                                                                                                                                                                                                      • Instruction ID: edb20439a36284776f78bdf2a161e381ec1662189dfb35441dcb715623f8c11f
                                                                                                                                                                                                      • Opcode Fuzzy Hash: f23027273586d22dc91d36c163fda7c4d2bba8e67a2e92b27164e12e8a6d5fbf
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 6F410574A001099BDB01EBA5D8C2ADEB7B5EF44309F50547BE411B7392DB389E058F69
                                                                                                                                                                                                      Function 00452510 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 75COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • 751C1520.VERSION(00000000,?,?,?,ptI), ref: 00452530
                                                                                                                                                                                                      • 751C1500.VERSION(00000000,?,00000000,?,00000000,004525AB,?,00000000,?,?,?,ptI), ref: 0045255D
                                                                                                                                                                                                      • 751C1540.VERSION(?,004525D4,?,?,00000000,?,00000000,?,00000000,004525AB,?,00000000,?,?,?,ptI), ref: 00452577
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: C1500C1520C1540
                                                                                                                                                                                                      • String ID: ptI$%E
                                                                                                                                                                                                      • API String ID: 1315064709-3209181666
                                                                                                                                                                                                      • Opcode ID: f18440ec30d6a8502c14f0dca7f1c7caee1af709ad5b943411f89d38bbe9f821
                                                                                                                                                                                                      • Instruction ID: f5dca5bfdad9659449235e2d7a4f424f1fde127461be4d93bb02e754cc996b3f
                                                                                                                                                                                                      • Opcode Fuzzy Hash: f18440ec30d6a8502c14f0dca7f1c7caee1af709ad5b943411f89d38bbe9f821
                                                                                                                                                                                                      • Instruction Fuzzy Hash: D2218331A00608BFDB01DAA989519AFB7FCEB4A300F554477F800E7242E6B9AE04C765
                                                                                                                                                                                                      Function 00423A84 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • EnumWindows.USER32(00423A1C), ref: 00423AA8
                                                                                                                                                                                                      • GetWindow.USER32(?,00000003), ref: 00423ABD
                                                                                                                                                                                                      • GetWindowLongA.USER32(?,000000EC), ref: 00423ACC
                                                                                                                                                                                                      • SetWindowPos.USER32(00000000,\AB,00000000,00000000,00000000,00000000,00000013,?,000000EC,?,?,?,004241AB,?,?,00423D73), ref: 00423B02
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Window$EnumLongWindows
                                                                                                                                                                                                      • String ID: \AB
                                                                                                                                                                                                      • API String ID: 4191631535-3948367934
                                                                                                                                                                                                      • Opcode ID: bca5fbb655e429c390612aedafb62b4dde642c29ff44978b36ddb9eb5ee27a78
                                                                                                                                                                                                      • Instruction ID: 3ad81c14f5822e14e615a382c86082b2427cd388a5bf15486a3129e996868218
                                                                                                                                                                                                      • Opcode Fuzzy Hash: bca5fbb655e429c390612aedafb62b4dde642c29ff44978b36ddb9eb5ee27a78
                                                                                                                                                                                                      • Instruction Fuzzy Hash: D6115E70700610ABDB109F28E885F5677E8EB08715F10026AF994AB2E3C378ED41CB59
                                                                                                                                                                                                      Function 0042DE44 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 32registrylibraryloaderCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • RegDeleteKeyA.ADVAPI32(00000000,00000000), ref: 0042DE50
                                                                                                                                                                                                      • GetModuleHandleA.KERNEL32(advapi32.dll,RegDeleteKeyExA,?,00000000,0042DFEB,00000000,0042E003,?,?,?,?,00000006,?,00000000,004973CD), ref: 0042DE6B
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,advapi32.dll), ref: 0042DE71
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: AddressDeleteHandleModuleProc
                                                                                                                                                                                                      • String ID: RegDeleteKeyExA$advapi32.dll
                                                                                                                                                                                                      • API String ID: 588496660-1846899949
                                                                                                                                                                                                      • Opcode ID: ed1542cdc99e60fdc1e6205037aed1b156b4601bf62b1d4fa5b097ff81e7402e
                                                                                                                                                                                                      • Instruction ID: e7246de0df94fba710dd2820c0ca51643d5dd29c3ac0bea476bad59fd0e01b91
                                                                                                                                                                                                      • Opcode Fuzzy Hash: ed1542cdc99e60fdc1e6205037aed1b156b4601bf62b1d4fa5b097ff81e7402e
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 73E06DF1B41B30AAD72022657C8ABA33729DB75365F658437F105AD19183FC2C50CE9D
                                                                                                                                                                                                      Function 0046B984 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 320COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      • Need to restart Windows? %s, xrefs: 0046BD09
                                                                                                                                                                                                      • NextButtonClick, xrefs: 0046BAC0
                                                                                                                                                                                                      • PrepareToInstall failed: %s, xrefs: 0046BCE2
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                      • String ID: Need to restart Windows? %s$NextButtonClick$PrepareToInstall failed: %s
                                                                                                                                                                                                      • API String ID: 0-2329492092
                                                                                                                                                                                                      • Opcode ID: 490b2e74a464cf7520e00604ee2d45cc7022df190e8f8daa5fb17716187a3b63
                                                                                                                                                                                                      • Instruction ID: b95f389d09e957f91eb9f42d110418d47b08b3dab155efeebd7a2a0376f7d9ee
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 490b2e74a464cf7520e00604ee2d45cc7022df190e8f8daa5fb17716187a3b63
                                                                                                                                                                                                      • Instruction Fuzzy Hash: F2D12F34A04208DFCB10EBA9D585AED77F5EF09304F5440BAE404EB352D779AE81DB9A
                                                                                                                                                                                                      Function 00482B68 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 226COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • SetActiveWindow.USER32(?,?,00000000,00482EB9), ref: 00482C8C
                                                                                                                                                                                                      • SHChangeNotify.SHELL32(08000000,00000000,00000000,00000000), ref: 00482D2A
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: ActiveChangeNotifyWindow
                                                                                                                                                                                                      • String ID: $Need to restart Windows? %s
                                                                                                                                                                                                      • API String ID: 1160245247-4200181552
                                                                                                                                                                                                      • Opcode ID: 578bb09626bf16f427e9c3466d626182ab0c1498d51dc4c831d42f437cf610bb
                                                                                                                                                                                                      • Instruction ID: 086790f0fc0b942e3ee9f07944933bacbb32a26cbddea002bc31c7aef2919c1b
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 578bb09626bf16f427e9c3466d626182ab0c1498d51dc4c831d42f437cf610bb
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 60919F746002449FDB10FB69D9C5BAE7BE5AF59304F4484BBE8009B3A2C7B8AD05CB5D
                                                                                                                                                                                                      Function 0046F950 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 161COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                        • Part of subcall function 0042C804: GetFullPathNameA.KERNEL32(00000000,00001000,?), ref: 0042C828
                                                                                                                                                                                                      • GetLastError.KERNEL32(00000000,0046FB4D,?,?,0049C1DC,00000000), ref: 0046FA2A
                                                                                                                                                                                                      • SHChangeNotify.SHELL32(00000008,00000001,00000000,00000000), ref: 0046FAA4
                                                                                                                                                                                                      • SHChangeNotify.SHELL32(00001000,00001001,00000000,00000000), ref: 0046FAC9
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: ChangeNotify$ErrorFullLastNamePath
                                                                                                                                                                                                      • String ID: Creating directory: %s
                                                                                                                                                                                                      • API String ID: 2451617938-483064649
                                                                                                                                                                                                      • Opcode ID: fff36761d6b87b2bf6f3a77feb0b5b7e27b91a07a758255a60a3be3f41930be9
                                                                                                                                                                                                      • Instruction ID: 553d0e02451aea180b77d3c3bea8b04784d1aec5cd58197de2500155b30451aa
                                                                                                                                                                                                      • Opcode Fuzzy Hash: fff36761d6b87b2bf6f3a77feb0b5b7e27b91a07a758255a60a3be3f41930be9
                                                                                                                                                                                                      • Instruction Fuzzy Hash: E5516474E00248ABDB00DFA5D992BDEB7F5AF49304F50847AE850B7386D7786E08CB59
                                                                                                                                                                                                      Function 00454DD4 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 102libraryloaderCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,SfcIsFileProtected), ref: 00454E82
                                                                                                                                                                                                      • MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000FFF,00000000,00454F48), ref: 00454EEC
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: AddressByteCharMultiProcWide
                                                                                                                                                                                                      • String ID: SfcIsFileProtected$sfc.dll
                                                                                                                                                                                                      • API String ID: 2508298434-591603554
                                                                                                                                                                                                      • Opcode ID: b2872c537cb6cd03ad7726ff2c2bd0a0e2fc6763cd0da9df413ff005d177c2bc
                                                                                                                                                                                                      • Instruction ID: 0183ab2a96bad10459dc7acb776d15a29b7b4c70eaa7773bbc3cb8db3249cf06
                                                                                                                                                                                                      • Opcode Fuzzy Hash: b2872c537cb6cd03ad7726ff2c2bd0a0e2fc6763cd0da9df413ff005d177c2bc
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 1A419771A042189BEB20DB59DC85B9DB7B8EB4430DF5041B7E908A7293D7785F88CE1C
                                                                                                                                                                                                      Function 00416410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 89registryCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetClassInfoA.USER32(00400000,?,?), ref: 0041647F
                                                                                                                                                                                                      • UnregisterClassA.USER32(?,00400000), ref: 004164AB
                                                                                                                                                                                                      • RegisterClassA.USER32(?), ref: 004164CE
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Class$InfoRegisterUnregister
                                                                                                                                                                                                      • String ID: @
                                                                                                                                                                                                      • API String ID: 3749476976-2766056989
                                                                                                                                                                                                      • Opcode ID: edaa0b27323e1ef5a902df15cd742df43c623eda2d9d137e69ab4bddab8fe14c
                                                                                                                                                                                                      • Instruction ID: c77080f262680b7bd3c4c6a37e0a11d074b1995aa9dd52ebf92fb76dd285a693
                                                                                                                                                                                                      • Opcode Fuzzy Hash: edaa0b27323e1ef5a902df15cd742df43c623eda2d9d137e69ab4bddab8fe14c
                                                                                                                                                                                                      • Instruction Fuzzy Hash: B8316D702042409BD720EF69C981B9B77E5AB89308F04457FF949DB392DB39DD44CB6A
                                                                                                                                                                                                      Function 00404D2A Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 72windowCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • MessageBoxA.USER32(00000000,Runtime error at 00000000,Error,00000000), ref: 00404DC5
                                                                                                                                                                                                      • ExitProcess.KERNEL32 ref: 00404E0D
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: ExitMessageProcess
                                                                                                                                                                                                      • String ID: Error$Runtime error at 00000000
                                                                                                                                                                                                      • API String ID: 1220098344-2970929446
                                                                                                                                                                                                      • Opcode ID: 4aa0907dffceb0697d192a833af99b379258e6819ee5eddde657f3822e72bbb6
                                                                                                                                                                                                      • Instruction ID: e2df0dcbf1ce8e07228a8ae3c957e3f7be2bf5582065763199918d440bd3f461
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 4aa0907dffceb0697d192a833af99b379258e6819ee5eddde657f3822e72bbb6
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 8E219560A442414ADB11A779BA8571B3B91D7E5348F04817BE710A73E3C77C8C4487ED
                                                                                                                                                                                                      Function 0042ED38 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 55libraryloaderCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • SHAutoComplete.SHLWAPI(00000000,00000001), ref: 0042EDC5
                                                                                                                                                                                                        • Part of subcall function 0042D8C4: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0042D8D7
                                                                                                                                                                                                        • Part of subcall function 0042E394: SetErrorMode.KERNEL32(00008000), ref: 0042E39E
                                                                                                                                                                                                        • Part of subcall function 0042E394: LoadLibraryA.KERNEL32(00000000,00000000,0042E3E8,?,00000000,0042E406,?,00008000), ref: 0042E3CD
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,SHAutoComplete), ref: 0042EDA8
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: AddressAutoCompleteDirectoryErrorLibraryLoadModeProcSystem
                                                                                                                                                                                                      • String ID: SHAutoComplete$shlwapi.dll
                                                                                                                                                                                                      • API String ID: 395431579-1506664499
                                                                                                                                                                                                      • Opcode ID: 9bc7ff361d258be52dd27e2f74bcf33eed5b2b299b3a40fb55461f8ad11e2a91
                                                                                                                                                                                                      • Instruction ID: e807f919b0f5f47641bb36d66eaae5ab4e0d2818c3cb02d7dc2bc8906116ae4e
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 9bc7ff361d258be52dd27e2f74bcf33eed5b2b299b3a40fb55461f8ad11e2a91
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 3311A330B00319BBD711EB62FD85B8E7BA8DB55704F90447BF40066291DBB8AE05C65D
                                                                                                                                                                                                      Function 00455A10 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 41registryCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                        • Part of subcall function 0042DE1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,004836C7,?,00000001,?,?,004836C7,?,00000001,00000000), ref: 0042DE38
                                                                                                                                                                                                      • RegCloseKey.ADVAPI32(?,00455A7B,?,00000001,00000000), ref: 00455A6E
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      • PendingFileRenameOperations2, xrefs: 00455A4F
                                                                                                                                                                                                      • PendingFileRenameOperations, xrefs: 00455A40
                                                                                                                                                                                                      • SYSTEM\CurrentControlSet\Control\Session Manager, xrefs: 00455A1C
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CloseOpen
                                                                                                                                                                                                      • String ID: PendingFileRenameOperations$PendingFileRenameOperations2$SYSTEM\CurrentControlSet\Control\Session Manager
                                                                                                                                                                                                      • API String ID: 47109696-2115312317
                                                                                                                                                                                                      • Opcode ID: 9558350f34ddeb35ff12a6c57317cf96059e68c4625077236ac43c80a8283c08
                                                                                                                                                                                                      • Instruction ID: e9356c19d9a7d2c1b22529064790e486fb2be540b5bf165494b3782c633fa2c0
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 9558350f34ddeb35ff12a6c57317cf96059e68c4625077236ac43c80a8283c08
                                                                                                                                                                                                      • Instruction Fuzzy Hash: A3F0F671304A08BFDB04D661DC62A3B739CE744725FB08167F800CB682EA7CBD04915C
                                                                                                                                                                                                      Function 0047F7DC Relevance: 6.1, APIs: 4, Instructions: 147fileCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • FindNextFileA.KERNEL32(000000FF,?,?,?,?,00000000,0047F9D5,?,00000000,00000000,?,?,00480C2B,?,?,00000000), ref: 0047F882
                                                                                                                                                                                                      • FindClose.KERNEL32(000000FF,000000FF,?,?,?,?,00000000,0047F9D5,?,00000000,00000000,?,?,00480C2B,?,?), ref: 0047F88F
                                                                                                                                                                                                      • FindNextFileA.KERNEL32(000000FF,?,00000000,0047F9A8,?,?,?,?,00000000,0047F9D5,?,00000000,00000000,?,?,00480C2B), ref: 0047F984
                                                                                                                                                                                                      • FindClose.KERNEL32(000000FF,0047F9AF,0047F9A8,?,?,?,?,00000000,0047F9D5,?,00000000,00000000,?,?,00480C2B,?), ref: 0047F9A2
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Find$CloseFileNext
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 2066263336-0
                                                                                                                                                                                                      • Opcode ID: d71ed79f5e3cae8dbdb8f9366932315e37cb591a7859d28a8b9a768ac6bf17e9
                                                                                                                                                                                                      • Instruction ID: 945984253e7709c97adc8e2d755cc1877c70959f01d2b28a808f8207dce1d898
                                                                                                                                                                                                      • Opcode Fuzzy Hash: d71ed79f5e3cae8dbdb8f9366932315e37cb591a7859d28a8b9a768ac6bf17e9
                                                                                                                                                                                                      • Instruction Fuzzy Hash: FD513E71900648AFCB20EF65CC45ADEB7B8EB88315F1084BAA418E7351D7389F89CF55
                                                                                                                                                                                                      Function 00421274 Relevance: 6.1, APIs: 4, Instructions: 127windowCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetMenu.USER32(00000000), ref: 00421361
                                                                                                                                                                                                      • SetMenu.USER32(00000000,00000000), ref: 0042137E
                                                                                                                                                                                                      • SetMenu.USER32(00000000,00000000), ref: 004213B3
                                                                                                                                                                                                      • SetMenu.USER32(00000000,00000000), ref: 004213CF
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Menu
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 3711407533-0
                                                                                                                                                                                                      • Opcode ID: 011238806e8749de4259267c2425fab43e1a23b2a7ed20fe69ece2c0c4e48eae
                                                                                                                                                                                                      • Instruction ID: 68e231870b0c3442489bede8fdcf2aa1db34e154331db007d9f14f65c1163b63
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 011238806e8749de4259267c2425fab43e1a23b2a7ed20fe69ece2c0c4e48eae
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 4641AE3070425447EB20EA3AA9857AB36925B20308F4841BFFC40DF7A3CA7CDD45839D
                                                                                                                                                                                                      Function 00416B42 Relevance: 6.1, APIs: 4, Instructions: 67windowCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • SendMessageA.USER32(?,?,?,?), ref: 00416B84
                                                                                                                                                                                                      • SetTextColor.GDI32(?,00000000), ref: 00416B9E
                                                                                                                                                                                                      • SetBkColor.GDI32(?,00000000), ref: 00416BB8
                                                                                                                                                                                                      • CallWindowProcA.USER32(?,?,?,?,?), ref: 00416BE0
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Color$CallMessageProcSendTextWindow
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 601730667-0
                                                                                                                                                                                                      • Opcode ID: 072521f5090f240ceba025e33949739ce14f97652003165ca459573163e57643
                                                                                                                                                                                                      • Instruction ID: 4ea48ea5c9b96bae81565ca4ce64eb356f32bd46963e120bc97d04dec40f2685
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 072521f5090f240ceba025e33949739ce14f97652003165ca459573163e57643
                                                                                                                                                                                                      • Instruction Fuzzy Hash: BC115171705604AFD710EE6ECC84E8777ECEF49310715887EB959CB612C638F8418B69
                                                                                                                                                                                                      Function 00454F7C Relevance: 6.1, APIs: 4, Instructions: 54COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • WaitForInputIdle.USER32(?,00000032), ref: 00454FA8
                                                                                                                                                                                                      • MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000FF), ref: 00454FCA
                                                                                                                                                                                                      • GetExitCodeProcess.KERNEL32(?,?), ref: 00454FD9
                                                                                                                                                                                                      • CloseHandle.KERNEL32(?,00455006,00454FFF,?,?,?,00000000,?,?,004551DB,?,?,?,00000044,00000000,00000000), ref: 00454FF9
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Wait$CloseCodeExitHandleIdleInputMultipleObjectsProcess
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 4071923889-0
                                                                                                                                                                                                      • Opcode ID: 7a90289248fc1b73338e990bec893a2b2f0b3f31367c070c083f3916a619ed36
                                                                                                                                                                                                      • Instruction ID: ea90b2abd28d60bbe0c33bbe6d7a83e36ef454db8471bda6b5c19e9a906557d9
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 7a90289248fc1b73338e990bec893a2b2f0b3f31367c070c083f3916a619ed36
                                                                                                                                                                                                      • Instruction Fuzzy Hash: B9012D31A006097FEB1097AA8C02F6FBBECDF49764F610127F904D72C2C5788D409A78
                                                                                                                                                                                                      Function 004230C8 Relevance: 6.1, APIs: 4, Instructions: 54COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetDC.USER32(00000000), ref: 0042311E
                                                                                                                                                                                                      • EnumFontsA.GDI32(00000000,00000000,00423068,00410460,00000000,?,?,00000000,?,00418FD3,00000000,?,?,?,00000001), ref: 00423131
                                                                                                                                                                                                      • GetDeviceCaps.GDI32(00000000,0000005A), ref: 00423139
                                                                                                                                                                                                      • ReleaseDC.USER32(00000000,00000000), ref: 00423144
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CapsDeviceEnumFontsRelease
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 2698912916-0
                                                                                                                                                                                                      • Opcode ID: ae3b46bdf4144dece9088701a44aa945a4d7eb571b2044da6dc5baa79edeb2ca
                                                                                                                                                                                                      • Instruction ID: a9d24610abdaa6694e735d00c6d38f20457f2ac5f1468c421a1b182fb2ef8db9
                                                                                                                                                                                                      • Opcode Fuzzy Hash: ae3b46bdf4144dece9088701a44aa945a4d7eb571b2044da6dc5baa79edeb2ca
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 8D01CC716042102AE700BF6A5C82B9B3AA49F01319F40027BF808AA3C6DA7E980547AE
                                                                                                                                                                                                      Function 0047C838 Relevance: 6.0, APIs: 4, Instructions: 35sleepCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: ErrorLast$CountSleepTick
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 2227064392-0
                                                                                                                                                                                                      • Opcode ID: 38f5d04c3eac98d085fcff285c4b3ae2f20cb312c74cbf7026be5c9a809c06d4
                                                                                                                                                                                                      • Instruction ID: 6dd2862dcb574814dc985a52fd8bef393983683767be68f312e29577703bd9fd
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 38f5d04c3eac98d085fcff285c4b3ae2f20cb312c74cbf7026be5c9a809c06d4
                                                                                                                                                                                                      • Instruction Fuzzy Hash: C4E0E5623291114D862935FE18D25AF4984CBC23A6B2A453FE088D6242C8584D05467F
                                                                                                                                                                                                      Function 0045C0B4 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 166COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                        • Part of subcall function 0045092C: SetEndOfFile.KERNEL32(?,?,0045C192,00000000,0045C31D,?,00000000,00000002,00000002), ref: 00450933
                                                                                                                                                                                                      • FlushFileBuffers.KERNEL32(?), ref: 0045C2E9
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      • NumRecs range exceeded, xrefs: 0045C1E6
                                                                                                                                                                                                      • EndOffset range exceeded, xrefs: 0045C21D
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: File$BuffersFlush
                                                                                                                                                                                                      • String ID: EndOffset range exceeded$NumRecs range exceeded
                                                                                                                                                                                                      • API String ID: 3593489403-659731555
                                                                                                                                                                                                      • Opcode ID: 8bf98c9d60884cf3bb303afe6a2d902a3b8c4cda653ee0cbd8c8d24135a36091
                                                                                                                                                                                                      • Instruction ID: 054e4d8252a4b7fe708e1d13fc1942b3136e6dcde41ac9beef610e5760cb7d56
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 8bf98c9d60884cf3bb303afe6a2d902a3b8c4cda653ee0cbd8c8d24135a36091
                                                                                                                                                                                                      • Instruction Fuzzy Hash: D3615434A002588FDB25DF25D881AD9B7B5AF49305F0084DAED89AB353D774AEC8CF54
                                                                                                                                                                                                      Function 00483070 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 123COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetForegroundWindow.USER32(00000000,004831FA,?,00000000,0048323B,?,?,?,?,00000000,00000000,00000000,?,0046BC0D), ref: 004830A9
                                                                                                                                                                                                      • SetActiveWindow.USER32(?,00000000,004831FA,?,00000000,0048323B,?,?,?,?,00000000,00000000,00000000,?,0046BC0D), ref: 004830BB
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      • Will not restart Windows automatically., xrefs: 004831DA
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Window$ActiveForeground
                                                                                                                                                                                                      • String ID: Will not restart Windows automatically.
                                                                                                                                                                                                      • API String ID: 307657957-4169339592
                                                                                                                                                                                                      • Opcode ID: 7fd75d1fe03ea15687e233c32779d02ba9d1da470a9ba52b664817fbd1389c1d
                                                                                                                                                                                                      • Instruction ID: 14d12ce259a9d91e5540598a1459cb212717435f7278461c6eeed3650d71e2e9
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 7fd75d1fe03ea15687e233c32779d02ba9d1da470a9ba52b664817fbd1389c1d
                                                                                                                                                                                                      • Instruction Fuzzy Hash: E7415530304280AEE701FF64DDAAB6DBBA0AB56F05F104CB7E8404B3A2C67D1A01DB5D
                                                                                                                                                                                                      Function 00498718 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 119COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                        • Part of subcall function 00403344: GetModuleHandleA.KERNEL32(00000000,00498726), ref: 0040334B
                                                                                                                                                                                                        • Part of subcall function 00403344: GetCommandLineA.KERNEL32(00000000,00498726), ref: 00403356
                                                                                                                                                                                                        • Part of subcall function 0040631C: GetModuleHandleA.KERNEL32(kernel32.dll,?,00498730), ref: 00406322
                                                                                                                                                                                                        • Part of subcall function 0040631C: GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 0040632F
                                                                                                                                                                                                        • Part of subcall function 0040631C: GetProcAddress.KERNEL32(00000000,SetSearchPathMode), ref: 00406345
                                                                                                                                                                                                        • Part of subcall function 0040631C: GetProcAddress.KERNEL32(00000000,SetProcessDEPPolicy), ref: 0040635B
                                                                                                                                                                                                        • Part of subcall function 0040631C: SetProcessDEPPolicy.KERNEL32(00000001,00000000,SetProcessDEPPolicy,00000000,SetSearchPathMode,kernel32.dll,?,00498730), ref: 00406366
                                                                                                                                                                                                        • Part of subcall function 004063C4: 6F9C1CD0.COMCTL32(00498735), ref: 004063C4
                                                                                                                                                                                                        • Part of subcall function 00410764: GetCurrentThreadId.KERNEL32 ref: 004107B2
                                                                                                                                                                                                        • Part of subcall function 00419040: GetVersion.KERNEL32(0049874E), ref: 00419040
                                                                                                                                                                                                        • Part of subcall function 0044F744: GetModuleHandleA.KERNEL32(user32.dll,NotifyWinEvent,00498762), ref: 0044F77F
                                                                                                                                                                                                        • Part of subcall function 0044F744: GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0044F785
                                                                                                                                                                                                        • Part of subcall function 0044FC10: GetVersionExA.KERNEL32(0049B790,00498767), ref: 0044FC1F
                                                                                                                                                                                                        • Part of subcall function 004531F0: GetModuleHandleA.KERNEL32(kernel32.dll,Wow64DisableWow64FsRedirection,00000000,00453289,?,?,?,?,00000000,?,00498776), ref: 00453210
                                                                                                                                                                                                        • Part of subcall function 004531F0: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00453216
                                                                                                                                                                                                        • Part of subcall function 004531F0: GetModuleHandleA.KERNEL32(kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000,00453289,?,?,?,?,00000000,?,00498776), ref: 0045322A
                                                                                                                                                                                                        • Part of subcall function 004531F0: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00453230
                                                                                                                                                                                                        • Part of subcall function 00456F00: GetProcAddress.KERNEL32(00000000,SHCreateItemFromParsingName), ref: 00456F24
                                                                                                                                                                                                        • Part of subcall function 00464468: LoadLibraryA.KERNEL32(shell32.dll,SHPathPrepareForWriteA,0049878A), ref: 00464477
                                                                                                                                                                                                        • Part of subcall function 00464468: GetProcAddress.KERNEL32(00000000,shell32.dll), ref: 0046447D
                                                                                                                                                                                                        • Part of subcall function 0046CC64: GetProcAddress.KERNEL32(00000000,SHPathPrepareForWriteA), ref: 0046CC79
                                                                                                                                                                                                        • Part of subcall function 00478740: GetModuleHandleA.KERNEL32(kernel32.dll,?,00498794), ref: 00478746
                                                                                                                                                                                                        • Part of subcall function 00478740: GetProcAddress.KERNEL32(00000000,VerSetConditionMask), ref: 00478753
                                                                                                                                                                                                        • Part of subcall function 00478740: GetProcAddress.KERNEL32(00000000,VerifyVersionInfoW), ref: 00478763
                                                                                                                                                                                                        • Part of subcall function 00483A6C: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 00483B5B
                                                                                                                                                                                                        • Part of subcall function 00495724: RegisterClipboardFormatA.USER32(QueryCancelAutoPlay), ref: 0049573D
                                                                                                                                                                                                      • SetErrorMode.KERNEL32(00000001,00000000,004987DC), ref: 004987AE
                                                                                                                                                                                                        • Part of subcall function 004984D8: GetModuleHandleA.KERNEL32(user32.dll,DisableProcessWindowsGhosting,004987B8,00000001,00000000,004987DC), ref: 004984E2
                                                                                                                                                                                                        • Part of subcall function 004984D8: GetProcAddress.KERNEL32(00000000,user32.dll), ref: 004984E8
                                                                                                                                                                                                        • Part of subcall function 004244D4: SendMessageA.USER32(?,0000B020,00000000,?), ref: 004244F3
                                                                                                                                                                                                        • Part of subcall function 004242C4: SetWindowTextA.USER32(?,00000000), ref: 004242DC
                                                                                                                                                                                                      • ShowWindow.USER32(?,00000005,00000000,004987DC), ref: 0049880F
                                                                                                                                                                                                        • Part of subcall function 004820AC: SetActiveWindow.USER32(?), ref: 0048215A
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: AddressProc$HandleModule$Window$Version$ActiveClipboardCommandCurrentErrorFormatLibraryLineLoadMessageModePolicyProcessRegisterSendShowTextThread
                                                                                                                                                                                                      • String ID: Setup
                                                                                                                                                                                                      • API String ID: 504348408-3839654196
                                                                                                                                                                                                      • Opcode ID: 4026870168645be20c4e504289bca16f7fc9894158eff1610b8fe089479f565d
                                                                                                                                                                                                      • Instruction ID: 72ad643eee306aeb53380572695708c68149a0501138caf3355f256a6ce1e3ac
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 4026870168645be20c4e504289bca16f7fc9894158eff1610b8fe089479f565d
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 7931C5712046409ED705BBBBAC5392D3B94EF8A728BA2447FF80486593DE3C58508A7F
                                                                                                                                                                                                      Function 00453A24 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 83COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • CreateDirectoryA.KERNEL32(00000000,00000000,?,00000000,00453B13,?,?,00000000,0049B628,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00453A6A
                                                                                                                                                                                                      • GetLastError.KERNEL32(00000000,00000000,?,00000000,00453B13,?,?,00000000,0049B628,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00453A73
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CreateDirectoryErrorLast
                                                                                                                                                                                                      • String ID: .tmp
                                                                                                                                                                                                      • API String ID: 1375471231-2986845003
                                                                                                                                                                                                      • Opcode ID: 3642c0b96ae942dc1c792259ad0b0452526e562a8a627ea9b4e70994377075dc
                                                                                                                                                                                                      • Instruction ID: ea6adcadec8e2c01cafa1ba510acc1338588d6ec7b4e1cf88163bb5bfef62d35
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 3642c0b96ae942dc1c792259ad0b0452526e562a8a627ea9b4e70994377075dc
                                                                                                                                                                                                      • Instruction Fuzzy Hash: A9213575A002089BDB01EFA1C8429DEB7B8EF49305F50457BE801B7343DA3CAF058B69
                                                                                                                                                                                                      Function 00455290 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 77COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • ShellExecuteEx.SHELL32(0000003C), ref: 0045532C
                                                                                                                                                                                                      • GetLastError.KERNEL32(0000003C,00000000,00455375,?,?,?), ref: 0045533D
                                                                                                                                                                                                        • Part of subcall function 0042D8C4: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0042D8D7
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: DirectoryErrorExecuteLastShellSystem
                                                                                                                                                                                                      • String ID: <
                                                                                                                                                                                                      • API String ID: 893404051-4251816714
                                                                                                                                                                                                      • Opcode ID: 47c2adcd3f7a191c5fcf73870fd18e6840a4fbb1278b5499c59c113412add8ef
                                                                                                                                                                                                      • Instruction ID: 92df0b2f1231c5c49ece4c570041ef31d6ed92e86db86b93cafb864a5026e18c
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 47c2adcd3f7a191c5fcf73870fd18e6840a4fbb1278b5499c59c113412add8ef
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 172167B0600609ABDB10EF65C8926AE7BE8AF44355F54403AFC44E7291D7789E49CB98
                                                                                                                                                                                                      Function 00483A6C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 68libraryloaderCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                        • Part of subcall function 00483560: GetModuleHandleA.KERNEL32(kernel32.dll), ref: 00483571
                                                                                                                                                                                                        • Part of subcall function 00483560: GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 0048357E
                                                                                                                                                                                                        • Part of subcall function 00483560: GetNativeSystemInfo.KERNELBASE(?,00000000,GetNativeSystemInfo,kernel32.dll), ref: 0048358C
                                                                                                                                                                                                        • Part of subcall function 00483560: GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 00483594
                                                                                                                                                                                                        • Part of subcall function 00483560: GetCurrentProcess.KERNEL32(?,00000000,IsWow64Process), ref: 004835A0
                                                                                                                                                                                                        • Part of subcall function 00483560: GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryA), ref: 004835C1
                                                                                                                                                                                                        • Part of subcall function 00483560: GetModuleHandleA.KERNEL32(advapi32.dll,RegDeleteKeyExA,00000000,GetSystemWow64DirectoryA,?,00000000,IsWow64Process), ref: 004835D4
                                                                                                                                                                                                        • Part of subcall function 00483560: GetProcAddress.KERNEL32(00000000,advapi32.dll), ref: 004835DA
                                                                                                                                                                                                        • Part of subcall function 0048388C: GetVersionExA.KERNEL32(?,00483A9E,00000000,00483B73,?,?,?,?,?,00498799), ref: 0048389A
                                                                                                                                                                                                        • Part of subcall function 0048388C: GetVersionExA.KERNEL32(0000009C,?,00483A9E,00000000,00483B73,?,?,?,?,?,00498799), ref: 004838EC
                                                                                                                                                                                                        • Part of subcall function 0042E394: SetErrorMode.KERNEL32(00008000), ref: 0042E39E
                                                                                                                                                                                                        • Part of subcall function 0042E394: LoadLibraryA.KERNEL32(00000000,00000000,0042E3E8,?,00000000,0042E406,?,00008000), ref: 0042E3CD
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 00483B5B
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: AddressProc$HandleModuleVersion$CurrentErrorInfoLibraryLoadModeNativeProcessSystem
                                                                                                                                                                                                      • String ID: SHGetKnownFolderPath$shell32.dll
                                                                                                                                                                                                      • API String ID: 3869789854-2936008475
                                                                                                                                                                                                      • Opcode ID: 36bbd7205677a14235ded179242f98fe4396733ea939f399f849956901c26b03
                                                                                                                                                                                                      • Instruction ID: 33d3db6593e9873a674f830e342c1c65c6cab746408e9d399a43700aa418428b
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 36bbd7205677a14235ded179242f98fe4396733ea939f399f849956901c26b03
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 672100B06503516EC300BF7E59A661A3BA5EB5474C380893FF804EB3D2D77E68145BAE
                                                                                                                                                                                                      Function 0047C0C8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36registryCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • RegCloseKey.ADVAPI32(?,?,00000001,00000000,?,?,?,0047C41C,00000000,0047C432), ref: 0047C12A
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Close
                                                                                                                                                                                                      • String ID: RegisteredOrganization$RegisteredOwner
                                                                                                                                                                                                      • API String ID: 3535843008-1113070880
                                                                                                                                                                                                      • Opcode ID: 0e90ec8331aa68b80fdbd6afaabfad8867ded4c3b6cad332e65b349247218e2d
                                                                                                                                                                                                      • Instruction ID: 6af266579ce0f4cae339b7a6725c06c490679c1ac7d4d5cc7f46b4f942b6f465
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 0e90ec8331aa68b80fdbd6afaabfad8867ded4c3b6cad332e65b349247218e2d
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 32F0B430704244AFDB04DAA8EDD2BAA776AD741304FA4803FE1048F382D679DE019BAC
                                                                                                                                                                                                      Function 004750C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28fileCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • CreateFileA.KERNEL32(00000000,C0000000,00000000,00000000,00000001,00000080,00000000,00000000,?,004752F7), ref: 004750E5
                                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000,00000000,C0000000,00000000,00000000,00000001,00000080,00000000,00000000,?,004752F7), ref: 004750FC
                                                                                                                                                                                                        • Part of subcall function 0045349C: GetLastError.KERNEL32(00000000,00454031,00000005,00000000,00454066,?,?,00000000,0049B628,00000004,00000000,00000000,00000000,?,00497F15,00000000), ref: 0045349F
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CloseCreateErrorFileHandleLast
                                                                                                                                                                                                      • String ID: CreateFile
                                                                                                                                                                                                      • API String ID: 2528220319-823142352
                                                                                                                                                                                                      • Opcode ID: bbf61bf67fe349c097a8a02b07410db95704594b340b54041ead5b805cfa0960
                                                                                                                                                                                                      • Instruction ID: 6399d4087dc53d24fa9d3bc8bb06fd86b45c214eecae9240140a798b65cacfb0
                                                                                                                                                                                                      • Opcode Fuzzy Hash: bbf61bf67fe349c097a8a02b07410db95704594b340b54041ead5b805cfa0960
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 18E06D302407447BEA10FA69CCC6F4A77989B04768F10C162FA48AF3E2C5B9EC408658
                                                                                                                                                                                                      Function 00456F00 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 11libraryloaderCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                        • Part of subcall function 00456E90: CoInitialize.OLE32(00000000), ref: 00456E96
                                                                                                                                                                                                        • Part of subcall function 0042E394: SetErrorMode.KERNEL32(00008000), ref: 0042E39E
                                                                                                                                                                                                        • Part of subcall function 0042E394: LoadLibraryA.KERNEL32(00000000,00000000,0042E3E8,?,00000000,0042E406,?,00008000), ref: 0042E3CD
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,SHCreateItemFromParsingName), ref: 00456F24
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: AddressErrorInitializeLibraryLoadModeProc
                                                                                                                                                                                                      • String ID: SHCreateItemFromParsingName$shell32.dll
                                                                                                                                                                                                      • API String ID: 2906209438-2320870614
                                                                                                                                                                                                      • Opcode ID: 3ee7a517847f468c0619dab237ccb69dbf9a8b231eaadc82d937c3bc473404de
                                                                                                                                                                                                      • Instruction ID: 06a1b1eafb8ede6a4ef061af05be88198505768e1dcfa776260a5a664dfb1d55
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 3ee7a517847f468c0619dab237ccb69dbf9a8b231eaadc82d937c3bc473404de
                                                                                                                                                                                                      • Instruction Fuzzy Hash: BBC04CA1F5271156CA00BBFA655361F2805DB5031FBD2803FB948A7587CE7C9C095B6E
                                                                                                                                                                                                      Function 0046CC64 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 8libraryloaderCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                        • Part of subcall function 0042E394: SetErrorMode.KERNEL32(00008000), ref: 0042E39E
                                                                                                                                                                                                        • Part of subcall function 0042E394: LoadLibraryA.KERNEL32(00000000,00000000,0042E3E8,?,00000000,0042E406,?,00008000), ref: 0042E3CD
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,SHPathPrepareForWriteA), ref: 0046CC79
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: AddressErrorLibraryLoadModeProc
                                                                                                                                                                                                      • String ID: SHPathPrepareForWriteA$shell32.dll
                                                                                                                                                                                                      • API String ID: 2492108670-2683653824
                                                                                                                                                                                                      • Opcode ID: 86cf81fee744bb21f40f36152ca0a59654e50c5ee39d1ae44c17eff86845b0ac
                                                                                                                                                                                                      • Instruction ID: d379c4162c5a45317e257a8b9368072ef34678a45322f04a033aff34d3fd6743
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 86cf81fee744bb21f40f36152ca0a59654e50c5ee39d1ae44c17eff86845b0ac
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 4BB092A06027018ADB00F7F258A662B28099B40319B20803B71889B685EE3C88004BAF
                                                                                                                                                                                                      Function 00481760 Relevance: 4.6, APIs: 3, Instructions: 98windowCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetSystemMenu.USER32(00000000,00000000,00000000,00481898), ref: 00481830
                                                                                                                                                                                                      • AppendMenuA.USER32(00000000,00000800,00000000,00000000), ref: 00481841
                                                                                                                                                                                                      • AppendMenuA.USER32(00000000,00000000,0000270F,00000000), ref: 00481859
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Menu$Append$System
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 1489644407-0
                                                                                                                                                                                                      • Opcode ID: d933746ff7b66401e606975732ccc260a02719cdd81df1f2e9532199b1c22675
                                                                                                                                                                                                      • Instruction ID: 2579a7d5db53e33ee4863251c1290a2b13440539eb68b17f0e677d1311332c65
                                                                                                                                                                                                      • Opcode Fuzzy Hash: d933746ff7b66401e606975732ccc260a02719cdd81df1f2e9532199b1c22675
                                                                                                                                                                                                      • Instruction Fuzzy Hash: A131A3307043445AD721BB769C83B6E3B989F55718F54587FF8009A2E3CA7C9D0A879D
                                                                                                                                                                                                      Function 0044B38C Relevance: 4.6, APIs: 3, Instructions: 74COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetDC.USER32(00000000), ref: 0044B401
                                                                                                                                                                                                      • SelectObject.GDI32(?,00000000), ref: 0044B424
                                                                                                                                                                                                      • ReleaseDC.USER32(00000000,?), ref: 0044B457
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: ObjectReleaseSelect
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 1831053106-0
                                                                                                                                                                                                      • Opcode ID: 71686dd1bf2aceb477ce3f8db4b541325f82ff5bc32dc74031120fde16d0cea8
                                                                                                                                                                                                      • Instruction ID: 242bcfed98594cbdcf51f2854abe94a1ec69c13560e3a72339b9f4254961cc58
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 71686dd1bf2aceb477ce3f8db4b541325f82ff5bc32dc74031120fde16d0cea8
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 62216570A04248AFEB15DFA6C841B9F7BB9DB49304F11806AF904A7682D778D940CB59
                                                                                                                                                                                                      Function 0044B0C0 Relevance: 4.6, APIs: 3, Instructions: 72COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00000000,0044B14C,?,004820C7,?,?), ref: 0044B11E
                                                                                                                                                                                                      • DrawTextW.USER32(?,?,00000000,?,?), ref: 0044B131
                                                                                                                                                                                                      • DrawTextA.USER32(?,00000000,00000000,?,?), ref: 0044B165
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: DrawText$ByteCharMultiWide
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 65125430-0
                                                                                                                                                                                                      • Opcode ID: 48900d8d8fc19135f8d19aada3e9e9d8d34cb92564939e70bb5bc2663f887e99
                                                                                                                                                                                                      • Instruction ID: fec6fabf6d030a51aab30bc406273ff78954f96defe81b00f374268ef7e1f253
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 48900d8d8fc19135f8d19aada3e9e9d8d34cb92564939e70bb5bc2663f887e99
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 2A11CBB27046047FEB00DB6A9C91D6F77ECDB49750F10817BF504D72D0D6399E018669
                                                                                                                                                                                                      Function 004243FC Relevance: 4.6, APIs: 3, Instructions: 59windowCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 00424412
                                                                                                                                                                                                      • TranslateMessage.USER32(?), ref: 0042448F
                                                                                                                                                                                                      • DispatchMessageA.USER32(?), ref: 00424499
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Message$DispatchPeekTranslate
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 4217535847-0
                                                                                                                                                                                                      • Opcode ID: d4f7142ddfb2041a0388c754ad29f8297397d1c5d5a6fc901d04af05902ad934
                                                                                                                                                                                                      • Instruction ID: 8eae6dca0d2455523dd27ca57e4683f6da326f6f2f90499d04ddbfd693f83f9d
                                                                                                                                                                                                      • Opcode Fuzzy Hash: d4f7142ddfb2041a0388c754ad29f8297397d1c5d5a6fc901d04af05902ad934
                                                                                                                                                                                                      • Instruction Fuzzy Hash: E3116D303043205AEB20FA24A941B9F73D4DFC5758F80481EFC99972C2D77D9D49879A
                                                                                                                                                                                                      Function 00416644 Relevance: 4.5, APIs: 3, Instructions: 39COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • SetPropA.USER32(00000000,00000000), ref: 0041666A
                                                                                                                                                                                                      • SetPropA.USER32(00000000,00000000), ref: 0041667F
                                                                                                                                                                                                      • SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,00000000,00000000,?,00000000,00000000), ref: 004166A6
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Prop$Window
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 3363284559-0
                                                                                                                                                                                                      • Opcode ID: ff8df5d04f2ecdb5f17762fdbd8b59dc717163ef82ea70d213bab306533cf9bb
                                                                                                                                                                                                      • Instruction ID: 6913c5f2d07602d921388148e43cadd8ab2d6729f30613f48e4cae6714e3bc13
                                                                                                                                                                                                      • Opcode Fuzzy Hash: ff8df5d04f2ecdb5f17762fdbd8b59dc717163ef82ea70d213bab306533cf9bb
                                                                                                                                                                                                      • Instruction Fuzzy Hash: ACF01271701210ABDB10AB599C85FA732DCAB09714F16057AB905EF286C778DC40C7A8
                                                                                                                                                                                                      Function 0041EE54 Relevance: 4.5, APIs: 3, Instructions: 27windowCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • IsWindowVisible.USER32(?), ref: 0041EE64
                                                                                                                                                                                                      • IsWindowEnabled.USER32(?), ref: 0041EE6E
                                                                                                                                                                                                      • EnableWindow.USER32(?,00000000), ref: 0041EE94
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Window$EnableEnabledVisible
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 3234591441-0
                                                                                                                                                                                                      • Opcode ID: 495d6a49dc4b54b7e424eeae3cce025a94256eba33976185de8149e812397146
                                                                                                                                                                                                      • Instruction ID: 3b4cb379701a2ac24b7d0c87bf9454d2e26b3d0fb89a85d5a5a22e513a73856b
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 495d6a49dc4b54b7e424eeae3cce025a94256eba33976185de8149e812397146
                                                                                                                                                                                                      • Instruction Fuzzy Hash: EAE06DB5100301AAE301AB2BDC81B5B7A9CAB54350F05843BA9089B292D63ADC408B7C
                                                                                                                                                                                                      Function 00482F00 Relevance: 4.5, APIs: 3, Instructions: 25threadCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetForegroundWindow.USER32(00000000,00000000,?,?,00482F65,?,0048304A,?,?,00000000), ref: 00482F06
                                                                                                                                                                                                      • GetWindowThreadProcessId.USER32(00000000,?), ref: 00482F18
                                                                                                                                                                                                      • GetCurrentProcessId.KERNEL32(00000000,?,00000000,00000000,?,?,00482F65,?,0048304A,?,?,00000000), ref: 00482F21
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: ProcessWindow$CurrentForegroundThread
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 3477312055-0
                                                                                                                                                                                                      • Opcode ID: 982b7c28898e91d336e4c92c16d26505a5b0c1b6108dfd8263cdc1cd6946a2c9
                                                                                                                                                                                                      • Instruction ID: 842f7e69b7392d8f05dadf12e6a5d85353db318e418c724dfe05613eb92887f7
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 982b7c28898e91d336e4c92c16d26505a5b0c1b6108dfd8263cdc1cd6946a2c9
                                                                                                                                                                                                      • Instruction Fuzzy Hash: D7D0C233505A2A6E6611F5E55D818AFB36CCD01398315017BFE04A3241D7A89E0486BD
                                                                                                                                                                                                      Function 00469D90 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 232COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • SetActiveWindow.USER32(?), ref: 00469EA1
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: ActiveWindow
                                                                                                                                                                                                      • String ID: PrepareToInstall
                                                                                                                                                                                                      • API String ID: 2558294473-1101760603
                                                                                                                                                                                                      • Opcode ID: 1fbe4651e59d525787342a10e43af15516f0d5ccc6715f1dd950ca7e12eb6a87
                                                                                                                                                                                                      • Instruction ID: ccacc6dcba8b8cbbfa1c17f86b27e08b0c11e5798d11daccd90c331c988b02c3
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 1fbe4651e59d525787342a10e43af15516f0d5ccc6715f1dd950ca7e12eb6a87
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 7EA11934A00109DFCB00EF59D986EDEB7F5AF48304F6580B6E404AB366D778AE41DB99
                                                                                                                                                                                                      Function 0046C330 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 209COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                      • String ID: /:*?"<>|
                                                                                                                                                                                                      • API String ID: 0-4078764451
                                                                                                                                                                                                      • Opcode ID: 43277fb1c717e2606564b112b1b0681d416f5021830c97b09ce096e65d7cf365
                                                                                                                                                                                                      • Instruction ID: 1e87f3d38ec7dbf16fc1afa4daea9e6ca85b65b9a8fb7c68475855461939e3a0
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 43277fb1c717e2606564b112b1b0681d416f5021830c97b09ce096e65d7cf365
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 4371A470A40214ABDB10EB66DDD2BEE77A19F40308F1084A7F580AB392E779AD45875F
                                                                                                                                                                                                      Function 004820AC Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 58COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • SetActiveWindow.USER32(?), ref: 0048215A
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: ActiveWindow
                                                                                                                                                                                                      • String ID: InitializeWizard
                                                                                                                                                                                                      • API String ID: 2558294473-2356795471
                                                                                                                                                                                                      • Opcode ID: 16a9dc39c4158835143d7d45412b6ec0e02973fc1ea34eaa9527db297379c07e
                                                                                                                                                                                                      • Instruction ID: 36b0f45b5e581da985bac651985c8aaa8d6a9bed6a39233588f506be3a995c8b
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 16a9dc39c4158835143d7d45412b6ec0e02973fc1ea34eaa9527db297379c07e
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 79119434205200AFD701FBA9EEDAB1937E4EB59328F60047BF5009B6A1DA796C00CB5D
                                                                                                                                                                                                      Function 0047C88C Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 51COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      • Failed to remove temporary directory: , xrefs: 0047C8EF
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CountTick
                                                                                                                                                                                                      • String ID: Failed to remove temporary directory:
                                                                                                                                                                                                      • API String ID: 536389180-3544197614
                                                                                                                                                                                                      • Opcode ID: f9bc668b0367bd16aeb61581f42f6c64efb7415d7a328cc03232e9703b58b720
                                                                                                                                                                                                      • Instruction ID: db65feaf4d2351fb67e5e2e33a446e3d8746ae63d214571eb0dd2c42bc0de3b8
                                                                                                                                                                                                      • Opcode Fuzzy Hash: f9bc668b0367bd16aeb61581f42f6c64efb7415d7a328cc03232e9703b58b720
                                                                                                                                                                                                      • Instruction Fuzzy Hash: D501F5B0204604BBEB11FB72DCC3FCA3798DB44709F60847FBA04A6292DA7C9A48D51C
                                                                                                                                                                                                      Function 0047BFE4 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 39registryCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                        • Part of subcall function 0042DE1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,004836C7,?,00000001,?,?,004836C7,?,00000001,00000000), ref: 0042DE38
                                                                                                                                                                                                      • RegCloseKey.ADVAPI32(?,?,00000001,00000000,?,?,?,?,?,0047C230,00000000,0047C432), ref: 0047C029
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      • Software\Microsoft\Windows\CurrentVersion, xrefs: 0047BFF9
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CloseOpen
                                                                                                                                                                                                      • String ID: Software\Microsoft\Windows\CurrentVersion
                                                                                                                                                                                                      • API String ID: 47109696-1019749484
                                                                                                                                                                                                      • Opcode ID: 91d5c32787d00ddb3ecc29a404e36154aacf37a6ecdb6076e024b20848598476
                                                                                                                                                                                                      • Instruction ID: 5930872802659161668f2fc27ec2b8a5c579264ce8ecaca434dd7baa373bea44
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 91d5c32787d00ddb3ecc29a404e36154aacf37a6ecdb6076e024b20848598476
                                                                                                                                                                                                      • Instruction Fuzzy Hash: B1F08231700514A7DA00A69E6D82B9BA79D9B84758F20403FF508DB242DABE9E0202EC
                                                                                                                                                                                                      Function 0046ECB8 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 34registryCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • RegSetValueExA.ADVAPI32(?,Inno Setup: Setup Version,00000000,00000001,00000000,00000001,00475FFE,?,0049C1DC,?,0046EFCF,?,00000000,0046F56A,?,_is1), ref: 0046ECDB
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      • Inno Setup: Setup Version, xrefs: 0046ECD9
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Value
                                                                                                                                                                                                      • String ID: Inno Setup: Setup Version
                                                                                                                                                                                                      • API String ID: 3702945584-4166306022
                                                                                                                                                                                                      • Opcode ID: cfedfcb8e60698f18e741e08fc6847c096e8936c7941a25738a13fb6c90d91fa
                                                                                                                                                                                                      • Instruction ID: 3111e2ab1a00cbee8849f506c2bc3fe53732bb3e30b7299e44938699edfd3f7c
                                                                                                                                                                                                      • Opcode Fuzzy Hash: cfedfcb8e60698f18e741e08fc6847c096e8936c7941a25738a13fb6c90d91fa
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 71E06D753012043FE710AA2B9C85F5BBBDCDF99765F10403AB909DB392D978DD0085A8
                                                                                                                                                                                                      Function 0046ED28 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 24registryCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • RegSetValueExA.ADVAPI32(?,NoModify,00000000,00000004,00000000,00000004,00000001,?,0046F3A6,?,?,00000000,0046F56A,?,_is1,?), ref: 0046ED3B
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Value
                                                                                                                                                                                                      • String ID: NoModify
                                                                                                                                                                                                      • API String ID: 3702945584-1699962838
                                                                                                                                                                                                      • Opcode ID: 53cdef05058b287197a53b5e4611bc3cf079bd9e93731f223baf19424d11e081
                                                                                                                                                                                                      • Instruction ID: e7aa99f2e089c5623e338f59092b711216c244eb116ac0446a77828d65f342ac
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 53cdef05058b287197a53b5e4611bc3cf079bd9e93731f223baf19424d11e081
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 3AE04FB4640304BFEB04DB55CD4AF6B77ECDB48710F104059BA049B291E674FE00CA68
                                                                                                                                                                                                      Function 0042DE1C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 18registryCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,004836C7,?,00000001,?,?,004836C7,?,00000001,00000000), ref: 0042DE38
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      • System\CurrentControlSet\Control\Windows, xrefs: 0042DE36
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Open
                                                                                                                                                                                                      • String ID: System\CurrentControlSet\Control\Windows
                                                                                                                                                                                                      • API String ID: 71445658-1109719901
                                                                                                                                                                                                      • Opcode ID: a11f376e1d034aeb0d9ae53f60934921bcd728bb93d306f1768079d63b1ffdfe
                                                                                                                                                                                                      • Instruction ID: 60e43675bb36a9eef4a15598a1848ca3f705ecc445ee8c9fe52fc6b05f1352bb
                                                                                                                                                                                                      • Opcode Fuzzy Hash: a11f376e1d034aeb0d9ae53f60934921bcd728bb93d306f1768079d63b1ffdfe
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 29D09E72950128BB9B009A89DC41DFB775DDB15760F45441BF9049B141C5B4AC5197E4
                                                                                                                                                                                                      Function 00454100 Relevance: 3.2, APIs: 2, Instructions: 200fileCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • FindNextFileA.KERNEL32(000000FF,?,00000000,00454346,?,00000000,004543BA,?,?,-00000001,00000000,?,0047C8EB,00000000,0047C838,00000000), ref: 00454322
                                                                                                                                                                                                      • FindClose.KERNEL32(000000FF,0045434D,00454346,?,00000000,004543BA,?,?,-00000001,00000000,?,0047C8EB,00000000,0047C838,00000000,00000000), ref: 00454340
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Find$CloseFileNext
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 2066263336-0
                                                                                                                                                                                                      • Opcode ID: 4efbd2439a63238855ff90a677ad59559b44a6f41a8b8ce17eb9fc732e9bfa8f
                                                                                                                                                                                                      • Instruction ID: 54d7d993b90550b5414970fc4389b15b7902a372ed294bc13edf2f45dfba5a61
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 4efbd2439a63238855ff90a677ad59559b44a6f41a8b8ce17eb9fc732e9bfa8f
                                                                                                                                                                                                      • Instruction Fuzzy Hash: BE817430A0424D9FCF11DFA5C8457EFBB74AF49309F1440A6EC546B3A2D3399A8ACB58
                                                                                                                                                                                                      Function 0047DF58 Relevance: 3.2, APIs: 2, Instructions: 160windowCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetACP.KERNEL32(?,?,00000001,00000000,0047E237,?,-0000001A,004800ED,-00000010,?,00000004,0000001B,00000000,0048043A,?,0045D9B8), ref: 0047DFCE
                                                                                                                                                                                                        • Part of subcall function 0042E31C: GetDC.USER32(00000000), ref: 0042E32B
                                                                                                                                                                                                        • Part of subcall function 0042E31C: EnumFontsA.GDI32(?,00000000,0042E308,00000000,00000000,0042E374,?,00000000,00000000,004804A1,?,?,00000001,00000000,00000002,00000000), ref: 0042E356
                                                                                                                                                                                                        • Part of subcall function 0042E31C: ReleaseDC.USER32(00000000,?), ref: 0042E36E
                                                                                                                                                                                                      • SendNotifyMessageA.USER32(0002040C,00000496,00002711,-00000001), ref: 0047E19E
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: EnumFontsMessageNotifyReleaseSend
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 2649214853-0
                                                                                                                                                                                                      • Opcode ID: e029a571d7ea910feaf489f47ebd39d374a0288316229fc386b1e2e4e1e2ac40
                                                                                                                                                                                                      • Instruction ID: 52cd92918bf59317d76ec0dbded9268cc5ddbf6ebeab8dbad6023b52803fe890
                                                                                                                                                                                                      • Opcode Fuzzy Hash: e029a571d7ea910feaf489f47ebd39d374a0288316229fc386b1e2e4e1e2ac40
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 045196746001108BC710FF26D981A9B37E9EB58308B90C67BA4089B3A7CB7CDD46CB9D
                                                                                                                                                                                                      Function 0042DC00 Relevance: 3.1, APIs: 2, Instructions: 113registryCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,?,00000000,0042DD38), ref: 0042DC3C
                                                                                                                                                                                                      • RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,70000000,?,?,00000000,?,00000000,?,00000000,0042DD38), ref: 0042DCAC
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: QueryValue
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 3660427363-0
                                                                                                                                                                                                      • Opcode ID: 4e9f5f3f1f5a7bdad1ad22e8834f0161555fb3da0fe0a6abb79d4fd7acf7c60e
                                                                                                                                                                                                      • Instruction ID: 5bd1c55a509b6dee259ffcee94d68868fe84ce326e73fb4cf6662c4527ef549e
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 4e9f5f3f1f5a7bdad1ad22e8834f0161555fb3da0fe0a6abb79d4fd7acf7c60e
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 9D414171E00529ABDB11DF95D881BAFB7B8EB04704F918466E810F7241D778AE00CBA5
                                                                                                                                                                                                      Function 0042DEC0 Relevance: 3.1, APIs: 2, Instructions: 111registryCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • RegEnumKeyExA.ADVAPI32(?,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,0042DFD6,?,?,00000008,00000000,00000000,0042E003), ref: 0042DF6C
                                                                                                                                                                                                      • RegCloseKey.ADVAPI32(?,0042DFDD,?,00000000,00000000,00000000,00000000,00000000,0042DFD6,?,?,00000008,00000000,00000000,0042E003), ref: 0042DFD0
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CloseEnum
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 2818636725-0
                                                                                                                                                                                                      • Opcode ID: 4ba9105902ea8f19abce0b58cfd6361b4b3e39fae621ffe28cce2eb109bf1346
                                                                                                                                                                                                      • Instruction ID: d62689c7b7995b9893119ef97773413105dd68debc8ff02f2d4f9d8a28cc91ff
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 4ba9105902ea8f19abce0b58cfd6361b4b3e39fae621ffe28cce2eb109bf1346
                                                                                                                                                                                                      • Instruction Fuzzy Hash: DD31B270F04258AEDB11DFA6DD42BAEBBB9EB49304F91407BE501E6280D6785E01CA2D
                                                                                                                                                                                                      Function 0040ADD8 Relevance: 3.1, APIs: 2, Instructions: 51COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • FindResourceA.KERNEL32(00400000,00000000,0000000A), ref: 0040ADF2
                                                                                                                                                                                                      • FreeResource.KERNEL32(00000000,00400000,00000000,0000000A,F0E80040,00000000,?,?,0040AF4F,00000000,0040AF67,?,?,?,00000000), ref: 0040AE03
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Resource$FindFree
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 4097029671-0
                                                                                                                                                                                                      • Opcode ID: 724046dbf40c25189cee710f776ecaa222692b14a71540f68148777f5d1b7dbd
                                                                                                                                                                                                      • Instruction ID: 3d7a77417cef7b3885e8747e4544195f2de945da78ee84bb1155330bb8f828e3
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 724046dbf40c25189cee710f776ecaa222692b14a71540f68148777f5d1b7dbd
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 0301F771300700AFD700FF69EC52E1B77EDDB46714710807AF500AB3D1D639AC10966A
                                                                                                                                                                                                      Function 0041EEA4 Relevance: 3.0, APIs: 2, Instructions: 49threadCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetCurrentThreadId.KERNEL32 ref: 0041EEF3
                                                                                                                                                                                                      • EnumThreadWindows.USER32(00000000,0041EE54,00000000), ref: 0041EEF9
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Thread$CurrentEnumWindows
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 2396873506-0
                                                                                                                                                                                                      • Opcode ID: 30aad164e0a195eeb96462141dc827bf49acbc8680001675c00c89b7ac155170
                                                                                                                                                                                                      • Instruction ID: bcaa23655132f8f2785c0a842f21b48ac99b37e3223c43442b01e3940dbd0cdf
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 30aad164e0a195eeb96462141dc827bf49acbc8680001675c00c89b7ac155170
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 31015B76A04604BFD706CF6BEC1199ABBE8E789720B22887BEC04D3690E7355C10DF18
                                                                                                                                                                                                      Function 00452C80 Relevance: 3.0, APIs: 2, Instructions: 48fileCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • MoveFileA.KERNEL32(00000000,00000000), ref: 00452CC2
                                                                                                                                                                                                      • GetLastError.KERNEL32(00000000,00000000,00000000,00452CE8), ref: 00452CCA
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: ErrorFileLastMove
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 55378915-0
                                                                                                                                                                                                      • Opcode ID: bd02338dff925e1bcf0a80027825a402961c9c10eaaecac7b210e684feb30c76
                                                                                                                                                                                                      • Instruction ID: 1f9035ddd188b097fe3d15476f32cd7793c58c8f4df07880d9fc6ba60e4ff235
                                                                                                                                                                                                      • Opcode Fuzzy Hash: bd02338dff925e1bcf0a80027825a402961c9c10eaaecac7b210e684feb30c76
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 9401D671A04208AB8712EB799D4149EB7ECEB8A32575045BBFC04E3243EA785E048558
                                                                                                                                                                                                      Function 00452770 Relevance: 3.0, APIs: 2, Instructions: 43COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • CreateDirectoryA.KERNEL32(00000000,00000000,00000000,004527CF), ref: 004527A9
                                                                                                                                                                                                      • GetLastError.KERNEL32(00000000,00000000,00000000,004527CF), ref: 004527B1
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CreateDirectoryErrorLast
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 1375471231-0
                                                                                                                                                                                                      • Opcode ID: ea8676b5c10b68e39224bb32f4e4fef25c3caed51db780d1887d447946fb3f56
                                                                                                                                                                                                      • Instruction ID: e3b373b60118a844676bb749001e6832c3b26a50706decb61b3ae2e0e224b701
                                                                                                                                                                                                      • Opcode Fuzzy Hash: ea8676b5c10b68e39224bb32f4e4fef25c3caed51db780d1887d447946fb3f56
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 40F02871A00308BBCB01EF759D4259EB7E8EB4E311B2045B7FC04E3642E6B94E04859C
                                                                                                                                                                                                      Function 00452908 Relevance: 3.0, APIs: 2, Instructions: 42fileCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • DeleteFileA.KERNEL32(00000000,00000000,00452965,?,-00000001,?), ref: 0045293F
                                                                                                                                                                                                      • GetLastError.KERNEL32(00000000,00000000,00452965,?,-00000001,?), ref: 00452947
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: DeleteErrorFileLast
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 2018770650-0
                                                                                                                                                                                                      • Opcode ID: fbcc140a81a3acb9c96393828f2cc587f034b3ec3a8bc9b7824854e1d547cdb8
                                                                                                                                                                                                      • Instruction ID: a1d21d86fbcf93c7076efe682877c1f84c37cf58088428800e153654eea74c02
                                                                                                                                                                                                      • Opcode Fuzzy Hash: fbcc140a81a3acb9c96393828f2cc587f034b3ec3a8bc9b7824854e1d547cdb8
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 05F0C2B2B04608ABDB01EFB59D414AEB7E8EB4E315B6045B7FC04E3742E6B85E148598
                                                                                                                                                                                                      Function 00452E10 Relevance: 3.0, APIs: 2, Instructions: 42COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • RemoveDirectoryA.KERNEL32(00000000,00000000,00452E6D,?,-00000001,00000000), ref: 00452E47
                                                                                                                                                                                                      • GetLastError.KERNEL32(00000000,00000000,00452E6D,?,-00000001,00000000), ref: 00452E4F
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: DirectoryErrorLastRemove
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 377330604-0
                                                                                                                                                                                                      • Opcode ID: 8769a646033274a50feaa89106c60670f2dbad91017c501587ea10a2b48d2d14
                                                                                                                                                                                                      • Instruction ID: a8b2bafe79397aca91686f8656b478e2385adfe3b855dfce5f6cc0b9ba314abc
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 8769a646033274a50feaa89106c60670f2dbad91017c501587ea10a2b48d2d14
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 70F0FC71A04708AFCF01EF759D4249EB7E8DB4E31575049B7FC14E3642E7785E048598
                                                                                                                                                                                                      Function 0042323C Relevance: 3.0, APIs: 2, Instructions: 35COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • LoadCursorA.USER32(00000000,00007F00), ref: 00423249
                                                                                                                                                                                                      • LoadCursorA.USER32(00000000,00000000), ref: 00423273
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CursorLoad
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 3238433803-0
                                                                                                                                                                                                      • Opcode ID: 0c9a104e89a33193f60416200903d3bd70bbd31149720632682593485f60625b
                                                                                                                                                                                                      • Instruction ID: 5e34cf6406f075c2c63d733b1f02ef4b9a88184ee1572dc0f3c8875cc615d59b
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 0c9a104e89a33193f60416200903d3bd70bbd31149720632682593485f60625b
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 9EF0A711B04254AADA109E7E6CC0D6B72A8DF82735B61037BFA3EC72D1C62E1D414569
                                                                                                                                                                                                      Function 0042E394 Relevance: 3.0, APIs: 2, Instructions: 33libraryCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • SetErrorMode.KERNEL32(00008000), ref: 0042E39E
                                                                                                                                                                                                      • LoadLibraryA.KERNEL32(00000000,00000000,0042E3E8,?,00000000,0042E406,?,00008000), ref: 0042E3CD
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: ErrorLibraryLoadMode
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 2987862817-0
                                                                                                                                                                                                      • Opcode ID: 4bb5710dc3172506f3a82e57bec548632d1945d06b3d92e94bd16d63dfaa8550
                                                                                                                                                                                                      • Instruction ID: 14c2566281f292fbf4bc3f3871eddb8f7eb4f11f4d1149329263d7d1c8790498
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 4bb5710dc3172506f3a82e57bec548632d1945d06b3d92e94bd16d63dfaa8550
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 02F08970B147447FDB119F779CA241BBBECDB49B1175249B6F800A3591E53C4910C928
                                                                                                                                                                                                      Function 0046DF58 Relevance: 3.0, APIs: 2, Instructions: 28comCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetVersion.KERNEL32(?,0046DFEE), ref: 0046DF62
                                                                                                                                                                                                      • CoCreateInstance.OLE32(00499B84,00000000,00000001,00499B94,?,?,0046DFEE), ref: 0046DF7E
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CreateInstanceVersion
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 1462612201-0
                                                                                                                                                                                                      • Opcode ID: ea6118eeb2d8939c49b111833dc04e51e3bee2e3aacd01ab10407bd706608934
                                                                                                                                                                                                      • Instruction ID: 3442edb0ea1fabc64a92ad6c3e34ff78e3c28f6093e8310d9e86ee8e53d0260d
                                                                                                                                                                                                      • Opcode Fuzzy Hash: ea6118eeb2d8939c49b111833dc04e51e3bee2e3aacd01ab10407bd706608934
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 4EF0A031B85200DEEB14A7A9DC45B463BD4BB24328F04007BF0448B295E3AC9850861F
                                                                                                                                                                                                      Function 0047C37B Relevance: 3.0, APIs: 2, Instructions: 26COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • SHGetKnownFolderPath.SHELL32(00499D2C,00008000,00000000,?), ref: 0047C38B
                                                                                                                                                                                                      • CoTaskMemFree.OLE32(?,0047C3CE), ref: 0047C3C1
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: FolderFreeKnownPathTask
                                                                                                                                                                                                      • String ID: COMMAND.COM$Common Files$CommonFilesDir$Failed to get path of 64-bit Common Files directory$Failed to get path of 64-bit Program Files directory$ProgramFilesDir$SystemDrive$\Program Files$cmd.exe
                                                                                                                                                                                                      • API String ID: 969438705-544719455
                                                                                                                                                                                                      • Opcode ID: f6c6a059b63e4d54008f1ffce5751a4521167e095c9041d7631769de42763c2c
                                                                                                                                                                                                      • Instruction ID: 7faaca218829a84c9f3570f99a5fa1a3454177a5e5567d2e8256f64c4bc7b3ab
                                                                                                                                                                                                      • Opcode Fuzzy Hash: f6c6a059b63e4d54008f1ffce5751a4521167e095c9041d7631769de42763c2c
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 77E09B31340604AFEB219B619C92B6D77ACE744B00B718477F900E26C0D67CAD14991C
                                                                                                                                                                                                      Function 004508F8 Relevance: 3.0, APIs: 2, Instructions: 22COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • SetFilePointer.KERNEL32(?,00000000,?,00000002,?,?,0046FFBD,?,00000000), ref: 0045090E
                                                                                                                                                                                                      • GetLastError.KERNEL32(?,00000000,?,00000002,?,?,0046FFBD,?,00000000), ref: 00450916
                                                                                                                                                                                                        • Part of subcall function 004506B4: GetLastError.KERNEL32(004504D0,00450776,?,00000000,?,0049799C,00000001,00000000,00000002,00000000,00497AFD,?,?,00000005,00000000,00497B31), ref: 004506B7
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: ErrorLast$FilePointer
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 1156039329-0
                                                                                                                                                                                                      • Opcode ID: da9b101d890a5785f8a9e71de1b90467d9f3c90ee8d89fa87e0c2c0eb401b44d
                                                                                                                                                                                                      • Instruction ID: 32d43412562f4d6ab64aa8be608e77008e370c57458e4df53f7444e76f76d0cb
                                                                                                                                                                                                      • Opcode Fuzzy Hash: da9b101d890a5785f8a9e71de1b90467d9f3c90ee8d89fa87e0c2c0eb401b44d
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 0EE012E93042015BF700EA6599C1B2F22DCDB44315F00446ABD44CA28BE678CC048B29
                                                                                                                                                                                                      Function 00482F34 Relevance: 3.0, APIs: 2, Instructions: 17COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetTickCount.KERNEL32 ref: 00482F3E
                                                                                                                                                                                                      • GetTickCount.KERNEL32 ref: 00482F35
                                                                                                                                                                                                        • Part of subcall function 00482F00: GetForegroundWindow.USER32(00000000,00000000,?,?,00482F65,?,0048304A,?,?,00000000), ref: 00482F06
                                                                                                                                                                                                        • Part of subcall function 00482F00: GetWindowThreadProcessId.USER32(00000000,?), ref: 00482F18
                                                                                                                                                                                                        • Part of subcall function 00482F00: GetCurrentProcessId.KERNEL32(00000000,?,00000000,00000000,?,?,00482F65,?,0048304A,?,?,00000000), ref: 00482F21
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CountProcessTickWindow$CurrentForegroundThread
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 711787588-0
                                                                                                                                                                                                      • Opcode ID: 7c22aa7fab934049af48585247c35d08b9e51fd8af9464ee031efb4c5753d5c7
                                                                                                                                                                                                      • Instruction ID: d5ee797b4302cd0f85b2da30a03cb10faabf1b4225af228799f053cc1d868ece
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 7c22aa7fab934049af48585247c35d08b9e51fd8af9464ee031efb4c5753d5c7
                                                                                                                                                                                                      • Instruction Fuzzy Hash: FDD0C96470020145DE0137FB978226E4158AF1531CF501D6FB3469A187DEAC8506B73F
                                                                                                                                                                                                      Function 0041EFF4 Relevance: 3.0, APIs: 2, Instructions: 16threadCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetCurrentThreadId.KERNEL32 ref: 0041F00E
                                                                                                                                                                                                      • EnumThreadWindows.USER32(00000000,0041EF90,00000000), ref: 0041F014
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Thread$CurrentEnumWindows
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 2396873506-0
                                                                                                                                                                                                      • Opcode ID: 28faba8d13260114aebe4435219a546304dde162066a62bc81d999aa95987238
                                                                                                                                                                                                      • Instruction ID: 1bd0ab66c6aeceffdc4f5e21b8af03a27ec20acb013402289ac5ff21683637d0
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 28faba8d13260114aebe4435219a546304dde162066a62bc81d999aa95987238
                                                                                                                                                                                                      • Instruction Fuzzy Hash: EBE02676600200AEDB12DF7AAD4575B37D0A394314F12483FA904D61A1D2745C84DB19
                                                                                                                                                                                                      Function 004014E4 Relevance: 2.5, APIs: 2, Instructions: 37memoryCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • VirtualAlloc.KERNEL32(00000000,?,00002000,00000001,?,?,?,004017ED), ref: 00401513
                                                                                                                                                                                                      • VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,?,00002000,00000001,?,?,?,004017ED), ref: 0040153A
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Virtual$AllocFree
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 2087232378-0
                                                                                                                                                                                                      • Opcode ID: 94577317c2bcd4d3a70d22c0b2f2fc78c72c60cff144ef5375d29febf27e2799
                                                                                                                                                                                                      • Instruction ID: 119661fe7174a079321c86e78af40791ac039b5eb8373b45468023a5ba433726
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 94577317c2bcd4d3a70d22c0b2f2fc78c72c60cff144ef5375d29febf27e2799
                                                                                                                                                                                                      • Instruction Fuzzy Hash: F7F08272A0063067EB60596A4C81B5359859BC5B94F154076FD09FF3E9D6B58C0142A9
                                                                                                                                                                                                      Function 004085DC Relevance: 1.6, APIs: 1, Instructions: 99COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetSystemDefaultLCID.KERNEL32(00000000,00408712), ref: 004085FB
                                                                                                                                                                                                        • Part of subcall function 00406DEC: LoadStringA.USER32(00400000,0000FF87,?,00000400), ref: 00406E09
                                                                                                                                                                                                        • Part of subcall function 00408568: GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0049B4C0,00000001,?,00408633,?,00000000,00408712), ref: 00408586
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: DefaultInfoLoadLocaleStringSystem
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 1658689577-0
                                                                                                                                                                                                      • Opcode ID: 92125e52594e5bc8ee6d97e09480d95589045c4468e862feaba19903f63d3f1d
                                                                                                                                                                                                      • Instruction ID: 9026c6f0acc6bf601755118861b832b1e3c4c92574a9a05948c89544872af2a3
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 92125e52594e5bc8ee6d97e09480d95589045c4468e862feaba19903f63d3f1d
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 47314E35E00109ABCB00EB55CC819EEB779EF84314F558577E815BB286EB38AA018B98
                                                                                                                                                                                                      Function 0041FB9C Relevance: 1.6, APIs: 1, Instructions: 65COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • SetScrollInfo.USER32(00000000,?,?,00000001), ref: 0041FC39
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: InfoScroll
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 629608716-0
                                                                                                                                                                                                      • Opcode ID: a0ce2aaa01497ac04468ea6ac7a83421c49688bcbeeff2d3e991700215f3b25f
                                                                                                                                                                                                      • Instruction ID: 6365c2cd079840e4170b7c9ce409c3d873e807bce8729d2e10e5c00059922083
                                                                                                                                                                                                      • Opcode Fuzzy Hash: a0ce2aaa01497ac04468ea6ac7a83421c49688bcbeeff2d3e991700215f3b25f
                                                                                                                                                                                                      • Instruction Fuzzy Hash: D8214FB1608746AFC351DF3984407A6BBE4BB48344F14893EE498C3741E778E99ACBD6
                                                                                                                                                                                                      Function 0046C2C4 Relevance: 1.5, APIs: 1, Instructions: 37COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                        • Part of subcall function 0041EEA4: GetCurrentThreadId.KERNEL32 ref: 0041EEF3
                                                                                                                                                                                                        • Part of subcall function 0041EEA4: EnumThreadWindows.USER32(00000000,0041EE54,00000000), ref: 0041EEF9
                                                                                                                                                                                                      • SHPathPrepareForWriteA.SHELL32(00000000,00000000,00000000,00000000,00000000,0046C322,?,00000000,?,?,0046C534,?,00000000,0046C5A8), ref: 0046C306
                                                                                                                                                                                                        • Part of subcall function 0041EF58: IsWindow.USER32(?), ref: 0041EF66
                                                                                                                                                                                                        • Part of subcall function 0041EF58: EnableWindow.USER32(?,00000001), ref: 0041EF75
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: ThreadWindow$CurrentEnableEnumPathPrepareWindowsWrite
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 3319771486-0
                                                                                                                                                                                                      • Opcode ID: 372a16360b70271e3fbe54b3c8c2dd1bf1f72266d056807abca4c83ddb60c27c
                                                                                                                                                                                                      • Instruction ID: ca087fa44df162080e90021c0b7c07397410ce2cdc620b11c20c1b42f9b7769a
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 372a16360b70271e3fbe54b3c8c2dd1bf1f72266d056807abca4c83ddb60c27c
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 93F0B470204300BFEB059FA6ED96B2576D8D748714FA1443BF904C6290E57D5880852E
                                                                                                                                                                                                      Function 00416550 Relevance: 1.5, APIs: 1, Instructions: 32COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • CreateWindowExA.USER32(?,?,?,?,?,?,?,?,?,00000000,00400000,?), ref: 00416585
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CreateWindow
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 716092398-0
                                                                                                                                                                                                      • Opcode ID: b152e844846ae8a52721441d180559fdf16f7956a15d86c9ff4cf0dcda8b9698
                                                                                                                                                                                                      • Instruction ID: 158b8484bb218b41c698b3aa21f26e2dd86497bc01e640ef524e7c8f4c0ee3c6
                                                                                                                                                                                                      • Opcode Fuzzy Hash: b152e844846ae8a52721441d180559fdf16f7956a15d86c9ff4cf0dcda8b9698
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 4BF019B2200510AFDB84DE9CD9C0F9773ECEB0C210B0481A6FA08CB21AD220EC108BB0
                                                                                                                                                                                                      Function 004149B4 Relevance: 1.5, APIs: 1, Instructions: 31COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • KiUserCallbackDispatcher.NTDLL(?,?), ref: 004149EF
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CallbackDispatcherUser
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 2492992576-0
                                                                                                                                                                                                      • Opcode ID: 9e73aedc2ede48524128b4fba7c94cddd86b5e43f4b9cee2e76a3e9f018a4363
                                                                                                                                                                                                      • Instruction ID: 59ac3629b8f45f7a6bca1b57e2bf54285868c68ba6336e642f1ef9b7bb8d2b05
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 9e73aedc2ede48524128b4fba7c94cddd86b5e43f4b9cee2e76a3e9f018a4363
                                                                                                                                                                                                      • Instruction Fuzzy Hash: B2F0DA762042019FC740DF6CC8C488A77E5FF89255B5546A9F989CB356C731EC54CB91
                                                                                                                                                                                                      Function 004507C4 Relevance: 1.5, APIs: 1, Instructions: 29fileCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • CreateFileA.KERNEL32(00000000,?,?,00000000,?,00000080,00000000), ref: 00450804
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CreateFile
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 823142352-0
                                                                                                                                                                                                      • Opcode ID: ce99838f7be0491c6923214398908b2fd93372403a84c7b432a549debe4dc153
                                                                                                                                                                                                      • Instruction ID: 52eb814c7c241dc182afdc6c3e242d4e4c9a4e6d94000e289351c80ae23ff87c
                                                                                                                                                                                                      • Opcode Fuzzy Hash: ce99838f7be0491c6923214398908b2fd93372403a84c7b432a549debe4dc153
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 53E012B53541483EE780EEAD6C42F9777DC971A714F008037B998D7341D461DD158BA8
                                                                                                                                                                                                      Function 0042CCCC Relevance: 1.5, APIs: 1, Instructions: 29COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetFileAttributesA.KERNEL32(00000000,00000000,0042CD14,?,00000001,?,?,00000000,?,0042CD66,00000000,00452A25,00000000,00452A46,?,00000000), ref: 0042CCF7
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: AttributesFile
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 3188754299-0
                                                                                                                                                                                                      • Opcode ID: 1d0d78a442318f5a8380efcabe61a4e230812411e55e6b5390a6eabb80abb0a2
                                                                                                                                                                                                      • Instruction ID: d3c11148bbbe1678040d416a6bc301cfea82702c80b798926358c5e84281cc0e
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 1d0d78a442318f5a8380efcabe61a4e230812411e55e6b5390a6eabb80abb0a2
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 80E065B1304304BFD701EB66EC92A5EBAACDB49754BA14876B50097592D5B86E008468
                                                                                                                                                                                                      Function 0042E8C8 Relevance: 1.5, APIs: 1, Instructions: 28windowCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • FormatMessageA.KERNEL32(00003200,00000000,4C783AFB,00000000,?,00000400,00000000,?,00453273,00000000,kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000), ref: 0042E8E7
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: FormatMessage
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 1306739567-0
                                                                                                                                                                                                      • Opcode ID: 07eb917982e44065cc90d67cadef310e262c4caec6bcfbb1197f6d5f5d2cfc19
                                                                                                                                                                                                      • Instruction ID: fbc307da5c1359fbfbc351051067b699ae1438aedf6613c80dda169529e76e7e
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 07eb917982e44065cc90d67cadef310e262c4caec6bcfbb1197f6d5f5d2cfc19
                                                                                                                                                                                                      • Instruction Fuzzy Hash: BCE0206278431116F2353416AC47B77150E43C0708F944027BB90DF3D3D6AF9945D25E
                                                                                                                                                                                                      Function 004062E8 Relevance: 1.5, APIs: 1, Instructions: 27COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • CreateWindowExA.USER32(00000000,0042367C,00000000,94CA0000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00423C0C), ref: 00406311
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CreateWindow
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 716092398-0
                                                                                                                                                                                                      • Opcode ID: ff94722aa4050723ad3f6c96c0112c9f8192a5aa4540eb1f1ae13447e7542d04
                                                                                                                                                                                                      • Instruction ID: 53e57476791a39574122dfc8a3f58f2f78c4a621b5a82e38d1c80b15216a1e52
                                                                                                                                                                                                      • Opcode Fuzzy Hash: ff94722aa4050723ad3f6c96c0112c9f8192a5aa4540eb1f1ae13447e7542d04
                                                                                                                                                                                                      • Instruction Fuzzy Hash: EEE0FEB2214209BBDB00DE8ADCC1DABB7ACFB4C654F808105BB1C972428275AC608B71
                                                                                                                                                                                                      Function 0042DDE4 Relevance: 1.5, APIs: 1, Instructions: 26registryCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • RegCreateKeyExA.ADVAPI32(?,?,?,?,?,?,?,?,?), ref: 0042DE10
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Create
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 2289755597-0
                                                                                                                                                                                                      • Opcode ID: 296f4a6b1841180fcb6525c1425398a2afe0618770c3240f8adf4a5c8222c494
                                                                                                                                                                                                      • Instruction ID: 68673b5cf84413dff1d7ecec16939cb2303f89f305828e6cd22260af4b89741b
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 296f4a6b1841180fcb6525c1425398a2afe0618770c3240f8adf4a5c8222c494
                                                                                                                                                                                                      • Instruction Fuzzy Hash: EDE07EB2610119AF9B40DE8CDC81EEB37ADAB1D350F404016FA08E7200C2B4EC519BB4
                                                                                                                                                                                                      Function 00454BF8 Relevance: 1.5, APIs: 1, Instructions: 25COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • FindClose.KERNEL32(00000000,000000FF,004707E0,00000000,004715F6,?,00000000,0047163F,?,00000000,00471778,?,00000000,?,00000000), ref: 00454C0E
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CloseFind
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 1863332320-0
                                                                                                                                                                                                      • Opcode ID: 7c8f6db93596433e8c6540ce52a48f0da3b0448ecaf471e45e9c42032ee7c2dc
                                                                                                                                                                                                      • Instruction ID: 5c2dbd3a099336849a47a332199978da45cb785deb8a29a76394180ab3bc5383
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 7c8f6db93596433e8c6540ce52a48f0da3b0448ecaf471e45e9c42032ee7c2dc
                                                                                                                                                                                                      • Instruction Fuzzy Hash: A1E09BB09097004BC715DF39858031A76D19FC9325F05C96AEC99CF3D7E77D84454617
                                                                                                                                                                                                      Function 0041467C Relevance: 1.5, APIs: 1, Instructions: 23COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • KiUserCallbackDispatcher.NTDLL(00495556,?,00495578,?,?,00000000,00495556,?,?), ref: 0041469B
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CallbackDispatcherUser
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 2492992576-0
                                                                                                                                                                                                      • Opcode ID: 6e76042b9040d81ea616cca6ecacd77bc76811df147480a1eef497ac36b7c045
                                                                                                                                                                                                      • Instruction ID: 3a83c41fa5c3d176b15f2666d2672a78f9af76d4247255e2ff0bda4df6ea0631
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 6e76042b9040d81ea616cca6ecacd77bc76811df147480a1eef497ac36b7c045
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 59E012723001199F8250CE5EDC88C57FBEDEBC966130983A6F508C7306DA31EC44C7A0
                                                                                                                                                                                                      Function 00406F10 Relevance: 1.5, APIs: 1, Instructions: 23fileCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • WriteFile.KERNEL32(?,?,?,?,00000000), ref: 00406F24
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: FileWrite
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 3934441357-0
                                                                                                                                                                                                      • Opcode ID: 4c02731fe18b0a47ab7745946c5e8dd4c7dfafdb2aa22804bebcbb41d9412fbb
                                                                                                                                                                                                      • Instruction ID: adeaf4ebd0e6cd94d64be6b3cb299443ba394f13a0b1cd3d8337db6b6af80796
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 4c02731fe18b0a47ab7745946c5e8dd4c7dfafdb2aa22804bebcbb41d9412fbb
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 53D012722091506AD220965A6C44EAB6BDCCBC5770F11063AB558C2181D7209C01C675
                                                                                                                                                                                                      Function 0042364C Relevance: 1.5, APIs: 1, Instructions: 22COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                        • Part of subcall function 004235F8: SystemParametersInfoA.USER32(00000048,00000000,00000000,00000000), ref: 0042360D
                                                                                                                                                                                                      • ShowWindow.USER32(00410460,00000009,?,00000000,0041EDA4,0042393A,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00423C0C), ref: 00423667
                                                                                                                                                                                                        • Part of subcall function 00423628: SystemParametersInfoA.USER32(00000049,00000000,00000000,00000000), ref: 00423644
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: InfoParametersSystem$ShowWindow
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 3202724764-0
                                                                                                                                                                                                      • Opcode ID: f1fbc87c7d3064a6cf4368d53b3e4c6ee974437194041f03c0195094467d5de5
                                                                                                                                                                                                      • Instruction ID: 3e39ddd90fb628193caaea160b6f4ed5bf244f394cc2da11a07db6b12dca8b82
                                                                                                                                                                                                      • Opcode Fuzzy Hash: f1fbc87c7d3064a6cf4368d53b3e4c6ee974437194041f03c0195094467d5de5
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 34D05E123821703142307ABB280699B46EC8D822EB389043BB5449B312ED5DCE01116C
                                                                                                                                                                                                      Function 004242C4 Relevance: 1.5, APIs: 1, Instructions: 21COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • SetWindowTextA.USER32(?,00000000), ref: 004242DC
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: TextWindow
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 530164218-0
                                                                                                                                                                                                      • Opcode ID: 968e2600307bd84f4d65718215a4df57ccfa9b7919b98356d7a542cd4e907fd2
                                                                                                                                                                                                      • Instruction ID: e359d8c046b4275bb87a72ac3440150ee0889cd0e7de0465f76ccf46c1161c2e
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 968e2600307bd84f4d65718215a4df57ccfa9b7919b98356d7a542cd4e907fd2
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 81D05EE27011602BCB01BAED54C4AC667CC9B8D25AB1840BBF904EF257D638CE40C398
                                                                                                                                                                                                      Function 0042CD6C Relevance: 1.5, APIs: 1, Instructions: 18COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetFileAttributesA.KERNEL32(00000000,?,00452C55,00000000,00452C6E,?,-00000001,00000000), ref: 0042CD77
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: AttributesFile
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 3188754299-0
                                                                                                                                                                                                      • Opcode ID: a2088c7275e813bd9e5827587d2463c05c437d53b82becc98194beb6e78a0163
                                                                                                                                                                                                      • Instruction ID: 2eab32a2699244162946c929296992ee32eb3599f5fc22494aed3d9886f7b4af
                                                                                                                                                                                                      • Opcode Fuzzy Hash: a2088c7275e813bd9e5827587d2463c05c437d53b82becc98194beb6e78a0163
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 51D012D036121015DF1455BD28C535F05884B65375BA82F37B66DE62E2D23D8857281C
                                                                                                                                                                                                      Function 004669B4 Relevance: 1.5, APIs: 1, Instructions: 16COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • KiUserCallbackDispatcher.NTDLL(?,?,00000000,?,0046769C,00000000,00000000,00000000,0000000C,00000000), ref: 004669CC
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CallbackDispatcherUser
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 2492992576-0
                                                                                                                                                                                                      • Opcode ID: 1170af52fdfa1b22d402febd08e71c9ecbcd6356f79449625b478cc807a9fefe
                                                                                                                                                                                                      • Instruction ID: a3a9c25b9c80179eca176ae0059a0aa24e3542550d9dc9bac8dced773014ab2a
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 1170af52fdfa1b22d402febd08e71c9ecbcd6356f79449625b478cc807a9fefe
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 0ED09272210A109F8364CAADC9C4C97B3ECEF4C2213004659E54AC3B15D664FC018BA0
                                                                                                                                                                                                      Function 0042CD24 Relevance: 1.5, APIs: 1, Instructions: 16COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetFileAttributesA.KERNEL32(00000000,00000000,004515CB,00000000), ref: 0042CD2F
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: AttributesFile
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 3188754299-0
                                                                                                                                                                                                      • Opcode ID: 1e77a1c17026b055d6e182de84434438929c2eccdb1d07d08554776b7f607fb0
                                                                                                                                                                                                      • Instruction ID: 53db4a1afaa3b7bebcc80daf879f764776582c58df104e6651e2d127eece83ed
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 1e77a1c17026b055d6e182de84434438929c2eccdb1d07d08554776b7f607fb0
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 48C08CE03222001A9E60A6BD2CC551F06CC891423A3A41E3BB129EB2E2D23D88162818
                                                                                                                                                                                                      Function 00406EC0 Relevance: 1.5, APIs: 1, Instructions: 14fileCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • CreateFileA.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000,0040A6D4,0040CC80,?,00000000,?), ref: 00406EDD
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CreateFile
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 823142352-0
                                                                                                                                                                                                      • Opcode ID: d487f09bce5ab2446fefe52ff91139140134d323c8d44495a9ab4cbc0f9c4527
                                                                                                                                                                                                      • Instruction ID: fbce42704b7dd2fd8be74a622cf743b4adaa06f64be9adac3ea2875d17ee2119
                                                                                                                                                                                                      • Opcode Fuzzy Hash: d487f09bce5ab2446fefe52ff91139140134d323c8d44495a9ab4cbc0f9c4527
                                                                                                                                                                                                      • Instruction Fuzzy Hash: EAC048A13C130032F92035A60C87F16008C5754F0AE60C43AB740BF1C2D8E9A818022C
                                                                                                                                                                                                      Function 0041F39C Relevance: 1.5, APIs: 1, Instructions: 14COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • KiUserCallbackDispatcher.NTDLL(?,?,?,00000000), ref: 0041F3B0
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CallbackDispatcherUser
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 2492992576-0
                                                                                                                                                                                                      • Opcode ID: aa2ab5d04534ce78fd06398472ac87fc8e200d4b6eb1d54961e47d4e7a3c3f50
                                                                                                                                                                                                      • Instruction ID: 48f25c4fc7afed193c39a16cc91a0304f94a1296cd048c63733264e3b5f0309e
                                                                                                                                                                                                      • Opcode Fuzzy Hash: aa2ab5d04534ce78fd06398472ac87fc8e200d4b6eb1d54961e47d4e7a3c3f50
                                                                                                                                                                                                      • Instruction Fuzzy Hash: D2D0C932100108AFDB018E94AC018677B69EB48210B148815FD0485221D633E831AA91
                                                                                                                                                                                                      Function 0045092C Relevance: 1.5, APIs: 1, Instructions: 11fileCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • SetEndOfFile.KERNEL32(?,?,0045C192,00000000,0045C31D,?,00000000,00000002,00000002), ref: 00450933
                                                                                                                                                                                                        • Part of subcall function 004506B4: GetLastError.KERNEL32(004504D0,00450776,?,00000000,?,0049799C,00000001,00000000,00000002,00000000,00497AFD,?,?,00000005,00000000,00497B31), ref: 004506B7
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: ErrorFileLast
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 734332943-0
                                                                                                                                                                                                      • Opcode ID: dfd6122944db5b319254e7b77af95d7469dcf5406d44b15aeae4525e96e42585
                                                                                                                                                                                                      • Instruction ID: 9573b676cf6dd5fef234c73c81a1a5d02d78d5ca05287b50762f3c98dcfac2da
                                                                                                                                                                                                      • Opcode Fuzzy Hash: dfd6122944db5b319254e7b77af95d7469dcf5406d44b15aeae4525e96e42585
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 1AC04CA5700211479F10A6BA85C1A0662D86A5D3157144066BD08CF207D668D8148A18
                                                                                                                                                                                                      Function 00406F50 Relevance: 1.5, APIs: 1, Instructions: 11fileCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • DeleteFileA.KERNEL32(00000000,0049B628,00498261,00000000,004982B6,?,?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000), ref: 00406F5B
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: DeleteFile
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 4033686569-0
                                                                                                                                                                                                      • Opcode ID: 974406c8209f5f2baf9aa7f60898e2c16b4dbb69ce3e1bfb04616041c36a0a4c
                                                                                                                                                                                                      • Instruction ID: 1cff4f98fe1f8e2c1d524c72e998173d896329315b0501cca3ecf0a0fad01fcd
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 974406c8209f5f2baf9aa7f60898e2c16b4dbb69ce3e1bfb04616041c36a0a4c
                                                                                                                                                                                                      • Instruction Fuzzy Hash: E4B012E13D224A26CB0079FE4CC1D1A00CC4A293063406A3A3006F72C3D83CC8180014
                                                                                                                                                                                                      Function 004072A8 Relevance: 1.5, APIs: 1, Instructions: 11COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • SetCurrentDirectoryA.KERNEL32(00000000,?,0049792A,00000000,00497AFD,?,?,00000005,00000000,00497B31,?,?,00000000), ref: 004072B3
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CurrentDirectory
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 1611563598-0
                                                                                                                                                                                                      • Opcode ID: 9cfe1b671e2ded52e2a4f1899edd371c25323ab6eac1b77aed394817f5a1d109
                                                                                                                                                                                                      • Instruction ID: 2ee9fcf0c2ecb8048618371478a38130c752a95b947e2a8aefd026f579ab26ad
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 9cfe1b671e2ded52e2a4f1899edd371c25323ab6eac1b77aed394817f5a1d109
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 33B012E03D120A2BCA0079FE4CC192A00CC46292163401B3B3006EB1C3D83DC8180824
                                                                                                                                                                                                      Function 0044FE04 Relevance: 1.5, APIs: 1, Instructions: 11COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • FreeLibrary.KERNEL32(00000000,00450010,00000000,?,00468254,0000000C,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000,?), ref: 0044FE22
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: FreeLibrary
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 3664257935-0
                                                                                                                                                                                                      • Opcode ID: 737efbd1d05e8daf9b2f5d4ad47827039e352d1058cf7efe3c38226c1680fcb2
                                                                                                                                                                                                      • Instruction ID: 66f3cd114cd8849fa0b5cd02f95834ec0ce5bd652375c405162ae2aedd08d897
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 737efbd1d05e8daf9b2f5d4ad47827039e352d1058cf7efe3c38226c1680fcb2
                                                                                                                                                                                                      • Instruction Fuzzy Hash: A1D0C9B05022448EDB50EB69FA8472233E4E328346F18503FE500CA26AF33A8C44CF9C
                                                                                                                                                                                                      Function 0042E3EF Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • SetErrorMode.KERNEL32(?,0042E40D), ref: 0042E400
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: ErrorMode
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 2340568224-0
                                                                                                                                                                                                      • Opcode ID: cb8e2ebd86b0ac1182f6c4657d989dfa6a466ad308997f4b3834ff3b1e7758f7
                                                                                                                                                                                                      • Instruction ID: 426ac138898b17598b25982f2c454791bd479401c65f9a69ae9baa170422678e
                                                                                                                                                                                                      • Opcode Fuzzy Hash: cb8e2ebd86b0ac1182f6c4657d989dfa6a466ad308997f4b3834ff3b1e7758f7
                                                                                                                                                                                                      • Instruction Fuzzy Hash: CDB09B7670C6105EE709D6D5B45552D63D4D7C57207E14477F010D2581D57D58054E18
                                                                                                                                                                                                      Function 0047CBBC Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • FreeLibrary.KERNEL32(00000000,00481513), ref: 0047CBD2
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: FreeLibrary
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 3664257935-0
                                                                                                                                                                                                      • Opcode ID: 3960cdac8bd68834c73d3577d90ff23d446efd861fc5d3bb3c358d7d7c6731e4
                                                                                                                                                                                                      • Instruction ID: 20db21915ed00eb17110ede63ac0c4995f7a8f82a6390a4d14b1d10f219631a4
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 3960cdac8bd68834c73d3577d90ff23d446efd861fc5d3bb3c358d7d7c6731e4
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 1DC002717912018EC758DF75ADD5B6536D8D714305F00543B6414E7165DA386440DB68
                                                                                                                                                                                                      Function 004165EC Relevance: 1.5, APIs: 1, Instructions: 4COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: DestroyWindow
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 3375834691-0
                                                                                                                                                                                                      • Opcode ID: 1244af60e57b01067fe56da529b9c4312cbd500fa9ed17bad69dff1823a021af
                                                                                                                                                                                                      • Instruction ID: 4f6e5339ba6c71e81ef5aec1f6829bfe42d3c8de95bc03762545e97b2cddf6f9
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 1244af60e57b01067fe56da529b9c4312cbd500fa9ed17bad69dff1823a021af
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 1AA00275501500AADA00E7B5D849F7E2298BB44204FD905F9714897056C57C99008B55
                                                                                                                                                                                                      Function 0047D888 Relevance: 1.4, APIs: 1, Instructions: 154COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,0047DA68,?,?,?,?,00000000,00000000,00000000,00000000), ref: 0047DA22
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: ByteCharMultiWide
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 626452242-0
                                                                                                                                                                                                      • Opcode ID: f00937e419430fadacdfb08ba868c06bfaea8747007b4ff93a078d6954f67ca3
                                                                                                                                                                                                      • Instruction ID: f29de2ad8c50687240b36adc22138c5273adba91495e2343049bdb371ee5aac2
                                                                                                                                                                                                      • Opcode Fuzzy Hash: f00937e419430fadacdfb08ba868c06bfaea8747007b4ff93a078d6954f67ca3
                                                                                                                                                                                                      • Instruction Fuzzy Hash: A051B6B0A14214AFDB10DF54D8C4B9ABBF8EF19308F108077E944A7391D738AE45CB6A
                                                                                                                                                                                                      Function 0041F3C4 Relevance: 1.3, APIs: 1, Instructions: 52memoryCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • VirtualAlloc.KERNEL32(00000000,00001000,00001000,00000040,?,00000000,0041EDA4,?,0042388F,00423C0C,0041EDA4), ref: 0041F3E2
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: AllocVirtual
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 4275171209-0
                                                                                                                                                                                                      • Opcode ID: f624f178b2757757f6ee0ed82108e7e17b49aa81eb1cfd09d0e3ddd3732ee692
                                                                                                                                                                                                      • Instruction ID: 3312bc658de40493dbbbdb628fa1ac862c14c743cb2aabe02eeb7d71ec829e14
                                                                                                                                                                                                      • Opcode Fuzzy Hash: f624f178b2757757f6ee0ed82108e7e17b49aa81eb1cfd09d0e3ddd3732ee692
                                                                                                                                                                                                      • Instruction Fuzzy Hash: D5115A752007059BCB20DF19D880B82FBE5EF98390F10C53BE9688B385D3B4E8458BA9
                                                                                                                                                                                                      Function 00452FC4 Relevance: 1.3, APIs: 1, Instructions: 48COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetLastError.KERNEL32(00000000,0045302D), ref: 0045300F
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: ErrorLast
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 1452528299-0
                                                                                                                                                                                                      • Opcode ID: 9b36e42861a8e97045d3d1c2d68090febbf4b925d95e27d87fd5eab6f39d8911
                                                                                                                                                                                                      • Instruction ID: b902f5f71593d0acd8113edc39c0d5725662cc955bae9521e0e34912f41e4d76
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 9b36e42861a8e97045d3d1c2d68090febbf4b925d95e27d87fd5eab6f39d8911
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 850170356042486FC701DF699C008EEFBE8EB4D76171082B7FC24C3382D7345E059664
                                                                                                                                                                                                      Function 0040170C Relevance: 1.3, APIs: 1, Instructions: 48COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • VirtualFree.KERNEL32(00000000,00000000,00004000,?,?,?,?,?,00401973), ref: 00401766
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: FreeVirtual
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 1263568516-0
                                                                                                                                                                                                      • Opcode ID: 3cb279d385dc81f8188aef87182d0a586e7f532f71175ddb5b892d42a5daf7f8
                                                                                                                                                                                                      • Instruction ID: fd45504e6079eb3c344fd15592bdf3984e08e9418c18d248e8b2091ea2ac4f2a
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 3cb279d385dc81f8188aef87182d0a586e7f532f71175ddb5b892d42a5daf7f8
                                                                                                                                                                                                      • Instruction Fuzzy Hash: A10120766443148FC3109F29EDC0E2677E8D794378F15453EDA85673A1D37A6C0187D8

                                                                                                                                                                                                      Non-executed Functions

                                                                                                                                                                                                      Function 0041F118 Relevance: 45.6, APIs: 15, Strings: 11, Instructions: 87libraryloaderCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetVersion.KERNEL32(?,00418FF0,00000000,?,?,?,00000001), ref: 0041F126
                                                                                                                                                                                                      • SetErrorMode.KERNEL32(00008000,?,00418FF0,00000000,?,?,?,00000001), ref: 0041F142
                                                                                                                                                                                                      • LoadLibraryA.KERNEL32(CTL3D32.DLL,00008000,?,00418FF0,00000000,?,?,?,00000001), ref: 0041F14E
                                                                                                                                                                                                      • SetErrorMode.KERNEL32(00000000,CTL3D32.DLL,00008000,?,00418FF0,00000000,?,?,?,00000001), ref: 0041F15C
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000001,Ctl3dRegister), ref: 0041F18C
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000001,Ctl3dUnregister), ref: 0041F1B5
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000001,Ctl3dSubclassCtl), ref: 0041F1CA
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000001,Ctl3dSubclassDlgEx), ref: 0041F1DF
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000001,Ctl3dDlgFramePaint), ref: 0041F1F4
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000001,Ctl3dCtlColorEx), ref: 0041F209
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000001,Ctl3dAutoSubclass), ref: 0041F21E
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000001,Ctl3dUnAutoSubclass), ref: 0041F233
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000001,Ctl3DColorChange), ref: 0041F248
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000001,BtnWndProc3d), ref: 0041F25D
                                                                                                                                                                                                      • FreeLibrary.KERNEL32(00000001,?,00418FF0,00000000,?,?,?,00000001), ref: 0041F26F
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: AddressProc$ErrorLibraryMode$FreeLoadVersion
                                                                                                                                                                                                      • String ID: BtnWndProc3d$CTL3D32.DLL$Ctl3DColorChange$Ctl3dAutoSubclass$Ctl3dCtlColorEx$Ctl3dDlgFramePaint$Ctl3dRegister$Ctl3dSubclassCtl$Ctl3dSubclassDlgEx$Ctl3dUnAutoSubclass$Ctl3dUnregister
                                                                                                                                                                                                      • API String ID: 2323315520-3614243559
                                                                                                                                                                                                      • Opcode ID: 671fdaa251972b62047104a2fe9ad863bdd7b53d79a33238f475940deae409a8
                                                                                                                                                                                                      • Instruction ID: e724c2aa341d6685c6ab1c4031cb88844a897dd828fe35f3324890dc483947ec
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 671fdaa251972b62047104a2fe9ad863bdd7b53d79a33238f475940deae409a8
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 8E314FB2640700ABEB01EBB9AC46A6B3794F328724741093FB508D7192D77C5C55CF5C
                                                                                                                                                                                                      Function 00458418 Relevance: 40.4, APIs: 11, Strings: 12, Instructions: 186pipeprocessfileCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetTickCount.KERNEL32 ref: 0045847F
                                                                                                                                                                                                      • QueryPerformanceCounter.KERNEL32(00000000,00000000,00458712,?,?,00000000,00000000,?,00458E0E,?,00000000,00000000), ref: 00458488
                                                                                                                                                                                                      • GetSystemTimeAsFileTime.KERNEL32(00000000,00000000), ref: 00458492
                                                                                                                                                                                                      • GetCurrentProcessId.KERNEL32(?,00000000,00000000,00458712,?,?,00000000,00000000,?,00458E0E,?,00000000,00000000), ref: 0045849B
                                                                                                                                                                                                      • CreateNamedPipeA.KERNEL32(00000000,40080003,00000006,00000001,00002000,00002000,00000000,00000000), ref: 00458511
                                                                                                                                                                                                      • GetLastError.KERNEL32(00000000,40080003,00000006,00000001,00002000,00002000,00000000,00000000,?,00000000,00000000), ref: 0045851F
                                                                                                                                                                                                      • CreateFileA.KERNEL32(00000000,C0000000,00000000,00499B10,00000003,00000000,00000000,00000000,004586CE), ref: 00458567
                                                                                                                                                                                                      • SetNamedPipeHandleState.KERNEL32(000000FF,00000002,00000000,00000000,00000000,004586BD,?,00000000,C0000000,00000000,00499B10,00000003,00000000,00000000,00000000,004586CE), ref: 004585A0
                                                                                                                                                                                                        • Part of subcall function 0042D8C4: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0042D8D7
                                                                                                                                                                                                      • CreateProcessA.KERNEL32(00000000,00000000,?,00000000,00000000,00000001,0C000000,00000000,00000000,00000044,?,000000FF,00000002,00000000,00000000,00000000), ref: 00458649
                                                                                                                                                                                                      • CloseHandle.KERNEL32(?,00000000,00000000,?,00000000,00000000,00000001,0C000000,00000000,00000000,00000044,?,000000FF,00000002,00000000,00000000), ref: 0045867F
                                                                                                                                                                                                      • CloseHandle.KERNEL32(000000FF,004586C4,?,00000000,00000000,00000001,0C000000,00000000,00000000,00000044,?,000000FF,00000002,00000000,00000000,00000000), ref: 004586B7
                                                                                                                                                                                                        • Part of subcall function 0045349C: GetLastError.KERNEL32(00000000,00454031,00000005,00000000,00454066,?,?,00000000,0049B628,00000004,00000000,00000000,00000000,?,00497F15,00000000), ref: 0045349F
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CreateHandle$CloseErrorFileLastNamedPipeProcessSystemTime$CountCounterCurrentDirectoryPerformanceQueryStateTick
                                                                                                                                                                                                      • String ID: 64-bit helper EXE wasn't extracted$Cannot utilize 64-bit features on this version of Windows$CreateFile$CreateNamedPipe$CreateProcess$D$Helper process PID: %u$SetNamedPipeHandleState$Starting 64-bit helper process.$\\.\pipe\InnoSetup64BitHelper-%.8x-%.8x-%.8x-%.8x%.8x$helper %d 0x%x$i
                                                                                                                                                                                                      • API String ID: 770386003-3271284199
                                                                                                                                                                                                      • Opcode ID: 80fba83bc81d2b5b43c398149ea40b7dcac2476432f516ce8150cb8f3d9cd01d
                                                                                                                                                                                                      • Instruction ID: 01244017a6d81f6d28e4b5174d8fffcdbc0783d4be9496fecaa57000614c8eca
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 80fba83bc81d2b5b43c398149ea40b7dcac2476432f516ce8150cb8f3d9cd01d
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 71711370A003449EDB10EF65CC45B9EBBF4EB15705F5084BAF918FB282DB7899448F69
                                                                                                                                                                                                      Function 00478024 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 94COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                        • Part of subcall function 00477E90: GetModuleHandleA.KERNEL32(kernel32.dll,GetFinalPathNameByHandleA,02182C14,?,?,?,02182C14,00478054,00000000,00478172,?,?,-00000010,?), ref: 00477EA9
                                                                                                                                                                                                        • Part of subcall function 00477E90: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00477EAF
                                                                                                                                                                                                        • Part of subcall function 00477E90: GetFileAttributesA.KERNEL32(00000000,00000000,kernel32.dll,GetFinalPathNameByHandleA,02182C14,?,?,?,02182C14,00478054,00000000,00478172,?,?,-00000010,?), ref: 00477EC2
                                                                                                                                                                                                        • Part of subcall function 00477E90: CreateFileA.KERNEL32(00000000,00000000,00000007,00000000,00000003,00000000,00000000,00000000,00000000,kernel32.dll,GetFinalPathNameByHandleA,02182C14,?,?,?,02182C14), ref: 00477EEC
                                                                                                                                                                                                        • Part of subcall function 00477E90: CloseHandle.KERNEL32(00000000,?,?,?,02182C14,00478054,00000000,00478172,?,?,-00000010,?), ref: 00477F0A
                                                                                                                                                                                                        • Part of subcall function 00477F68: GetCurrentDirectoryA.KERNEL32(00000104,?,00000000,00477FFA,?,?,?,02182C14,?,0047805C,00000000,00478172,?,?,-00000010,?), ref: 00477F98
                                                                                                                                                                                                      • ShellExecuteEx.SHELL32(0000003C), ref: 004780AC
                                                                                                                                                                                                      • GetLastError.KERNEL32(00000000,00478172,?,?,-00000010,?), ref: 004780B5
                                                                                                                                                                                                      • MsgWaitForMultipleObjects.USER32(00000001,00000000,00000000,000000FF,000000FF), ref: 00478102
                                                                                                                                                                                                      • GetExitCodeProcess.KERNEL32(00000000,00000000), ref: 00478126
                                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000,00478157,00000000,00000000,000000FF,000000FF,00000000,00478150,?,00000000,00478172,?,?,-00000010,?), ref: 0047814A
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Handle$CloseFile$AddressAttributesCodeCreateCurrentDirectoryErrorExecuteExitLastModuleMultipleObjectsProcProcessShellWait
                                                                                                                                                                                                      • String ID: <$GetExitCodeProcess$MsgWaitForMultipleObjects$ShellExecuteEx$ShellExecuteEx returned hProcess=0$runas
                                                                                                                                                                                                      • API String ID: 883996979-221126205
                                                                                                                                                                                                      • Opcode ID: 8788230693866ed6bcb85df324b2142f094c57ec83f56fa9ac32c36753e82478
                                                                                                                                                                                                      • Instruction ID: 4776828256a8cc8572350b5820200226dc7264e1f18f620f8b2e082d5f540a6f
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 8788230693866ed6bcb85df324b2142f094c57ec83f56fa9ac32c36753e82478
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 6E316670940208AEDB10EFE6C845ADEB7B8EB04318F90847FF518F7281DA7899058B59
                                                                                                                                                                                                      Function 00418384 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 58windowCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • IsIconic.USER32(?), ref: 00418393
                                                                                                                                                                                                      • GetWindowPlacement.USER32(?,0000002C), ref: 004183B0
                                                                                                                                                                                                      • GetWindowRect.USER32(?), ref: 004183CC
                                                                                                                                                                                                      • GetWindowLongA.USER32(?,000000F0), ref: 004183DA
                                                                                                                                                                                                      • GetWindowLongA.USER32(?,000000F8), ref: 004183EF
                                                                                                                                                                                                      • ScreenToClient.USER32(00000000), ref: 004183F8
                                                                                                                                                                                                      • ScreenToClient.USER32(00000000,?), ref: 00418403
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Window$ClientLongScreen$IconicPlacementRect
                                                                                                                                                                                                      • String ID: ,
                                                                                                                                                                                                      • API String ID: 2266315723-3772416878
                                                                                                                                                                                                      • Opcode ID: 093fbc58c9f2bb22a74bd7cb36b3f86111f4d6c014dbe9a16a5ffda61369e0f0
                                                                                                                                                                                                      • Instruction ID: 8875a2d430ef8be2c5346fa25315cde737655516302bc4d2344e38a88124d083
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 093fbc58c9f2bb22a74bd7cb36b3f86111f4d6c014dbe9a16a5ffda61369e0f0
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 2B112B71505201ABEB00DF69C885F9B77E8AF48314F04067EFD58DB296D738D900CB65
                                                                                                                                                                                                      Function 004555E4 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 41shutdownCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetCurrentProcess.KERNEL32(00000028), ref: 004555F3
                                                                                                                                                                                                      • OpenProcessToken.ADVAPI32(00000000,00000028), ref: 004555F9
                                                                                                                                                                                                      • LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,00000028), ref: 00455612
                                                                                                                                                                                                      • AdjustTokenPrivileges.ADVAPI32(?,00000000,00000002,00000000,00000000,00000000), ref: 00455639
                                                                                                                                                                                                      • GetLastError.KERNEL32(?,00000000,00000002,00000000,00000000,00000000), ref: 0045563E
                                                                                                                                                                                                      • ExitWindowsEx.USER32(00000002,00000000), ref: 0045564F
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: ProcessToken$AdjustCurrentErrorExitLastLookupOpenPrivilegePrivilegesValueWindows
                                                                                                                                                                                                      • String ID: SeShutdownPrivilege
                                                                                                                                                                                                      • API String ID: 107509674-3733053543
                                                                                                                                                                                                      • Opcode ID: 23a1c1ca7702ac245645511191d061da24fcba761293a90f9603509016b7b969
                                                                                                                                                                                                      • Instruction ID: 23182b732e3c774e917f784577cc733395bd6f0e504c2650860deaf78f25ff04
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 23a1c1ca7702ac245645511191d061da24fcba761293a90f9603509016b7b969
                                                                                                                                                                                                      • Instruction Fuzzy Hash: CBF0C870294B41B9EA10A6718C17F3B21C89B40709F80083ABD05E90D3D7BDD40C4A2E
                                                                                                                                                                                                      Function 00497C14 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 90fileCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • FindFirstFileA.KERNEL32(00000000,?,00000000,00497D52,?,?,00000000,0049B628,?,00497EDC,00000000,00497F30,?,?,00000000,0049B628), ref: 00497C6B
                                                                                                                                                                                                      • SetFileAttributesA.KERNEL32(00000000,00000010), ref: 00497CEE
                                                                                                                                                                                                      • FindNextFileA.KERNEL32(000000FF,?,00000000,00497D2A,?,00000000,?,00000000,00497D52,?,?,00000000,0049B628,?,00497EDC,00000000), ref: 00497D06
                                                                                                                                                                                                      • FindClose.KERNEL32(000000FF,00497D31,00497D2A,?,00000000,?,00000000,00497D52,?,?,00000000,0049B628,?,00497EDC,00000000,00497F30), ref: 00497D24
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: FileFind$AttributesCloseFirstNext
                                                                                                                                                                                                      • String ID: isRS-$isRS-???.tmp
                                                                                                                                                                                                      • API String ID: 134685335-3422211394
                                                                                                                                                                                                      • Opcode ID: 364c0e76f2c6b87ee015195f117b48597cda05d20fe84bdce713179882c005fd
                                                                                                                                                                                                      • Instruction ID: 58584d30a9cebb9496c34c78ac808807487b68c9e5340ea926fa5a91c3adbdad
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 364c0e76f2c6b87ee015195f117b48597cda05d20fe84bdce713179882c005fd
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 22316571A146086BDF10EF65CC41ADEBBBCDF49304F5085BBA908A32A1E63C9E458F58
                                                                                                                                                                                                      Function 004573E0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 238windownativeCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • PostMessageA.USER32(00000000,00000000,00000000,00000000), ref: 0045745D
                                                                                                                                                                                                      • PostMessageA.USER32(00000000,00000000,00000000,00000000), ref: 00457484
                                                                                                                                                                                                      • SetForegroundWindow.USER32(?), ref: 00457495
                                                                                                                                                                                                      • NtdllDefWindowProc_A.USER32(00000000,?,?,?,00000000,0045776F,?,00000000,004577AB), ref: 0045775A
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      • Cannot evaluate variable because [Code] isn't running yet, xrefs: 004575DA
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: MessagePostWindow$ForegroundNtdllProc_
                                                                                                                                                                                                      • String ID: Cannot evaluate variable because [Code] isn't running yet
                                                                                                                                                                                                      • API String ID: 2236967946-3182603685
                                                                                                                                                                                                      • Opcode ID: c878fce27bc3c8dc75fad0f5f900a48c4cc5de30f49b2c425ab4ccba2d1645e8
                                                                                                                                                                                                      • Instruction ID: fa7acb0e2d6b8d582b6902519899a90ae2b0afcf3fbb82d78ce799b77582f668
                                                                                                                                                                                                      • Opcode Fuzzy Hash: c878fce27bc3c8dc75fad0f5f900a48c4cc5de30f49b2c425ab4ccba2d1645e8
                                                                                                                                                                                                      • Instruction Fuzzy Hash: DF91D134608204EFD715CF69E991F5ABBF9FB49704F2180BAEC0497792D638AE04DB58
                                                                                                                                                                                                      Function 00417CD0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 76windowCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • IsIconic.USER32(?), ref: 00417D0F
                                                                                                                                                                                                      • SetWindowPos.USER32(?,00000000,?,?,?,?,00000014,?), ref: 00417D2D
                                                                                                                                                                                                      • GetWindowPlacement.USER32(?,0000002C), ref: 00417D63
                                                                                                                                                                                                      • SetWindowPlacement.USER32(?,0000002C,?,0000002C), ref: 00417D8A
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Window$Placement$Iconic
                                                                                                                                                                                                      • String ID: ,
                                                                                                                                                                                                      • API String ID: 568898626-3772416878
                                                                                                                                                                                                      • Opcode ID: a0af22d6e47f15c5c805b34526d81a80d06eca119401db975a7b3104afeb2d4e
                                                                                                                                                                                                      • Instruction ID: e85585575f8c5a3e7823c55acc6b28d6d187d41511fbfc80546af44b70413e2d
                                                                                                                                                                                                      • Opcode Fuzzy Hash: a0af22d6e47f15c5c805b34526d81a80d06eca119401db975a7b3104afeb2d4e
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 4C2112716042089BDF10EF69D8C1AEA77B8AF48314F05456AFD18DF346D678DD84CBA8
                                                                                                                                                                                                      Function 00463B50 Relevance: 7.6, APIs: 5, Instructions: 129fileCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • SetErrorMode.KERNEL32(00000001,00000000,00463D0D), ref: 00463B81
                                                                                                                                                                                                      • FindFirstFileA.KERNEL32(00000000,?,00000000,00463CE0,?,00000001,00000000,00463D0D), ref: 00463C10
                                                                                                                                                                                                      • FindNextFileA.KERNEL32(000000FF,?,00000000,00463CC2,?,00000000,?,00000000,00463CE0,?,00000001,00000000,00463D0D), ref: 00463CA2
                                                                                                                                                                                                      • FindClose.KERNEL32(000000FF,00463CC9,00463CC2,?,00000000,?,00000000,00463CE0,?,00000001,00000000,00463D0D), ref: 00463CBC
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Find$File$CloseErrorFirstModeNext
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 4011626565-0
                                                                                                                                                                                                      • Opcode ID: ea3eed7d1408edc3882bc6792a8114668d7e879bec7624fad3ea01842ef17e57
                                                                                                                                                                                                      • Instruction ID: 951735f7a3c6dd48f486321ddf7fb9c00a217b4e97ee71939f184256b73d479b
                                                                                                                                                                                                      • Opcode Fuzzy Hash: ea3eed7d1408edc3882bc6792a8114668d7e879bec7624fad3ea01842ef17e57
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 2B41A871A00A58AFCB10EF65DC45ADDB7B8EB88706F4044BAF404B7381E67C9F488E59
                                                                                                                                                                                                      Function 00463FCC Relevance: 7.6, APIs: 5, Instructions: 129fileCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • SetErrorMode.KERNEL32(00000001,00000000,004641B3), ref: 00464041
                                                                                                                                                                                                      • FindFirstFileA.KERNEL32(00000000,?,00000000,0046417E,?,00000001,00000000,004641B3), ref: 00464087
                                                                                                                                                                                                      • FindNextFileA.KERNEL32(000000FF,?,00000000,00464160,?,00000000,?,00000000,0046417E,?,00000001,00000000,004641B3), ref: 0046413C
                                                                                                                                                                                                      • FindClose.KERNEL32(000000FF,00464167,00464160,?,00000000,?,00000000,0046417E,?,00000001,00000000,004641B3), ref: 0046415A
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Find$File$CloseErrorFirstModeNext
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 4011626565-0
                                                                                                                                                                                                      • Opcode ID: 178f21a278dbeca0b5487afb4cc8a3a474e9964bec91cf1fa54baf1df103d301
                                                                                                                                                                                                      • Instruction ID: 3e1e9a66f2526eb02ce93895e5fa1006c5947d115418489384634c6f5ce8cf05
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 178f21a278dbeca0b5487afb4cc8a3a474e9964bec91cf1fa54baf1df103d301
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 7341A434B00A58AFCF11EF65CC859DEB7B9EBC8305F4044AAF804A7341E6389E848E49
                                                                                                                                                                                                      Function 0042E934 Relevance: 7.6, APIs: 5, Instructions: 50fileCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • CreateFileA.KERNEL32(00000000,C0000000,00000001,00000000,00000003,02000000,00000000,?,?,?,?,00452F3F,00000000,00452F60), ref: 0042E956
                                                                                                                                                                                                      • DeviceIoControl.KERNEL32(00000000,0009C040,?,00000002,00000000,00000000,?,00000000), ref: 0042E981
                                                                                                                                                                                                      • GetLastError.KERNEL32(00000000,C0000000,00000001,00000000,00000003,02000000,00000000,?,?,?,?,00452F3F,00000000,00452F60), ref: 0042E98E
                                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000,00000000,C0000000,00000001,00000000,00000003,02000000,00000000,?,?,?,?,00452F3F,00000000,00452F60), ref: 0042E996
                                                                                                                                                                                                      • SetLastError.KERNEL32(00000000,00000000,00000000,C0000000,00000001,00000000,00000003,02000000,00000000,?,?,?,?,00452F3F,00000000,00452F60), ref: 0042E99C
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: ErrorLast$CloseControlCreateDeviceFileHandle
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 1177325624-0
                                                                                                                                                                                                      • Opcode ID: ca7e64f53124eee773614f4530e241cea0742e07ac6524e5167bff1d6a405f94
                                                                                                                                                                                                      • Instruction ID: 661b18b1de4eb1238568a50ab540e77c3175952f9b14320adb6d96c9b056064d
                                                                                                                                                                                                      • Opcode Fuzzy Hash: ca7e64f53124eee773614f4530e241cea0742e07ac6524e5167bff1d6a405f94
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 80F090B23A17207AF620B57A5C86F7F418CCB89B68F10423BBA04FF1D1D9A85D0555AD
                                                                                                                                                                                                      Function 00483420 Relevance: 6.0, APIs: 4, Instructions: 47windowCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • IsIconic.USER32(?), ref: 0048345E
                                                                                                                                                                                                      • GetWindowLongA.USER32(00000000,000000F0), ref: 0048347C
                                                                                                                                                                                                      • ShowWindow.USER32(00000000,00000005,00000000,000000F0,0049C0A4,0048293A,0048296E,00000000,0048298E,?,?,?,0049C0A4), ref: 0048349E
                                                                                                                                                                                                      • ShowWindow.USER32(00000000,00000000,00000000,000000F0,0049C0A4,0048293A,0048296E,00000000,0048298E,?,?,?,0049C0A4), ref: 004834B2
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Window$Show$IconicLong
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 2754861897-0
                                                                                                                                                                                                      • Opcode ID: 7adc6d23a2e45bfcb47f86f15328f2256524f13007b9a6bd5233fe1c8f26e82e
                                                                                                                                                                                                      • Instruction ID: b2d3f2bb309dc3ccac68fe08692f7b65e7038161d92c55b9b58b225abec03440
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 7adc6d23a2e45bfcb47f86f15328f2256524f13007b9a6bd5233fe1c8f26e82e
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 750152706012409AE601BFE59D8AB5A26C55F10F49F18087BB9009F2A2DA2DDA858B1C
                                                                                                                                                                                                      Function 004625C4 Relevance: 4.6, APIs: 3, Instructions: 67fileCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • FindFirstFileA.KERNEL32(00000000,?,00000000,00462698), ref: 0046261C
                                                                                                                                                                                                      • FindNextFileA.KERNEL32(000000FF,?,00000000,00462678,?,00000000,?,00000000,00462698), ref: 00462658
                                                                                                                                                                                                      • FindClose.KERNEL32(000000FF,0046267F,00462678,?,00000000,?,00000000,00462698), ref: 00462672
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Find$File$CloseFirstNext
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 3541575487-0
                                                                                                                                                                                                      • Opcode ID: e94515bc2c8b3d54fda8ee7ea50903a5de584af26bf4ddc4af921dcd62f8e3d1
                                                                                                                                                                                                      • Instruction ID: 64bef34161faf0391a99b618d3e767a3fd2d5c762390acd0a64fbb4d401bfb5a
                                                                                                                                                                                                      • Opcode Fuzzy Hash: e94515bc2c8b3d54fda8ee7ea50903a5de584af26bf4ddc4af921dcd62f8e3d1
                                                                                                                                                                                                      • Instruction Fuzzy Hash: E921D831904B147ECB11EB65DC41ADEB7ACDB49304F5084F7F808E22A1E6B89E548F5A
                                                                                                                                                                                                      Function 004241DC Relevance: 4.5, APIs: 3, Instructions: 32windowCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • IsIconic.USER32(?), ref: 004241E4
                                                                                                                                                                                                      • SetActiveWindow.USER32(?,?,?,0046CBC7), ref: 004241F1
                                                                                                                                                                                                        • Part of subcall function 0042364C: ShowWindow.USER32(00410460,00000009,?,00000000,0041EDA4,0042393A,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00423C0C), ref: 00423667
                                                                                                                                                                                                        • Part of subcall function 00423B14: SetWindowPos.USER32(00000000,000000FF,00000000,00000000,00000000,00000000,00000013,?,021825AC,0042420A,?,?,?,0046CBC7), ref: 00423B4F
                                                                                                                                                                                                      • SetFocus.USER32(00000000,?,?,?,0046CBC7), ref: 0042421E
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Window$ActiveFocusIconicShow
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 649377781-0
                                                                                                                                                                                                      • Opcode ID: 1be179083055f96161d8b165ddd04f1e3bd56871e014c6a07f585ac04199aa1a
                                                                                                                                                                                                      • Instruction ID: c953833529836f01456b8f788e47b4b7c36f7a841d6c6df07f57e62630513da6
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 1be179083055f96161d8b165ddd04f1e3bd56871e014c6a07f585ac04199aa1a
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 8CF030B170012097CB10BFAAA8C5B9676A8AB48344F5500BBBD05DF357CA7CDC018778
                                                                                                                                                                                                      Function 00417CCE Relevance: 3.0, APIs: 2, Instructions: 49windowCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • IsIconic.USER32(?), ref: 00417D0F
                                                                                                                                                                                                      • SetWindowPos.USER32(?,00000000,?,?,?,?,00000014,?), ref: 00417D2D
                                                                                                                                                                                                      • GetWindowPlacement.USER32(?,0000002C), ref: 00417D63
                                                                                                                                                                                                      • SetWindowPlacement.USER32(?,0000002C,?,0000002C), ref: 00417D8A
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Window$Placement$Iconic
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 568898626-0
                                                                                                                                                                                                      • Opcode ID: 76c66e33316401a89d3facc50d11a2b6f1ba08a7ab00baf439cd89f832e1e53a
                                                                                                                                                                                                      • Instruction ID: d9358ea7cd183770b33139a8ac7b7a0a70302bd2c01e5fc8313c3e2814ac7f2c
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 76c66e33316401a89d3facc50d11a2b6f1ba08a7ab00baf439cd89f832e1e53a
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 33012C71204108ABDB10EE59D8C1EF673A8AF45724F154566FD19DF242D639ED8087A8
                                                                                                                                                                                                      Function 00417598 Relevance: 3.0, APIs: 2, Instructions: 44windowCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CaptureIconic
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 2277910766-0
                                                                                                                                                                                                      • Opcode ID: c8f0edb1377470e81cbec4a2b95b5efcfd9f911131a56f14dd142127f01798ba
                                                                                                                                                                                                      • Instruction ID: 6cb7601519473143bf4e876ebf6758ccc8fc4fa751d6c6e0357a6193460a6b05
                                                                                                                                                                                                      • Opcode Fuzzy Hash: c8f0edb1377470e81cbec4a2b95b5efcfd9f911131a56f14dd142127f01798ba
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 0AF0A4723056425BD730AB2EC984AB762F69F84314B14403BE419CBFA1EB3CDCC08798
                                                                                                                                                                                                      Function 00424194 Relevance: 3.0, APIs: 2, Instructions: 22windowCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • IsIconic.USER32(?), ref: 0042419B
                                                                                                                                                                                                        • Part of subcall function 00423A84: EnumWindows.USER32(00423A1C), ref: 00423AA8
                                                                                                                                                                                                        • Part of subcall function 00423A84: GetWindow.USER32(?,00000003), ref: 00423ABD
                                                                                                                                                                                                        • Part of subcall function 00423A84: GetWindowLongA.USER32(?,000000EC), ref: 00423ACC
                                                                                                                                                                                                        • Part of subcall function 00423A84: SetWindowPos.USER32(00000000,\AB,00000000,00000000,00000000,00000000,00000013,?,000000EC,?,?,?,004241AB,?,?,00423D73), ref: 00423B02
                                                                                                                                                                                                      • SetActiveWindow.USER32(?,?,?,00423D73,00000000,0042415C), ref: 004241AF
                                                                                                                                                                                                        • Part of subcall function 0042364C: ShowWindow.USER32(00410460,00000009,?,00000000,0041EDA4,0042393A,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00423C0C), ref: 00423667
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Window$ActiveEnumIconicLongShowWindows
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 2671590913-0
                                                                                                                                                                                                      • Opcode ID: b2ff140757208bd7b7cc33ac29151dbeb423d1cdddd3b288bc041a56f1810338
                                                                                                                                                                                                      • Instruction ID: ce5d4440ec1c13bcfda566247f28ea27228b22b89c70f7a48f218b5e8bc86154
                                                                                                                                                                                                      • Opcode Fuzzy Hash: b2ff140757208bd7b7cc33ac29151dbeb423d1cdddd3b288bc041a56f1810338
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 55E01AA070011087DB10AFAADCC8B9632A9BB48304F55017ABD49CF35BD63CC8608724
                                                                                                                                                                                                      Function 004125D8 Relevance: 1.7, APIs: 1, Instructions: 188nativeCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • NtdllDefWindowProc_A.USER32(?,?,?,?,00000000,004127D5), ref: 004127C3
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: NtdllProc_Window
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 4255912815-0
                                                                                                                                                                                                      • Opcode ID: 52e37b400ef70ce07d55a0833d187e2ce83493dd1eac51222033d67a41acb98e
                                                                                                                                                                                                      • Instruction ID: 2c049f03cfb376e3baa0368465928f91904f6d03483072bf0e6cb5f6a46bccc5
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 52e37b400ef70ce07d55a0833d187e2ce83493dd1eac51222033d67a41acb98e
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 4A5102357082048FD710DB6ADA80A9BF3E5EF98314B2082BBD814C77A1D7B8AD91C75D
                                                                                                                                                                                                      Function 004785E0 Relevance: 1.6, APIs: 1, Instructions: 107nativeCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • NtdllDefWindowProc_A.USER32(?,?,?,?), ref: 0047872E
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: NtdllProc_Window
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 4255912815-0
                                                                                                                                                                                                      • Opcode ID: 325927527603c558aafadcdcf7495ada4e8f38c5787c000dc039267e562bd8f4
                                                                                                                                                                                                      • Instruction ID: 93be4e423146f0b72d2fb04b2818289b08cc6f156d75f667f85849a608f59376
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 325927527603c558aafadcdcf7495ada4e8f38c5787c000dc039267e562bd8f4
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 81416979604104EFCB10CF99D6889AAB7F5FB48310B74C5AAE809EB701DB38EE41DB55
                                                                                                                                                                                                      Function 0042F520 Relevance: 1.5, APIs: 1, Instructions: 17nativeCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • NtdllDefWindowProc_A.USER32(?,?,?,?), ref: 0042F53C
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: NtdllProc_Window
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 4255912815-0
                                                                                                                                                                                                      • Opcode ID: 84fa915654b0e9cabe4af8b3610e56d273e883bd018482bfacacc2813b1fcd3b
                                                                                                                                                                                                      • Instruction ID: 7ca9c19e24a5def9c493c34941f9da96f9ca037215ec7a65a90973bf7a04e639
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 84fa915654b0e9cabe4af8b3610e56d273e883bd018482bfacacc2813b1fcd3b
                                                                                                                                                                                                      • Instruction Fuzzy Hash: FCD09E7120011D7B9B00DE99E840D6B33AD9B88710B909925F945D7642D634ED9197A5
                                                                                                                                                                                                      Function 0044B658 Relevance: 166.5, APIs: 48, Strings: 47, Instructions: 252libraryloaderCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                        • Part of subcall function 0044B604: GetVersionExA.KERNEL32(00000094), ref: 0044B621
                                                                                                                                                                                                      • LoadLibraryA.KERNEL32(uxtheme.dll,?,0044F775,00498762), ref: 0044B67F
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,OpenThemeData), ref: 0044B697
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,CloseThemeData), ref: 0044B6A9
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,DrawThemeBackground), ref: 0044B6BB
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,DrawThemeText), ref: 0044B6CD
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,GetThemeBackgroundContentRect), ref: 0044B6DF
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,GetThemeBackgroundContentRect), ref: 0044B6F1
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,GetThemePartSize), ref: 0044B703
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,GetThemeTextExtent), ref: 0044B715
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,GetThemeTextMetrics), ref: 0044B727
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,GetThemeBackgroundRegion), ref: 0044B739
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,HitTestThemeBackground), ref: 0044B74B
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,DrawThemeEdge), ref: 0044B75D
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,DrawThemeIcon), ref: 0044B76F
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,IsThemePartDefined), ref: 0044B781
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,IsThemeBackgroundPartiallyTransparent), ref: 0044B793
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,GetThemeColor), ref: 0044B7A5
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,GetThemeMetric), ref: 0044B7B7
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,GetThemeString), ref: 0044B7C9
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,GetThemeBool), ref: 0044B7DB
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,GetThemeInt), ref: 0044B7ED
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,GetThemeEnumValue), ref: 0044B7FF
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,GetThemePosition), ref: 0044B811
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,GetThemeFont), ref: 0044B823
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,GetThemeRect), ref: 0044B835
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,GetThemeMargins), ref: 0044B847
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,GetThemeIntList), ref: 0044B859
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,GetThemePropertyOrigin), ref: 0044B86B
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,SetWindowTheme), ref: 0044B87D
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,GetThemeFilename), ref: 0044B88F
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,GetThemeSysColor), ref: 0044B8A1
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,GetThemeSysColorBrush), ref: 0044B8B3
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,GetThemeSysBool), ref: 0044B8C5
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,GetThemeSysSize), ref: 0044B8D7
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,GetThemeSysFont), ref: 0044B8E9
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,GetThemeSysString), ref: 0044B8FB
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,GetThemeSysInt), ref: 0044B90D
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,IsThemeActive), ref: 0044B91F
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,IsAppThemed), ref: 0044B931
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,GetWindowTheme), ref: 0044B943
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,EnableThemeDialogTexture), ref: 0044B955
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,IsThemeDialogTextureEnabled), ref: 0044B967
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,GetThemeAppProperties), ref: 0044B979
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,SetThemeAppProperties), ref: 0044B98B
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,GetCurrentThemeName), ref: 0044B99D
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,GetThemeDocumentationProperty), ref: 0044B9AF
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,DrawThemeParentBackground), ref: 0044B9C1
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,EnableTheming), ref: 0044B9D3
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: AddressProc$LibraryLoadVersion
                                                                                                                                                                                                      • String ID: CloseThemeData$DrawThemeBackground$DrawThemeEdge$DrawThemeIcon$DrawThemeParentBackground$DrawThemeText$EnableThemeDialogTexture$EnableTheming$GetCurrentThemeName$GetThemeAppProperties$GetThemeBackgroundContentRect$GetThemeBackgroundRegion$GetThemeBool$GetThemeColor$GetThemeDocumentationProperty$GetThemeEnumValue$GetThemeFilename$GetThemeFont$GetThemeInt$GetThemeIntList$GetThemeMargins$GetThemeMetric$GetThemePartSize$GetThemePosition$GetThemePropertyOrigin$GetThemeRect$GetThemeString$GetThemeSysBool$GetThemeSysColor$GetThemeSysColorBrush$GetThemeSysFont$GetThemeSysInt$GetThemeSysSize$GetThemeSysString$GetThemeTextExtent$GetThemeTextMetrics$GetWindowTheme$HitTestThemeBackground$IsAppThemed$IsThemeActive$IsThemeBackgroundPartiallyTransparent$IsThemeDialogTextureEnabled$IsThemePartDefined$OpenThemeData$SetThemeAppProperties$SetWindowTheme$uxtheme.dll
                                                                                                                                                                                                      • API String ID: 1968650500-2910565190
                                                                                                                                                                                                      • Opcode ID: 4248c38413e99d9464b79edb7fe9b1fdc4fa56b35b8262d24df0eec612bb70b6
                                                                                                                                                                                                      • Instruction ID: e93aa9000a3b975727f71862fff1c9a8a52c50bca2d3d110ef64c9f3a3b13d35
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 4248c38413e99d9464b79edb7fe9b1fdc4fa56b35b8262d24df0eec612bb70b6
                                                                                                                                                                                                      • Instruction Fuzzy Hash: D391A8F0A40B11ABEB00EFB5AD96A2A3BA8EB15714310067BB454DF295D778DC108FDD
                                                                                                                                                                                                      Function 004923A8 Relevance: 56.4, APIs: 16, Strings: 16, Instructions: 431sleepCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • Sleep.KERNEL32(00000000,00000000,0049289D,?,?,?,?,00000000,00000000,00000000), ref: 004923E8
                                                                                                                                                                                                      • FindWindowA.USER32(00000000,00000000), ref: 00492419
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: FindSleepWindow
                                                                                                                                                                                                      • String ID: CALLDLLPROC$CHARTOOEMBUFF$CREATEMUTEX$FINDWINDOWBYCLASSNAME$FINDWINDOWBYWINDOWNAME$FREEDLL$LOADDLL$OEMTOCHARBUFF$POSTBROADCASTMESSAGE$POSTMESSAGE$REGISTERWINDOWMESSAGE$SENDBROADCASTMESSAGE$SENDBROADCASTNOTIFYMESSAGE$SENDMESSAGE$SENDNOTIFYMESSAGE$SLEEP
                                                                                                                                                                                                      • API String ID: 3078808852-3310373309
                                                                                                                                                                                                      • Opcode ID: 70a9f38d732694e01fb2a8a93b740b75d67cd49c1d3b68deff2ab7e7f14d0a4a
                                                                                                                                                                                                      • Instruction ID: 9f3505894e5a6fd9d1366d4270c7319e33b1617852d99992837f934410b553a1
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 70a9f38d732694e01fb2a8a93b740b75d67cd49c1d3b68deff2ab7e7f14d0a4a
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 0CC182A0B042413BDB14FF3E9D4151F59A99B94708B118A3FB446EB38BCE7DED0A4399
                                                                                                                                                                                                      Function 0041CA0C Relevance: 33.2, APIs: 22, Instructions: 213windowCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetDC.USER32(00000000), ref: 0041CA40
                                                                                                                                                                                                      • CreateCompatibleDC.GDI32(?), ref: 0041CA4C
                                                                                                                                                                                                      • CreateBitmap.GDI32(0041A944,?,00000001,00000001,00000000), ref: 0041CA70
                                                                                                                                                                                                      • CreateCompatibleBitmap.GDI32(?,0041A944,?), ref: 0041CA80
                                                                                                                                                                                                      • SelectObject.GDI32(0041CE3C,00000000), ref: 0041CA9B
                                                                                                                                                                                                      • FillRect.USER32(0041CE3C,?,?), ref: 0041CAD6
                                                                                                                                                                                                      • SetTextColor.GDI32(0041CE3C,00000000), ref: 0041CAEB
                                                                                                                                                                                                      • SetBkColor.GDI32(0041CE3C,00000000), ref: 0041CB02
                                                                                                                                                                                                      • PatBlt.GDI32(0041CE3C,00000000,00000000,0041A944,?,00FF0062), ref: 0041CB18
                                                                                                                                                                                                      • CreateCompatibleDC.GDI32(?), ref: 0041CB2B
                                                                                                                                                                                                      • SelectObject.GDI32(00000000,00000000), ref: 0041CB5C
                                                                                                                                                                                                      • SelectPalette.GDI32(00000000,00000000,00000001), ref: 0041CB74
                                                                                                                                                                                                      • RealizePalette.GDI32(00000000), ref: 0041CB7D
                                                                                                                                                                                                      • SelectPalette.GDI32(0041CE3C,00000000,00000001), ref: 0041CB8C
                                                                                                                                                                                                      • RealizePalette.GDI32(0041CE3C), ref: 0041CB95
                                                                                                                                                                                                      • SetTextColor.GDI32(00000000,00000000), ref: 0041CBAE
                                                                                                                                                                                                      • SetBkColor.GDI32(00000000,00000000), ref: 0041CBC5
                                                                                                                                                                                                      • BitBlt.GDI32(0041CE3C,00000000,00000000,0041A944,?,00000000,00000000,00000000,00CC0020), ref: 0041CBE1
                                                                                                                                                                                                      • SelectObject.GDI32(00000000,?), ref: 0041CBEE
                                                                                                                                                                                                      • DeleteDC.GDI32(00000000), ref: 0041CC04
                                                                                                                                                                                                        • Part of subcall function 0041A058: GetSysColor.USER32(?), ref: 0041A062
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: ColorSelect$CreatePalette$CompatibleObject$BitmapRealizeText$DeleteFillRect
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 269503290-0
                                                                                                                                                                                                      • Opcode ID: 5610cf759d7025b655e2849d1764ebaab2a311e46506ba216d1aa554289a1213
                                                                                                                                                                                                      • Instruction ID: 91afdf38925dfcc0a19aef53af63d8b93a06df8cfedaf367688fa0d34ebdb442
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 5610cf759d7025b655e2849d1764ebaab2a311e46506ba216d1aa554289a1213
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 01610071A44648AFDF10EBE9DC86FDFB7B8EB48704F10446AB504E7281D67CA940CB68
                                                                                                                                                                                                      Function 00497F40 Relevance: 23.0, APIs: 7, Strings: 6, Instructions: 251synchronizationCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • ShowWindow.USER32(?,00000005,00000000,004982D8,?,?,00000000,?,00000000,00000000,?,0049868F,00000000,00498699,?,00000000), ref: 00497FC3
                                                                                                                                                                                                      • CreateMutexA.KERNEL32(00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000,004982D8,?,?,00000000,?,00000000,00000000,?,0049868F,00000000), ref: 00497FD6
                                                                                                                                                                                                      • ShowWindow.USER32(?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000,004982D8,?,?,00000000,?,00000000,00000000), ref: 00497FE6
                                                                                                                                                                                                      • MsgWaitForMultipleObjects.USER32(00000001,00000000,00000000,000000FF,000000FF), ref: 00498007
                                                                                                                                                                                                      • ShowWindow.USER32(?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000,004982D8,?,?,00000000,?,00000000), ref: 00498017
                                                                                                                                                                                                        • Part of subcall function 0042D44C: GetModuleFileNameA.KERNEL32(00000000,?,00000104,00000000,0042D4DA,?,?,?,00000001,?,0045607E,00000000,004560E6), ref: 0042D481
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: ShowWindow$CreateFileModuleMultipleMutexNameObjectsWait
                                                                                                                                                                                                      • String ID: .lst$.msg$/REG$/REGU$Inno-Setup-RegSvr-Mutex$Setup
                                                                                                                                                                                                      • API String ID: 2000705611-3672972446
                                                                                                                                                                                                      • Opcode ID: acab9580149f75eae7839736e9631fcca2424d0ecbbcfe327cba637ac9836c34
                                                                                                                                                                                                      • Instruction ID: 42a01cccdaaec234e2c43ae8d099a56eb68d33786198a0d03eeaed72e33259cf
                                                                                                                                                                                                      • Opcode Fuzzy Hash: acab9580149f75eae7839736e9631fcca2424d0ecbbcfe327cba637ac9836c34
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 3991B530A046049FDF11EBA9D852BAE7BA4EB4A704F5144BBF500AB682DE7D9C05CB1D
                                                                                                                                                                                                      Function 0045A528 Relevance: 23.0, APIs: 2, Strings: 11, Instructions: 209COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetLastError.KERNEL32(00000000,0045A7E4,?,?,?,?,?,00000006,?,00000000,004973CD,?,00000000,00497470), ref: 0045A696
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: ErrorLast
                                                                                                                                                                                                      • String ID: .chm$.chw$.fts$.gid$.hlp$.lnk$Deleting file: %s$Failed to delete the file; it may be in use (%d).$Failed to strip read-only attribute.$Stripped read-only attribute.$The file appears to be in use (%d). Will delete on restart.
                                                                                                                                                                                                      • API String ID: 1452528299-3112430753
                                                                                                                                                                                                      • Opcode ID: 36e62968e3df31f42ef0a3f4ecda86c0a22392123400a2d67fb0e4a2d74aa0fb
                                                                                                                                                                                                      • Instruction ID: 3d84b67d4b55823e814de2816039390ec2683d954eb16ce362ee678782389cb9
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 36e62968e3df31f42ef0a3f4ecda86c0a22392123400a2d67fb0e4a2d74aa0fb
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 9A719030B002485BCB10EB698891BAE77B59F48719F54856BFC01AB383DA7CDE1D875E
                                                                                                                                                                                                      Function 0045CA10 Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 182libraryloadermemoryCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetVersion.KERNEL32 ref: 0045CA2A
                                                                                                                                                                                                      • GetModuleHandleA.KERNEL32(advapi32.dll), ref: 0045CA4A
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,GetNamedSecurityInfoW), ref: 0045CA57
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,SetNamedSecurityInfoW), ref: 0045CA64
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,SetEntriesInAclW), ref: 0045CA72
                                                                                                                                                                                                        • Part of subcall function 0045C918: MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00000000,0045C9B7,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0045C991
                                                                                                                                                                                                      • AllocateAndInitializeSid.ADVAPI32(?,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,0045CC65,?,?,00000000), ref: 0045CB2B
                                                                                                                                                                                                      • GetLastError.KERNEL32(?,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,0045CC65,?,?,00000000), ref: 0045CB34
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: AddressProc$AllocateByteCharErrorHandleInitializeLastModuleMultiVersionWide
                                                                                                                                                                                                      • String ID: GetNamedSecurityInfoW$SetEntriesInAclW$SetNamedSecurityInfoW$W$advapi32.dll
                                                                                                                                                                                                      • API String ID: 59345061-4263478283
                                                                                                                                                                                                      • Opcode ID: c5b63a1d42029dde151d350c6c523910e730ec47f3c01229f67243dfc87c3d26
                                                                                                                                                                                                      • Instruction ID: 9267600119b74d5c47b6def8195b3f0e3f25b5cd065e112b6ecb42d85fa503a5
                                                                                                                                                                                                      • Opcode Fuzzy Hash: c5b63a1d42029dde151d350c6c523910e730ec47f3c01229f67243dfc87c3d26
                                                                                                                                                                                                      • Instruction Fuzzy Hash: B1518571900708EFDB11DFA9C885BAEBBB8EB4C311F14806AF915B7241C6799944CFA9
                                                                                                                                                                                                      Function 0041B3AC Relevance: 21.1, APIs: 14, Instructions: 126windowCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • CreateCompatibleDC.GDI32(00000000), ref: 0041B3C3
                                                                                                                                                                                                      • CreateCompatibleDC.GDI32(00000000), ref: 0041B3CD
                                                                                                                                                                                                      • GetObjectA.GDI32(?,00000018,00000004), ref: 0041B3DF
                                                                                                                                                                                                      • CreateBitmap.GDI32(0000000B,?,00000001,00000001,00000000), ref: 0041B3F6
                                                                                                                                                                                                      • GetDC.USER32(00000000), ref: 0041B402
                                                                                                                                                                                                      • CreateCompatibleBitmap.GDI32(00000000,0000000B,?), ref: 0041B42F
                                                                                                                                                                                                      • ReleaseDC.USER32(00000000,00000000), ref: 0041B455
                                                                                                                                                                                                      • SelectObject.GDI32(00000000,?), ref: 0041B470
                                                                                                                                                                                                      • SelectObject.GDI32(?,00000000), ref: 0041B47F
                                                                                                                                                                                                      • StretchBlt.GDI32(?,00000000,00000000,0000000B,?,00000000,00000000,00000000,?,?,00CC0020), ref: 0041B4AB
                                                                                                                                                                                                      • SelectObject.GDI32(00000000,00000000), ref: 0041B4B9
                                                                                                                                                                                                      • SelectObject.GDI32(?,00000000), ref: 0041B4C7
                                                                                                                                                                                                      • DeleteDC.GDI32(00000000), ref: 0041B4D0
                                                                                                                                                                                                      • DeleteDC.GDI32(?), ref: 0041B4D9
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Object$CreateSelect$Compatible$BitmapDelete$ReleaseStretch
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 644427674-0
                                                                                                                                                                                                      • Opcode ID: 9212dc48eb065078ffd6e64a0fe4b3e7e755c3ed7e1f96497366cc94fc87ddf9
                                                                                                                                                                                                      • Instruction ID: 0f3e5998203d07172116f12fa3fedaa120d09cd030f2870c51d139f455c41937
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 9212dc48eb065078ffd6e64a0fe4b3e7e755c3ed7e1f96497366cc94fc87ddf9
                                                                                                                                                                                                      • Instruction Fuzzy Hash: E941AD71E44619AFDB10DAE9C846FEFB7BCEB08704F104466B614F7281D6786D408BA8
                                                                                                                                                                                                      Function 00454874 Relevance: 19.5, APIs: 7, Strings: 4, Instructions: 244registryCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                        • Part of subcall function 0042DE1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,004836C7,?,00000001,?,?,004836C7,?,00000001,00000000), ref: 0042DE38
                                                                                                                                                                                                      • RegQueryValueExA.ADVAPI32(0045A9BA,00000000,00000000,?,00000000,?,00000000,00454B0D,?,0045A9BA,00000003,00000000,00000000,00454B44), ref: 0045498D
                                                                                                                                                                                                        • Part of subcall function 0042E8C8: FormatMessageA.KERNEL32(00003200,00000000,4C783AFB,00000000,?,00000400,00000000,?,00453273,00000000,kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000), ref: 0042E8E7
                                                                                                                                                                                                      • RegQueryValueExA.ADVAPI32(0045A9BA,00000000,00000000,00000000,?,00000004,00000000,00454A57,?,0045A9BA,00000000,00000000,?,00000000,?,00000000), ref: 00454A11
                                                                                                                                                                                                      • RegQueryValueExA.ADVAPI32(0045A9BA,00000000,00000000,00000000,?,00000004,00000000,00454A57,?,0045A9BA,00000000,00000000,?,00000000,?,00000000), ref: 00454A40
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      • , xrefs: 004548FE
                                                                                                                                                                                                      • Software\Microsoft\Windows\CurrentVersion\SharedDLLs, xrefs: 004548E4
                                                                                                                                                                                                      • Software\Microsoft\Windows\CurrentVersion\SharedDLLs, xrefs: 004548AB
                                                                                                                                                                                                      • RegOpenKeyEx, xrefs: 00454910
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: QueryValue$FormatMessageOpen
                                                                                                                                                                                                      • String ID: $RegOpenKeyEx$Software\Microsoft\Windows\CurrentVersion\SharedDLLs$Software\Microsoft\Windows\CurrentVersion\SharedDLLs
                                                                                                                                                                                                      • API String ID: 2812809588-1577016196
                                                                                                                                                                                                      • Opcode ID: 642a5f30a4765ce89375681098dab7f7f81d271fd72e87252dfabd5673311d5c
                                                                                                                                                                                                      • Instruction ID: 10c729c5df0f457655d9edc07d187ac9b2ad403c2690153cc8aec617143616fc
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 642a5f30a4765ce89375681098dab7f7f81d271fd72e87252dfabd5673311d5c
                                                                                                                                                                                                      • Instruction Fuzzy Hash: D1914871E44148ABDB10DF95C842BDEB7FCEB49309F50406BF900FB282D6789E458B69
                                                                                                                                                                                                      Function 004592A8 Relevance: 19.4, APIs: 3, Strings: 8, Instructions: 165registryCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                        • Part of subcall function 004591B4: RegCloseKey.ADVAPI32(00000000,00000000,00000001,00000000,?,00000000,?,00000002,004592F1,00000000,004594A9,?,00000000,00000000,00000000), ref: 00459201
                                                                                                                                                                                                      • RegCloseKey.ADVAPI32(00000000,00000000,00000001,00000000,00000000,004594A9,?,00000000,00000000,00000000), ref: 0045934F
                                                                                                                                                                                                      • RegCloseKey.ADVAPI32(00000000,00000000,00000001,00000000,00000000,004594A9,?,00000000,00000000,00000000), ref: 004593B9
                                                                                                                                                                                                        • Part of subcall function 0042DE1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,004836C7,?,00000001,?,?,004836C7,?,00000001,00000000), ref: 0042DE38
                                                                                                                                                                                                      • RegCloseKey.ADVAPI32(00000000,00000000,00000001,00000000,00000000,00000001,00000000,00000000,004594A9,?,00000000,00000000,00000000), ref: 00459420
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      • SOFTWARE\Microsoft\.NETFramework\Policy\v4.0, xrefs: 00459302
                                                                                                                                                                                                      • SOFTWARE\Microsoft\.NETFramework\Policy\v1.1, xrefs: 004593D3
                                                                                                                                                                                                      • .NET Framework not found, xrefs: 0045946D
                                                                                                                                                                                                      • SOFTWARE\Microsoft\.NETFramework\Policy\v2.0, xrefs: 0045936C
                                                                                                                                                                                                      • v4.0.30319, xrefs: 00459341
                                                                                                                                                                                                      • .NET Framework version %s not found, xrefs: 00459459
                                                                                                                                                                                                      • v2.0.50727, xrefs: 004593AB
                                                                                                                                                                                                      • v1.1.4322, xrefs: 00459412
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Close$Open
                                                                                                                                                                                                      • String ID: .NET Framework not found$.NET Framework version %s not found$SOFTWARE\Microsoft\.NETFramework\Policy\v1.1$SOFTWARE\Microsoft\.NETFramework\Policy\v2.0$SOFTWARE\Microsoft\.NETFramework\Policy\v4.0$v1.1.4322$v2.0.50727$v4.0.30319
                                                                                                                                                                                                      • API String ID: 2976201327-446240816
                                                                                                                                                                                                      • Opcode ID: 54e34cd44602b93ede3f7296a9310ab82d879df4d5c444ac47c898e8d614a2f1
                                                                                                                                                                                                      • Instruction ID: 97f3333ca529404cdccdc0b2d9ed50ca34310147e07c283222f48f4afab481b6
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 54e34cd44602b93ede3f7296a9310ab82d879df4d5c444ac47c898e8d614a2f1
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 7551B331A04144DBCB04DFA8D8A17EE77B6DB49305F54447BA841DB392E73D9E0ACB18
                                                                                                                                                                                                      Function 00458894 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 70sleepsynchronizationCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • CloseHandle.KERNEL32(?), ref: 004588CB
                                                                                                                                                                                                      • TerminateProcess.KERNEL32(?,00000001,?,00002710,?), ref: 004588E7
                                                                                                                                                                                                      • WaitForSingleObject.KERNEL32(?,00002710,?), ref: 004588F5
                                                                                                                                                                                                      • GetExitCodeProcess.KERNEL32(?), ref: 00458906
                                                                                                                                                                                                      • CloseHandle.KERNEL32(?,?,?,?,00002710,?,00000001,?,00002710,?), ref: 0045894D
                                                                                                                                                                                                      • Sleep.KERNEL32(000000FA,?,?,?,?,00002710,?,00000001,?,00002710,?), ref: 00458969
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      • Helper isn't responding; killing it., xrefs: 004588D7
                                                                                                                                                                                                      • Helper process exited, but failed to get exit code., xrefs: 0045893F
                                                                                                                                                                                                      • Helper process exited., xrefs: 00458915
                                                                                                                                                                                                      • Stopping 64-bit helper process. (PID: %u), xrefs: 004588BD
                                                                                                                                                                                                      • Helper process exited with failure code: 0x%x, xrefs: 00458933
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CloseHandleProcess$CodeExitObjectSingleSleepTerminateWait
                                                                                                                                                                                                      • String ID: Helper isn't responding; killing it.$Helper process exited with failure code: 0x%x$Helper process exited, but failed to get exit code.$Helper process exited.$Stopping 64-bit helper process. (PID: %u)
                                                                                                                                                                                                      • API String ID: 3355656108-1243109208
                                                                                                                                                                                                      • Opcode ID: 73dbfa3cdad617e305c3f832d4c000a78a7b9bdfac17e51cf2f5e1c942fa38a0
                                                                                                                                                                                                      • Instruction ID: 059a586d5f9fe809614c5be1e0bb00d3bdcd38e01f6b882276f5f7501e11c42c
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 73dbfa3cdad617e305c3f832d4c000a78a7b9bdfac17e51cf2f5e1c942fa38a0
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 4C2130706087409AD720E67AC485B6B76D4AF08305F00C82FB9DAE7693DE78E848D75B
                                                                                                                                                                                                      Function 00454528 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 228registryCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                        • Part of subcall function 0042DDE4: RegCreateKeyExA.ADVAPI32(?,?,?,?,?,?,?,?,?), ref: 0042DE10
                                                                                                                                                                                                      • RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,?,00000000,004546FF,?,00000000,004547C3), ref: 0045464F
                                                                                                                                                                                                      • RegCloseKey.ADVAPI32(?,?,?,00000000,00000004,00000000,00000001,?,00000000,?,00000000,004546FF,?,00000000,004547C3), ref: 0045478B
                                                                                                                                                                                                        • Part of subcall function 0042E8C8: FormatMessageA.KERNEL32(00003200,00000000,4C783AFB,00000000,?,00000400,00000000,?,00453273,00000000,kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000), ref: 0042E8E7
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      • RegCreateKeyEx, xrefs: 004545C3
                                                                                                                                                                                                      • Software\Microsoft\Windows\CurrentVersion\SharedDLLs, xrefs: 00454597
                                                                                                                                                                                                      • , xrefs: 004545B1
                                                                                                                                                                                                      • Software\Microsoft\Windows\CurrentVersion\SharedDLLs, xrefs: 00454567
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CloseCreateFormatMessageQueryValue
                                                                                                                                                                                                      • String ID: $RegCreateKeyEx$Software\Microsoft\Windows\CurrentVersion\SharedDLLs$Software\Microsoft\Windows\CurrentVersion\SharedDLLs
                                                                                                                                                                                                      • API String ID: 2481121983-1280779767
                                                                                                                                                                                                      • Opcode ID: 0a13d9f51dc1a177f7c9a0fb74a63c6f8e618ab34d6f7cd4778a0b53d840c415
                                                                                                                                                                                                      • Instruction ID: cde7545684c4620c2d036396f19d9a4160a162433608d969df8f63117b7f1412
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 0a13d9f51dc1a177f7c9a0fb74a63c6f8e618ab34d6f7cd4778a0b53d840c415
                                                                                                                                                                                                      • Instruction Fuzzy Hash: AC81FF75A00209ABDB00DFD5C981BDEB7B9EB49309F50452AF900FB282D7789A45CB69
                                                                                                                                                                                                      Function 004967C0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 141fileCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                        • Part of subcall function 004538BC: CreateFileA.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000,.tmp,00496991,_iu,?,00000000,004539F6), ref: 004539AB
                                                                                                                                                                                                        • Part of subcall function 004538BC: CloseHandle.KERNEL32(00000000,00000000,C0000000,00000000,00000000,00000002,00000080,00000000,.tmp,00496991,_iu,?,00000000,004539F6), ref: 004539BB
                                                                                                                                                                                                      • CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 0049683D
                                                                                                                                                                                                      • SetFileAttributesA.KERNEL32(00000000,00000080,00000000,00496991), ref: 0049685E
                                                                                                                                                                                                      • CreateWindowExA.USER32(00000000,STATIC,004969A0,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00400000,00000000), ref: 00496885
                                                                                                                                                                                                      • SetWindowLongA.USER32(?,000000FC,00496018), ref: 00496898
                                                                                                                                                                                                      • SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000097,00000000,00496964,?,?,000000FC,00496018,00000000,STATIC,004969A0), ref: 004968C8
                                                                                                                                                                                                      • MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000FF), ref: 0049693C
                                                                                                                                                                                                      • CloseHandle.KERNEL32(?,?,?,00000000,00000000,00000000,00000000,00000000,00000097,00000000,00496964,?,?,000000FC,00496018,00000000), ref: 00496948
                                                                                                                                                                                                        • Part of subcall function 00453D30: WritePrivateProfileStringA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00453E17
                                                                                                                                                                                                      • DestroyWindow.USER32(?,0049696B,00000000,00000000,00000000,00000000,00000000,00000097,00000000,00496964,?,?,000000FC,00496018,00000000,STATIC), ref: 0049695E
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Window$File$CloseCreateHandle$AttributesCopyDestroyLongMultipleObjectsPrivateProfileStringWaitWrite
                                                                                                                                                                                                      • String ID: /SECONDPHASE="%s" /FIRSTPHASEWND=$%x $STATIC
                                                                                                                                                                                                      • API String ID: 1549857992-2312673372
                                                                                                                                                                                                      • Opcode ID: 7b9aa83098eabb2dba0b70aa405a2d9f6b8f1b4b66eab831558cfba939a8a2a9
                                                                                                                                                                                                      • Instruction ID: 93ed1b954d13302bbccf96d2c338465d3c98789abcf3618d64464ab15fb4d88f
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 7b9aa83098eabb2dba0b70aa405a2d9f6b8f1b4b66eab831558cfba939a8a2a9
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 71412C70A04608AEDF00EBA5DC42FAE7BB8EB09714F51457AF400F7291D6799A008B69
                                                                                                                                                                                                      Function 0042E418 Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 86registrylibraryloaderCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetModuleHandleA.KERNEL32(kernel32.dll,GetUserDefaultUILanguage,00000000,0042E51D,?,00000000,0047E1C0,00000000), ref: 0042E441
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0042E447
                                                                                                                                                                                                      • RegCloseKey.ADVAPI32(00000000,00000000,00000001,00000000,00000000,kernel32.dll,GetUserDefaultUILanguage,00000000,0042E51D,?,00000000,0047E1C0,00000000), ref: 0042E495
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: AddressCloseHandleModuleProc
                                                                                                                                                                                                      • String ID: .DEFAULT\Control Panel\International$Control Panel\Desktop\ResourceLocale$GetUserDefaultUILanguage$Locale$QaE$kernel32.dll
                                                                                                                                                                                                      • API String ID: 4190037839-2312295185
                                                                                                                                                                                                      • Opcode ID: cc4cf932d7b220052410dacf18b487448e6dec6834fb41b85ae1fa26c47c2f69
                                                                                                                                                                                                      • Instruction ID: f42d7e7755912f49377b3a3c2778cbb45b18f2cdc7334bb7b0fb93ca3fe573dd
                                                                                                                                                                                                      • Opcode Fuzzy Hash: cc4cf932d7b220052410dacf18b487448e6dec6834fb41b85ae1fa26c47c2f69
                                                                                                                                                                                                      • Instruction Fuzzy Hash: E8213230B10225BBDB10EAE6DC51B9E76B8EB44308F90447BA504E7281E77CDE419B5C
                                                                                                                                                                                                      Function 00462864 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 82libraryloaderCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetActiveWindow.USER32 ref: 00462870
                                                                                                                                                                                                      • GetModuleHandleA.KERNEL32(user32.dll), ref: 00462884
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 00462891
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,GetMonitorInfoA), ref: 0046289E
                                                                                                                                                                                                      • GetWindowRect.USER32(?,00000000), ref: 004628EA
                                                                                                                                                                                                      • SetWindowPos.USER32(?,00000000,?,?,00000000,00000000,0000001D,?,00000000), ref: 00462928
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Window$AddressProc$ActiveHandleModuleRect
                                                                                                                                                                                                      • String ID: ($GetMonitorInfoA$MonitorFromWindow$user32.dll
                                                                                                                                                                                                      • API String ID: 2610873146-3407710046
                                                                                                                                                                                                      • Opcode ID: 963cd5e9bec20ae9785dbab648af90e3917fdde5ac028f1e20745c9c218af8a1
                                                                                                                                                                                                      • Instruction ID: fe1f68fcdb92d8fdb5b24afc8a588ee1dd3fc27577eab862170fec9bd430383f
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 963cd5e9bec20ae9785dbab648af90e3917fdde5ac028f1e20745c9c218af8a1
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 4621C5B5301B056BD301EA648D41F3B3699EBC4714F05052AF944DB3C6E6B8EC048B9A
                                                                                                                                                                                                      Function 0042F188 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 82libraryloaderCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetActiveWindow.USER32 ref: 0042F194
                                                                                                                                                                                                      • GetModuleHandleA.KERNEL32(user32.dll), ref: 0042F1A8
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 0042F1B5
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,GetMonitorInfoA), ref: 0042F1C2
                                                                                                                                                                                                      • GetWindowRect.USER32(?,00000000), ref: 0042F20E
                                                                                                                                                                                                      • SetWindowPos.USER32(?,00000000,?,?,00000000,00000000,0000001D), ref: 0042F24C
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Window$AddressProc$ActiveHandleModuleRect
                                                                                                                                                                                                      • String ID: ($GetMonitorInfoA$MonitorFromWindow$user32.dll
                                                                                                                                                                                                      • API String ID: 2610873146-3407710046
                                                                                                                                                                                                      • Opcode ID: fe4f6826bb7301b99e83fbe15c42cc49c8205db95b757379d9683ee99bf223cf
                                                                                                                                                                                                      • Instruction ID: 50a2e38ba83faf67dd7c56e8d7733487d454ef14a416094e89dadcccf0bf0910
                                                                                                                                                                                                      • Opcode Fuzzy Hash: fe4f6826bb7301b99e83fbe15c42cc49c8205db95b757379d9683ee99bf223cf
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 3821F279704710ABD300EA68ED41F3B37A9DB89714F88457AF944DB382DA79EC044BA9
                                                                                                                                                                                                      Function 00458A6C Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 127pipeCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,00000000,00458C4B,?,00000000,00458CAE,?,?,00000000,00000000), ref: 00458AC9
                                                                                                                                                                                                      • TransactNamedPipe.KERNEL32(?,-00000020,0000000C,-00004034,00000014,00000000,?,00000000,00458BE0,?,00000000,00000001,00000000,00000000,00000000,00458C4B), ref: 00458B26
                                                                                                                                                                                                      • GetLastError.KERNEL32(?,-00000020,0000000C,-00004034,00000014,00000000,?,00000000,00458BE0,?,00000000,00000001,00000000,00000000,00000000,00458C4B), ref: 00458B33
                                                                                                                                                                                                      • MsgWaitForMultipleObjects.USER32(00000001,00000000,00000000,000000FF,000000FF), ref: 00458B7F
                                                                                                                                                                                                      • GetOverlappedResult.KERNEL32(?,?,00000000,00000001,00458BB9,?,-00000020,0000000C,-00004034,00000014,00000000,?,00000000,00458BE0,?,00000000), ref: 00458BA5
                                                                                                                                                                                                      • GetLastError.KERNEL32(?,?,00000000,00000001,00458BB9,?,-00000020,0000000C,-00004034,00000014,00000000,?,00000000,00458BE0,?,00000000), ref: 00458BAC
                                                                                                                                                                                                        • Part of subcall function 0045349C: GetLastError.KERNEL32(00000000,00454031,00000005,00000000,00454066,?,?,00000000,0049B628,00000004,00000000,00000000,00000000,?,00497F15,00000000), ref: 0045349F
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: ErrorLast$CreateEventMultipleNamedObjectsOverlappedPipeResultTransactWait
                                                                                                                                                                                                      • String ID: CreateEvent$TransactNamedPipe
                                                                                                                                                                                                      • API String ID: 2182916169-3012584893
                                                                                                                                                                                                      • Opcode ID: a68127cb91b10de3174771854b6b789016aac8edb96e3d69966a751de492a7e2
                                                                                                                                                                                                      • Instruction ID: 4e8b515c978fc0f7227371b00e454fc29eb41545a574c41675fd698137751177
                                                                                                                                                                                                      • Opcode Fuzzy Hash: a68127cb91b10de3174771854b6b789016aac8edb96e3d69966a751de492a7e2
                                                                                                                                                                                                      • Instruction Fuzzy Hash: D74185B1A00608AFDB15DF95CD41F9EB7F8FB48715F10406AF900F7292CA78AE44CA68
                                                                                                                                                                                                      Function 00456B6C Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 99libraryloaderCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetModuleHandleA.KERNEL32(OLEAUT32.DLL,UnRegisterTypeLib,00000000,00456CD1,?,?,00000031,?), ref: 00456B94
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,OLEAUT32.DLL), ref: 00456B9A
                                                                                                                                                                                                      • LoadTypeLib.OLEAUT32(00000000,?), ref: 00456BE7
                                                                                                                                                                                                        • Part of subcall function 0045349C: GetLastError.KERNEL32(00000000,00454031,00000005,00000000,00454066,?,?,00000000,0049B628,00000004,00000000,00000000,00000000,?,00497F15,00000000), ref: 0045349F
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: AddressErrorHandleLastLoadModuleProcType
                                                                                                                                                                                                      • String ID: GetProcAddress$ITypeLib::GetLibAttr$LoadTypeLib$OLEAUT32.DLL$UnRegisterTypeLib$UnRegisterTypeLib
                                                                                                                                                                                                      • API String ID: 1914119943-2711329623
                                                                                                                                                                                                      • Opcode ID: ee3ea3d82efd4fb2b54eebd443786074e6cae9edf60e5ac548ea64bc7aca37c1
                                                                                                                                                                                                      • Instruction ID: 513f35abe53900720ade907ad6bd055a7f67a8f7377afb521354ad4100752fe6
                                                                                                                                                                                                      • Opcode Fuzzy Hash: ee3ea3d82efd4fb2b54eebd443786074e6cae9edf60e5ac548ea64bc7aca37c1
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 54319671700604AFDB02EFAACD51D5BB7BDEB8974575284A6BC04D3752DA38DD04C728
                                                                                                                                                                                                      Function 00416D80 Relevance: 15.2, APIs: 10, Instructions: 167windowCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • RectVisible.GDI32(?,?), ref: 00416E13
                                                                                                                                                                                                      • SaveDC.GDI32(?), ref: 00416E27
                                                                                                                                                                                                      • IntersectClipRect.GDI32(?,00000000,00000000,?,?), ref: 00416E4A
                                                                                                                                                                                                      • RestoreDC.GDI32(?,?), ref: 00416E65
                                                                                                                                                                                                      • CreateSolidBrush.GDI32(00000000), ref: 00416EE5
                                                                                                                                                                                                      • FrameRect.USER32(?,?,?), ref: 00416F18
                                                                                                                                                                                                      • DeleteObject.GDI32(?), ref: 00416F22
                                                                                                                                                                                                      • CreateSolidBrush.GDI32(00000000), ref: 00416F32
                                                                                                                                                                                                      • FrameRect.USER32(?,?,?), ref: 00416F65
                                                                                                                                                                                                      • DeleteObject.GDI32(?), ref: 00416F6F
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Rect$BrushCreateDeleteFrameObjectSolid$ClipIntersectRestoreSaveVisible
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 375863564-0
                                                                                                                                                                                                      • Opcode ID: fddca708b1e9b8a3c9570e2c84aca495e13af092fdabcc505fee3e5d33c2ade1
                                                                                                                                                                                                      • Instruction ID: c082a38e55a2621cff38c0036c5e412d4739722926df34ebe37a7eff5f7859fc
                                                                                                                                                                                                      • Opcode Fuzzy Hash: fddca708b1e9b8a3c9570e2c84aca495e13af092fdabcc505fee3e5d33c2ade1
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 70515A712086459FDB50EF69C8C4B9B77E8AF48314F15466AFD488B286C738EC81CB99
                                                                                                                                                                                                      Function 00404ABF Relevance: 15.1, APIs: 10, Instructions: 122fileCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • CreateFileA.KERNEL32(00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00404B46
                                                                                                                                                                                                      • GetFileSize.KERNEL32(?,00000000,00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00404B6A
                                                                                                                                                                                                      • SetFilePointer.KERNEL32(?,-00000080,00000000,00000000,?,00000000,00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00404B86
                                                                                                                                                                                                      • ReadFile.KERNEL32(?,?,00000080,?,00000000,00000000,?,-00000080,00000000,00000000,?,00000000,00000000,80000000,00000002,00000000), ref: 00404BA7
                                                                                                                                                                                                      • SetFilePointer.KERNEL32(?,00000000,00000000,00000002), ref: 00404BD0
                                                                                                                                                                                                      • SetEndOfFile.KERNEL32(?,?,00000000,00000000,00000002), ref: 00404BDA
                                                                                                                                                                                                      • GetStdHandle.KERNEL32(000000F5), ref: 00404BFA
                                                                                                                                                                                                      • GetFileType.KERNEL32(?,000000F5), ref: 00404C11
                                                                                                                                                                                                      • CloseHandle.KERNEL32(?,?,000000F5), ref: 00404C2C
                                                                                                                                                                                                      • GetLastError.KERNEL32(000000F5), ref: 00404C46
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: File$HandlePointer$CloseCreateErrorLastReadSizeType
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 1694776339-0
                                                                                                                                                                                                      • Opcode ID: 9f56c7289f94e04900e6d065ddfea074988f08e379b72121dafcd5ad7d79337d
                                                                                                                                                                                                      • Instruction ID: 0555156f4d2a620bb114dc01d937536d57074fdea11cd86abdfeb4dd56d828b4
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 9f56c7289f94e04900e6d065ddfea074988f08e379b72121dafcd5ad7d79337d
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 3741B3F02093009AF7305E248905B2375E5EBC0755F208E3FE296BA6E0D7BDE8458B1D
                                                                                                                                                                                                      Function 004221E8 Relevance: 15.1, APIs: 10, Instructions: 74windowCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetSystemMenu.USER32(00000000,00000000), ref: 00422233
                                                                                                                                                                                                      • DeleteMenu.USER32(00000000,0000F130,00000000,00000000,00000000), ref: 00422251
                                                                                                                                                                                                      • DeleteMenu.USER32(00000000,00000007,00000400,00000000,0000F130,00000000,00000000,00000000), ref: 0042225E
                                                                                                                                                                                                      • DeleteMenu.USER32(00000000,00000005,00000400,00000000,00000007,00000400,00000000,0000F130,00000000,00000000,00000000), ref: 0042226B
                                                                                                                                                                                                      • DeleteMenu.USER32(00000000,0000F030,00000000,00000000,00000005,00000400,00000000,00000007,00000400,00000000,0000F130,00000000,00000000,00000000), ref: 00422278
                                                                                                                                                                                                      • DeleteMenu.USER32(00000000,0000F020,00000000,00000000,0000F030,00000000,00000000,00000005,00000400,00000000,00000007,00000400,00000000,0000F130,00000000,00000000), ref: 00422285
                                                                                                                                                                                                      • DeleteMenu.USER32(00000000,0000F000,00000000,00000000,0000F020,00000000,00000000,0000F030,00000000,00000000,00000005,00000400,00000000,00000007,00000400,00000000), ref: 00422292
                                                                                                                                                                                                      • DeleteMenu.USER32(00000000,0000F120,00000000,00000000,0000F000,00000000,00000000,0000F020,00000000,00000000,0000F030,00000000,00000000,00000005,00000400,00000000), ref: 0042229F
                                                                                                                                                                                                      • EnableMenuItem.USER32(00000000,0000F020,00000001), ref: 004222BD
                                                                                                                                                                                                      • EnableMenuItem.USER32(00000000,0000F030,00000001), ref: 004222D9
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Menu$Delete$EnableItem$System
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 3985193851-0
                                                                                                                                                                                                      • Opcode ID: d8fcfd45993f68361b05288e300d90e061abaf0c01acb012dac33f8cfd749464
                                                                                                                                                                                                      • Instruction ID: 662ae76830c3dbb110fd6952920e185112f137d20e740dc0dcce1beff7d7cd05
                                                                                                                                                                                                      • Opcode Fuzzy Hash: d8fcfd45993f68361b05288e300d90e061abaf0c01acb012dac33f8cfd749464
                                                                                                                                                                                                      • Instruction Fuzzy Hash: AF2144703407047AE720E724CD8BF9BBBD89B04708F5451A5BA487F6D3C6F9AB804698
                                                                                                                                                                                                      Function 00461500 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 82COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • SHGetMalloc.SHELL32(?), ref: 0046153B
                                                                                                                                                                                                      • GetActiveWindow.USER32 ref: 0046159F
                                                                                                                                                                                                      • CoInitialize.OLE32(00000000), ref: 004615B3
                                                                                                                                                                                                      • SHBrowseForFolder.SHELL32(?), ref: 004615CA
                                                                                                                                                                                                      • CoUninitialize.OLE32(0046160B,00000000,?,?,?,?,?,00000000,0046168F), ref: 004615DF
                                                                                                                                                                                                      • SetActiveWindow.USER32(?,0046160B,00000000,?,?,?,?,?,00000000,0046168F), ref: 004615F5
                                                                                                                                                                                                      • SetActiveWindow.USER32(?,?,0046160B,00000000,?,?,?,?,?,00000000,0046168F), ref: 004615FE
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: ActiveWindow$BrowseFolderInitializeMallocUninitialize
                                                                                                                                                                                                      • String ID: A
                                                                                                                                                                                                      • API String ID: 2684663990-3554254475
                                                                                                                                                                                                      • Opcode ID: 703f1963e0dc72a1c395d9026068ceb343fdf60ef3171849bb259b064323ba87
                                                                                                                                                                                                      • Instruction ID: 8a944d3e7b26c7d839f1ecf9cf32de2b38f87d5f920ef02beae42f78277bfb86
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 703f1963e0dc72a1c395d9026068ceb343fdf60ef3171849bb259b064323ba87
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 62312D70E00358AFDB00EFA6D885A9EBBF8EB09304F55847AF405E7251E7789A048B59
                                                                                                                                                                                                      Function 0045D104 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 41libraryloaderCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,inflateInit_), ref: 0045D10D
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,inflate), ref: 0045D11D
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,inflateEnd), ref: 0045D12D
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,inflateReset), ref: 0045D13D
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: AddressProc
                                                                                                                                                                                                      • String ID: inflate$inflateEnd$inflateInit_$inflateReset
                                                                                                                                                                                                      • API String ID: 190572456-3516654456
                                                                                                                                                                                                      • Opcode ID: 642f53b55b6c69fa488a6078c858724ccece433db3f4d1a063b28ca439a42b30
                                                                                                                                                                                                      • Instruction ID: 41a921eeb660c13fccdf509460c8c4a7353affed60c98b376863fdd8d28133a2
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 642f53b55b6c69fa488a6078c858724ccece433db3f4d1a063b28ca439a42b30
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 1A01FFB0D00B00DAE724EFB69D9572736A5AB64306F14C03B9C09962A6D7790858DF6C
                                                                                                                                                                                                      Function 0041A8DC Relevance: 13.7, APIs: 9, Instructions: 176windowCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • SetBkColor.GDI32(?,00000000), ref: 0041A9B9
                                                                                                                                                                                                      • BitBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,00CC0020), ref: 0041A9F3
                                                                                                                                                                                                      • SetBkColor.GDI32(?,?), ref: 0041AA08
                                                                                                                                                                                                      • StretchBlt.GDI32(00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,00CC0020), ref: 0041AA52
                                                                                                                                                                                                      • SetTextColor.GDI32(00000000,00000000), ref: 0041AA5D
                                                                                                                                                                                                      • SetBkColor.GDI32(00000000,00FFFFFF), ref: 0041AA6D
                                                                                                                                                                                                      • StretchBlt.GDI32(00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,00E20746), ref: 0041AAAC
                                                                                                                                                                                                      • SetTextColor.GDI32(00000000,00000000), ref: 0041AAB6
                                                                                                                                                                                                      • SetBkColor.GDI32(00000000,?), ref: 0041AAC3
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Color$StretchText
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 2984075790-0
                                                                                                                                                                                                      • Opcode ID: d922b450a47b78d2b04aec2ac0d2e0f837e00e48c8544b253d9025e975fd03f1
                                                                                                                                                                                                      • Instruction ID: 4467ea82dd13d464879b0bd0dd0607b47ee3045dce17e21d2c6451b7f26a8ea4
                                                                                                                                                                                                      • Opcode Fuzzy Hash: d922b450a47b78d2b04aec2ac0d2e0f837e00e48c8544b253d9025e975fd03f1
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 8761E5B5A00505AFCB40EFADD985E9AB7F8EF08314B10816AF908DB262C775ED40CF58
                                                                                                                                                                                                      Function 00457F14 Relevance: 13.6, APIs: 1, Strings: 8, Instructions: 126COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                        • Part of subcall function 0042D8C4: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0042D8D7
                                                                                                                                                                                                      • CloseHandle.KERNEL32(?,?,00000044,00000000,00000000,04000000,00000000,00000000,00000000,004580C8,?, /s ",?,regsvr32.exe",?,004580C8), ref: 0045803A
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CloseDirectoryHandleSystem
                                                                                                                                                                                                      • String ID: /s "$ /u$0x%x$CreateProcess$D$Spawning 32-bit RegSvr32: $Spawning 64-bit RegSvr32: $regsvr32.exe"
                                                                                                                                                                                                      • API String ID: 2051275411-1862435767
                                                                                                                                                                                                      • Opcode ID: de8b87487fd80ba2cfda28b44a4ae2a8264f119fe38269257662de6f28800998
                                                                                                                                                                                                      • Instruction ID: e9c79437d4df6862de8c7cd7f55e60b8630b5ed7fadd4497393df937d865c406
                                                                                                                                                                                                      • Opcode Fuzzy Hash: de8b87487fd80ba2cfda28b44a4ae2a8264f119fe38269257662de6f28800998
                                                                                                                                                                                                      • Instruction Fuzzy Hash: AA410670A043086BDB11EFD6D842B8EB7B9AF45705F51407FA904BB292DF789A0D8B19
                                                                                                                                                                                                      Function 0044D178 Relevance: 13.6, APIs: 9, Instructions: 90COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • OffsetRect.USER32(?,00000001,00000001), ref: 0044D1A9
                                                                                                                                                                                                      • GetSysColor.USER32(00000014), ref: 0044D1B0
                                                                                                                                                                                                      • SetTextColor.GDI32(00000000,00000000), ref: 0044D1C8
                                                                                                                                                                                                      • DrawTextA.USER32(00000000,00000000,00000000), ref: 0044D1F1
                                                                                                                                                                                                      • OffsetRect.USER32(?,000000FF,000000FF), ref: 0044D1FB
                                                                                                                                                                                                      • GetSysColor.USER32(00000010), ref: 0044D202
                                                                                                                                                                                                      • SetTextColor.GDI32(00000000,00000000), ref: 0044D21A
                                                                                                                                                                                                      • DrawTextA.USER32(00000000,00000000,00000000), ref: 0044D243
                                                                                                                                                                                                      • DrawTextA.USER32(00000000,00000000,00000000), ref: 0044D26E
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Text$Color$Draw$OffsetRect
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 1005981011-0
                                                                                                                                                                                                      • Opcode ID: 4054566e8ba3b89cdd91132f39c510e9855df1fb138f21794d8e69447c138b72
                                                                                                                                                                                                      • Instruction ID: 8406a00effd73db105afccad7da3796984cf264811f0ddac3e5cace4e0ac1d2b
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 4054566e8ba3b89cdd91132f39c510e9855df1fb138f21794d8e69447c138b72
                                                                                                                                                                                                      • Instruction Fuzzy Hash: A021BDB42015047FC710FB2ACD8AE8B6BDCDF19319B05457AB958EB292C67CDD404668
                                                                                                                                                                                                      Function 0047778C Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 92windowCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                        • Part of subcall function 004776B4: GetWindowThreadProcessId.USER32(00000000), ref: 004776BC
                                                                                                                                                                                                        • Part of subcall function 004776B4: GetModuleHandleA.KERNEL32(user32.dll,AllowSetForegroundWindow,00000000,?,?,004777B3,0049C0A4,00000000), ref: 004776CF
                                                                                                                                                                                                        • Part of subcall function 004776B4: GetProcAddress.KERNEL32(00000000,user32.dll), ref: 004776D5
                                                                                                                                                                                                      • SendMessageA.USER32(00000000,0000004A,00000000,F{G), ref: 004777C1
                                                                                                                                                                                                      • GetTickCount.KERNEL32 ref: 00477806
                                                                                                                                                                                                      • GetTickCount.KERNEL32 ref: 00477810
                                                                                                                                                                                                      • MsgWaitForMultipleObjects.USER32(00000000,00000000,00000000,0000000A,000000FF), ref: 00477865
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CountTick$AddressHandleMessageModuleMultipleObjectsProcProcessSendThreadWaitWindow
                                                                                                                                                                                                      • String ID: CallSpawnServer: Unexpected response: $%x$CallSpawnServer: Unexpected status: %d$F{G
                                                                                                                                                                                                      • API String ID: 613034392-3657229555
                                                                                                                                                                                                      • Opcode ID: 6d97cf5564b98f17fd9f3b8579433905f0e6c95bef7ad8bee9a9e7eacc473beb
                                                                                                                                                                                                      • Instruction ID: 2d480610a6b59e2baa88e371a3ce18c9cee9fe0f547c40ec3b8b85eb822a561a
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 6d97cf5564b98f17fd9f3b8579433905f0e6c95bef7ad8bee9a9e7eacc473beb
                                                                                                                                                                                                      • Instruction Fuzzy Hash: CB31A234F042159ADB10EBB9C8867EE76A1AB44314F90847BF548EB392D67C9D01CBAD
                                                                                                                                                                                                      Function 00496064 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 90sleepsynchronizationthreadCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                        • Part of subcall function 0045092C: SetEndOfFile.KERNEL32(?,?,0045C192,00000000,0045C31D,?,00000000,00000002,00000002), ref: 00450933
                                                                                                                                                                                                        • Part of subcall function 00406F50: DeleteFileA.KERNEL32(00000000,0049B628,00498261,00000000,004982B6,?,?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000), ref: 00406F5B
                                                                                                                                                                                                      • GetWindowThreadProcessId.USER32(00000000,?), ref: 004960F5
                                                                                                                                                                                                      • OpenProcess.KERNEL32(00100000,00000000,?,00000000,?), ref: 00496109
                                                                                                                                                                                                      • SendNotifyMessageA.USER32(00000000,0000054D,00000000,00000000), ref: 00496123
                                                                                                                                                                                                      • WaitForSingleObject.KERNEL32(00000000,000000FF,00000000,0000054D,00000000,00000000,00000000,?), ref: 0049612F
                                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000,00000000,000000FF,00000000,0000054D,00000000,00000000,00000000,?), ref: 00496135
                                                                                                                                                                                                      • Sleep.KERNEL32(000001F4,00000000,0000054D,00000000,00000000,00000000,?), ref: 00496148
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      • Deleting Uninstall data files., xrefs: 0049606B
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: FileProcess$CloseDeleteHandleMessageNotifyObjectOpenSendSingleSleepThreadWaitWindow
                                                                                                                                                                                                      • String ID: Deleting Uninstall data files.
                                                                                                                                                                                                      • API String ID: 1570157960-2568741658
                                                                                                                                                                                                      • Opcode ID: 1c14f06cf20906d6098757f7c161041ddb556eb254dcbfb897c76230ada43d7f
                                                                                                                                                                                                      • Instruction ID: a2b0394162f9d438edd1a59a6b8f88e08a82a6f464fdedc4f7b2e31c99877ff7
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 1c14f06cf20906d6098757f7c161041ddb556eb254dcbfb897c76230ada43d7f
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 5F218570304250AFEB10EB7AFCC6B163798EB54728F52453BB505962D3D67CAC04CA6C
                                                                                                                                                                                                      Function 00470070 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 89registrywindowCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                        • Part of subcall function 0042DE1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,004836C7,?,00000001,?,?,004836C7,?,00000001,00000000), ref: 0042DE38
                                                                                                                                                                                                      • RegSetValueExA.ADVAPI32(?,00000000,00000000,00000001,00000000,00000001,?,00000002,00000000,00000000,0047016D,?,?,?,?,00000000), ref: 004700D7
                                                                                                                                                                                                      • RegCloseKey.ADVAPI32(?,?,00000000,00000000,00000001,00000000,00000001,?,00000002,00000000,00000000,0047016D), ref: 004700EE
                                                                                                                                                                                                      • AddFontResourceA.GDI32(00000000), ref: 0047010B
                                                                                                                                                                                                      • SendNotifyMessageA.USER32(0000FFFF,0000001D,00000000,00000000), ref: 0047011F
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      • AddFontResource, xrefs: 00470129
                                                                                                                                                                                                      • Failed to open Fonts registry key., xrefs: 004700F5
                                                                                                                                                                                                      • Failed to set value in Fonts registry key., xrefs: 004700E0
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CloseFontMessageNotifyOpenResourceSendValue
                                                                                                                                                                                                      • String ID: AddFontResource$Failed to open Fonts registry key.$Failed to set value in Fonts registry key.
                                                                                                                                                                                                      • API String ID: 955540645-649663873
                                                                                                                                                                                                      • Opcode ID: f316d6379e58168090b9c40addf9c962626be30da9295decb4dfabb84d340840
                                                                                                                                                                                                      • Instruction ID: 4679b390ee7f38cc50779b5755f8f256d37ac4db7264feb969586a41c0613652
                                                                                                                                                                                                      • Opcode Fuzzy Hash: f316d6379e58168090b9c40addf9c962626be30da9295decb4dfabb84d340840
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 1E21F470741204BBD710EA669C42FAE779DDB45704F908077B904EB3C2DA7DEE01962D
                                                                                                                                                                                                      Function 00462CA4 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 75windowCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                        • Part of subcall function 00416410: GetClassInfoA.USER32(00400000,?,?), ref: 0041647F
                                                                                                                                                                                                        • Part of subcall function 00416410: UnregisterClassA.USER32(?,00400000), ref: 004164AB
                                                                                                                                                                                                        • Part of subcall function 00416410: RegisterClassA.USER32(?), ref: 004164CE
                                                                                                                                                                                                      • GetVersion.KERNEL32 ref: 00462CD4
                                                                                                                                                                                                      • SendMessageA.USER32(00000000,0000112C,00000004,00000004), ref: 00462D12
                                                                                                                                                                                                      • SHGetFileInfo.SHELL32(00462DB0,00000000,?,00000160,00004011), ref: 00462D2F
                                                                                                                                                                                                      • LoadCursorA.USER32(00000000,00007F02), ref: 00462D4D
                                                                                                                                                                                                      • SetCursor.USER32(00000000,00000000,00007F02,00462DB0,00000000,?,00000160,00004011), ref: 00462D53
                                                                                                                                                                                                      • SetCursor.USER32(?,00462D93,00007F02,00462DB0,00000000,?,00000160,00004011), ref: 00462D86
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: ClassCursor$Info$FileLoadMessageRegisterSendUnregisterVersion
                                                                                                                                                                                                      • String ID: Explorer
                                                                                                                                                                                                      • API String ID: 2594429197-512347832
                                                                                                                                                                                                      • Opcode ID: b2508eec98d805366e2f4507ea44d46b961a44d372cb9f0a28019716940d75e3
                                                                                                                                                                                                      • Instruction ID: 9dbbc9fa048eb90f76178aab56daef4cc46522196ca1757d39461a436d1c0ce4
                                                                                                                                                                                                      • Opcode Fuzzy Hash: b2508eec98d805366e2f4507ea44d46b961a44d372cb9f0a28019716940d75e3
                                                                                                                                                                                                      • Instruction Fuzzy Hash: A521D2707403047AE711BB758D47B9A36989B09708F5004BFF608EA2C3EEBC9801866E
                                                                                                                                                                                                      Function 00477E90 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 66libraryfileloaderCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetModuleHandleA.KERNEL32(kernel32.dll,GetFinalPathNameByHandleA,02182C14,?,?,?,02182C14,00478054,00000000,00478172,?,?,-00000010,?), ref: 00477EA9
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00477EAF
                                                                                                                                                                                                      • GetFileAttributesA.KERNEL32(00000000,00000000,kernel32.dll,GetFinalPathNameByHandleA,02182C14,?,?,?,02182C14,00478054,00000000,00478172,?,?,-00000010,?), ref: 00477EC2
                                                                                                                                                                                                      • CreateFileA.KERNEL32(00000000,00000000,00000007,00000000,00000003,00000000,00000000,00000000,00000000,kernel32.dll,GetFinalPathNameByHandleA,02182C14,?,?,?,02182C14), ref: 00477EEC
                                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000,?,?,?,02182C14,00478054,00000000,00478172,?,?,-00000010,?), ref: 00477F0A
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: FileHandle$AddressAttributesCloseCreateModuleProc
                                                                                                                                                                                                      • String ID: GetFinalPathNameByHandleA$kernel32.dll
                                                                                                                                                                                                      • API String ID: 2704155762-2318956294
                                                                                                                                                                                                      • Opcode ID: bafb3ac814e09442ac61c4d44621b93fd5b97d9cf582e2665037daa8ea8e86dd
                                                                                                                                                                                                      • Instruction ID: 07fb0e6c3cbff21d125a0516fcac6af2f028e938fd8349bed9720d5bfc433141
                                                                                                                                                                                                      • Opcode Fuzzy Hash: bafb3ac814e09442ac61c4d44621b93fd5b97d9cf582e2665037daa8ea8e86dd
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 2101B55074870536E520316A5E86FBF648C8B5477DF548137FB1CEE2D2E9AC9D06026E
                                                                                                                                                                                                      Function 00459C5C Relevance: 12.1, APIs: 1, Strings: 7, Instructions: 121COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetLastError.KERNEL32(00000000,00459DDE,?,00000000,00000000,00000000,?,00000006,?,00000000,004973CD,?,00000000,00497470), ref: 00459D22
                                                                                                                                                                                                        • Part of subcall function 004543F4: FindClose.KERNEL32(000000FF,004544EA), ref: 004544D9
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      • Failed to delete directory (%d). Will delete on restart (if empty)., xrefs: 00459D97
                                                                                                                                                                                                      • Failed to strip read-only attribute., xrefs: 00459CF0
                                                                                                                                                                                                      • Failed to delete directory (%d). Will retry later., xrefs: 00459D3B
                                                                                                                                                                                                      • Stripped read-only attribute., xrefs: 00459CE4
                                                                                                                                                                                                      • Not stripping read-only attribute because the directory does not appear to be empty., xrefs: 00459CFC
                                                                                                                                                                                                      • Failed to delete directory (%d)., xrefs: 00459DB8
                                                                                                                                                                                                      • Deleting directory: %s, xrefs: 00459CAB
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CloseErrorFindLast
                                                                                                                                                                                                      • String ID: Deleting directory: %s$Failed to delete directory (%d).$Failed to delete directory (%d). Will delete on restart (if empty).$Failed to delete directory (%d). Will retry later.$Failed to strip read-only attribute.$Not stripping read-only attribute because the directory does not appear to be empty.$Stripped read-only attribute.
                                                                                                                                                                                                      • API String ID: 754982922-1448842058
                                                                                                                                                                                                      • Opcode ID: e397606c2307aff89f339bed254a440341d4a138159171c286e3402acf9b667b
                                                                                                                                                                                                      • Instruction ID: 5a692d040748e25b342bfc59b5c440c53b4552d2faa6a9747d6521fe41ba2a01
                                                                                                                                                                                                      • Opcode Fuzzy Hash: e397606c2307aff89f339bed254a440341d4a138159171c286e3402acf9b667b
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 69419330A04248DACB10DB6A98417AE76B59F8530AF54857BAC05E7383DB7C8D0DC75D
                                                                                                                                                                                                      Function 00422E50 Relevance: 12.1, APIs: 8, Instructions: 119windowCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetCapture.USER32 ref: 00422EA4
                                                                                                                                                                                                      • GetCapture.USER32 ref: 00422EB3
                                                                                                                                                                                                      • SendMessageA.USER32(00000000,0000001F,00000000,00000000), ref: 00422EB9
                                                                                                                                                                                                      • ReleaseCapture.USER32 ref: 00422EBE
                                                                                                                                                                                                      • GetActiveWindow.USER32 ref: 00422ECD
                                                                                                                                                                                                      • SendMessageA.USER32(00000000,0000B000,00000000,00000000), ref: 00422F4C
                                                                                                                                                                                                      • SendMessageA.USER32(00000000,0000B001,00000000,00000000), ref: 00422FB0
                                                                                                                                                                                                      • GetActiveWindow.USER32 ref: 00422FBF
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CaptureMessageSend$ActiveWindow$Release
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 862346643-0
                                                                                                                                                                                                      • Opcode ID: 3da4ec300de865232a3f60c9f80223c2bbe2427c246ff190c68097af5e341dae
                                                                                                                                                                                                      • Instruction ID: c6261992695b47722d84ffa44129b55dc5b2a4dad2f70b0012283783c1c7b094
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 3da4ec300de865232a3f60c9f80223c2bbe2427c246ff190c68097af5e341dae
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 24417230B00245AFDB10EB69DA86B9E77F1EF44304F5540BAF404AB2A2D778AE40DB49
                                                                                                                                                                                                      Function 0042F290 Relevance: 12.1, APIs: 8, Instructions: 102windowCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetWindowLongA.USER32(?,000000F0), ref: 0042F2BA
                                                                                                                                                                                                      • GetWindowLongA.USER32(?,000000EC), ref: 0042F2D1
                                                                                                                                                                                                      • GetActiveWindow.USER32 ref: 0042F2DA
                                                                                                                                                                                                      • MessageBoxA.USER32(00000000,00000000,00000000,00000000), ref: 0042F307
                                                                                                                                                                                                      • SetActiveWindow.USER32(?,0042F437,00000000,?), ref: 0042F328
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Window$ActiveLong$Message
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 2785966331-0
                                                                                                                                                                                                      • Opcode ID: ca0cfe640851e4463c520fee9942c9233ac98ecb3d765a436798e71af7845e74
                                                                                                                                                                                                      • Instruction ID: ac844ef734d24c76dc9aa96f201b13a865b129e9c1b137beabd8cb6517960092
                                                                                                                                                                                                      • Opcode Fuzzy Hash: ca0cfe640851e4463c520fee9942c9233ac98ecb3d765a436798e71af7845e74
                                                                                                                                                                                                      • Instruction Fuzzy Hash: F931D271A00254AFEB01EFA5DD52E6EBBB8EB09304F9144BAF804E3291D73C9D10CB58
                                                                                                                                                                                                      Function 00429480 Relevance: 12.1, APIs: 8, Instructions: 62COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetDC.USER32(00000000), ref: 0042948A
                                                                                                                                                                                                      • GetTextMetricsA.GDI32(00000000), ref: 00429493
                                                                                                                                                                                                        • Part of subcall function 0041A1E8: CreateFontIndirectA.GDI32(?), ref: 0041A2A7
                                                                                                                                                                                                      • SelectObject.GDI32(00000000,00000000), ref: 004294A2
                                                                                                                                                                                                      • GetTextMetricsA.GDI32(00000000,?), ref: 004294AF
                                                                                                                                                                                                      • SelectObject.GDI32(00000000,00000000), ref: 004294B6
                                                                                                                                                                                                      • ReleaseDC.USER32(00000000,00000000), ref: 004294BE
                                                                                                                                                                                                      • GetSystemMetrics.USER32(00000006), ref: 004294E3
                                                                                                                                                                                                      • GetSystemMetrics.USER32(00000006), ref: 004294FD
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Metrics$ObjectSelectSystemText$CreateFontIndirectRelease
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 1583807278-0
                                                                                                                                                                                                      • Opcode ID: 62880ac9d08e5d684fd074e0f3ca61438eede96ade4d4e291019075c7fd144c0
                                                                                                                                                                                                      • Instruction ID: 8a5b62ad3b2811282b00f4aa11bc4c2c065e9b9ae855548013837f5c18493421
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 62880ac9d08e5d684fd074e0f3ca61438eede96ade4d4e291019075c7fd144c0
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 0F01C4A17087103BE321767A9CC6F6F65C8DB44358F84043BF686D63D3D96C9C41866A
                                                                                                                                                                                                      Function 0041DE24 Relevance: 12.1, APIs: 8, Instructions: 60windowCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetDC.USER32(00000000), ref: 0041DE27
                                                                                                                                                                                                      • GetDeviceCaps.GDI32(00000000,0000005A), ref: 0041DE31
                                                                                                                                                                                                      • ReleaseDC.USER32(00000000,00000000), ref: 0041DE3E
                                                                                                                                                                                                      • MulDiv.KERNEL32(00000008,00000060,00000048), ref: 0041DE4D
                                                                                                                                                                                                      • GetStockObject.GDI32(00000007), ref: 0041DE5B
                                                                                                                                                                                                      • GetStockObject.GDI32(00000005), ref: 0041DE67
                                                                                                                                                                                                      • GetStockObject.GDI32(0000000D), ref: 0041DE73
                                                                                                                                                                                                      • LoadIconA.USER32(00000000,00007F00), ref: 0041DE84
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: ObjectStock$CapsDeviceIconLoadRelease
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 225703358-0
                                                                                                                                                                                                      • Opcode ID: 93123cf7b7da28845296a778695a34f9ae7968dfa7e72d2685fd09fde09bf652
                                                                                                                                                                                                      • Instruction ID: 282f56568f1177e4dad385ec7f61a974d29090d827cf1f87eb40c920fa9ca7e8
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 93123cf7b7da28845296a778695a34f9ae7968dfa7e72d2685fd09fde09bf652
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 4C1142706457015EE340BFA66E52B6A36A4D725708F40413FF609AF3D1D77A2C448B9E
                                                                                                                                                                                                      Function 004630B4 Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 273COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • LoadCursorA.USER32(00000000,00007F02), ref: 004631B8
                                                                                                                                                                                                      • SetCursor.USER32(00000000,00000000,00007F02,00000000,0046324D), ref: 004631BE
                                                                                                                                                                                                      • SetCursor.USER32(?,00463235,00007F02,00000000,0046324D), ref: 00463228
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Cursor$Load
                                                                                                                                                                                                      • String ID: $ $Internal error: Item already expanding
                                                                                                                                                                                                      • API String ID: 1675784387-1948079669
                                                                                                                                                                                                      • Opcode ID: 9a907484170bb085a46c4a598b93bfbbd2bc194262705c34c2f461fc244cfbd4
                                                                                                                                                                                                      • Instruction ID: 06b17efc2869e1117ca0a97e11558f018c2dd138a4dd01a316207194f11c04f7
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 9a907484170bb085a46c4a598b93bfbbd2bc194262705c34c2f461fc244cfbd4
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 74B1B430A00284DFD711DF69C585B9EBBF0BF04305F1484AAE8459B792DB78EE45CB16
                                                                                                                                                                                                      Function 00453D30 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 225COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • WritePrivateProfileStringA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00453E17
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: PrivateProfileStringWrite
                                                                                                                                                                                                      • String ID: .tmp$MoveFileEx$NUL$WININIT.INI$[rename]
                                                                                                                                                                                                      • API String ID: 390214022-3304407042
                                                                                                                                                                                                      • Opcode ID: 4acafb8f8444067680350d3d4e03481623aa06ca7574397e5033f2f4cf45a0b5
                                                                                                                                                                                                      • Instruction ID: 4c4b1d7f09994941c57eaafc4db68242d6a3f6c21ecd3f2b5b8f846a746055a2
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 4acafb8f8444067680350d3d4e03481623aa06ca7574397e5033f2f4cf45a0b5
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 40911434E002099BDB01EFA5D842BDEB7F5AF4874AF608466E90077392D7786E49CB58
                                                                                                                                                                                                      Function 00476770 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 200windowCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetClassInfoW.USER32(00000000,COMBOBOX,?), ref: 004767C9
                                                                                                                                                                                                      • SetWindowLongW.USER32(00000000,000000FC,00476724), ref: 004767F0
                                                                                                                                                                                                      • GetACP.KERNEL32(00000000,00476A08,?,00000000,00476A32), ref: 0047682D
                                                                                                                                                                                                      • SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00476873
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: ClassInfoLongMessageSendWindow
                                                                                                                                                                                                      • String ID: COMBOBOX$Inno Setup: Language
                                                                                                                                                                                                      • API String ID: 3391662889-4234151509
                                                                                                                                                                                                      • Opcode ID: 7b097581a500be05759954e33284123b2b89370f46c26a428eff7c4db0c5a69c
                                                                                                                                                                                                      • Instruction ID: bb27e68bfa0a4e6e36c1c9b1f46c00cfa2f47713d75b81585866a7fa3ef15c14
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 7b097581a500be05759954e33284123b2b89370f46c26a428eff7c4db0c5a69c
                                                                                                                                                                                                      • Instruction Fuzzy Hash: C0813F746006059FC710EF69D885AEAB7F2FB09304F16C1BAE848E7362D738AD45CB59
                                                                                                                                                                                                      Function 00408720 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 167COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetSystemDefaultLCID.KERNEL32(00000000,00408968,?,?,?,?,00000000,00000000,00000000,?,0040996F,00000000,00409982), ref: 0040873A
                                                                                                                                                                                                        • Part of subcall function 00408568: GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0049B4C0,00000001,?,00408633,?,00000000,00408712), ref: 00408586
                                                                                                                                                                                                        • Part of subcall function 004085B4: GetLocaleInfoA.KERNEL32(00000000,0000000F,?,00000002,0000002C,?,?,00000000,004087B6,?,?,?,00000000,00408968), ref: 004085C7
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: InfoLocale$DefaultSystem
                                                                                                                                                                                                      • String ID: AMPM$:mm$:mm:ss$m/d/yy$mmmm d, yyyy
                                                                                                                                                                                                      • API String ID: 1044490935-665933166
                                                                                                                                                                                                      • Opcode ID: 99a58aab46255149f4b24f4520dbd6929c7443738739b227c4cc8c7d24f61a81
                                                                                                                                                                                                      • Instruction ID: 5c6fde8006682913ecab3173e7335377554a92ac61a87523d81808753b4ec1a9
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 99a58aab46255149f4b24f4520dbd6929c7443738739b227c4cc8c7d24f61a81
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 7D516C24B00108ABDB01FBA69E4169EB7A9DB94308F50C07FA181BB3C3CE3DDA05975D
                                                                                                                                                                                                      Function 004116F4 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 158windowCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetVersion.KERNEL32(00000000,004118F9), ref: 0041178C
                                                                                                                                                                                                      • InsertMenuItemA.USER32(?,000000FF,00000001,0000002C), ref: 0041184A
                                                                                                                                                                                                        • Part of subcall function 00411AAC: CreatePopupMenu.USER32 ref: 00411AC6
                                                                                                                                                                                                      • InsertMenuA.USER32(?,000000FF,?,?,00000000), ref: 004118D6
                                                                                                                                                                                                        • Part of subcall function 00411AAC: CreateMenu.USER32 ref: 00411AD0
                                                                                                                                                                                                      • InsertMenuA.USER32(?,000000FF,?,00000000,00000000), ref: 004118BD
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Menu$Insert$Create$ItemPopupVersion
                                                                                                                                                                                                      • String ID: ,$?
                                                                                                                                                                                                      • API String ID: 2359071979-2308483597
                                                                                                                                                                                                      • Opcode ID: b9a2b6ccc88d9caa62c3975205c07352f987ccdbf84bf9e0cd5a88eec52abf91
                                                                                                                                                                                                      • Instruction ID: ecf66c9774bccec907b621c371347452b74b7622051e058d8a4a73451c3e974f
                                                                                                                                                                                                      • Opcode Fuzzy Hash: b9a2b6ccc88d9caa62c3975205c07352f987ccdbf84bf9e0cd5a88eec52abf91
                                                                                                                                                                                                      • Instruction Fuzzy Hash: D7510674A00245ABDB10EF6ADC816EA7BF9AF09304B11857BF904E73A6D738DD41CB58
                                                                                                                                                                                                      Function 00455010 Relevance: 10.7, APIs: 2, Strings: 5, Instructions: 154COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetLastError.KERNEL32(?,00000044,00000000,00000000,04000000,00000000,00000000,00000000,?,COMMAND.COM" /C ,?,0045522C,0045522C,?,0045522C,00000000), ref: 004551BA
                                                                                                                                                                                                      • CloseHandle.KERNEL32(?,?,00000044,00000000,00000000,04000000,00000000,00000000,00000000,?,COMMAND.COM" /C ,?,0045522C,0045522C,?,0045522C), ref: 004551C7
                                                                                                                                                                                                        • Part of subcall function 00454F7C: WaitForInputIdle.USER32(?,00000032), ref: 00454FA8
                                                                                                                                                                                                        • Part of subcall function 00454F7C: MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000FF), ref: 00454FCA
                                                                                                                                                                                                        • Part of subcall function 00454F7C: GetExitCodeProcess.KERNEL32(?,?), ref: 00454FD9
                                                                                                                                                                                                        • Part of subcall function 00454F7C: CloseHandle.KERNEL32(?,00455006,00454FFF,?,?,?,00000000,?,?,004551DB,?,?,?,00000044,00000000,00000000), ref: 00454FF9
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CloseHandleWait$CodeErrorExitIdleInputLastMultipleObjectsProcess
                                                                                                                                                                                                      • String ID: .bat$.cmd$COMMAND.COM" /C $D$cmd.exe" /C "
                                                                                                                                                                                                      • API String ID: 854858120-615399546
                                                                                                                                                                                                      • Opcode ID: bdfe251ee88266499836d8fb4334459a89289398f2eabbc2594152ef150af025
                                                                                                                                                                                                      • Instruction ID: 058baa7e90e176347c833b132b7c272bf8058e823d6e061bdbf2f6311869cd9e
                                                                                                                                                                                                      • Opcode Fuzzy Hash: bdfe251ee88266499836d8fb4334459a89289398f2eabbc2594152ef150af025
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 41516D34B0074DABCF10EFA5D852BDEBBB9AF44305F50447BB804B7292D7789A098B59
                                                                                                                                                                                                      Function 0041BE63 Relevance: 10.7, APIs: 7, Instructions: 153windowCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetObjectA.GDI32(?,00000018,?), ref: 0041BF28
                                                                                                                                                                                                      • GetObjectA.GDI32(?,00000018,?), ref: 0041BF37
                                                                                                                                                                                                      • GetBitmapBits.GDI32(?,?,?), ref: 0041BF88
                                                                                                                                                                                                      • GetBitmapBits.GDI32(?,?,?), ref: 0041BF96
                                                                                                                                                                                                      • DeleteObject.GDI32(?), ref: 0041BF9F
                                                                                                                                                                                                      • DeleteObject.GDI32(?), ref: 0041BFA8
                                                                                                                                                                                                      • CreateIcon.USER32(00400000,?,?,?,?,?,?), ref: 0041BFC5
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Object$BitmapBitsDelete$CreateIcon
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 1030595962-0
                                                                                                                                                                                                      • Opcode ID: dabea464bc85c36b4411cc83672e19ff5768c85fc4c65aec36842f1966395034
                                                                                                                                                                                                      • Instruction ID: 74cae3b7aa7aab4ce12a2fbd062d204c5c4082198076ec6df892ad84fd278e80
                                                                                                                                                                                                      • Opcode Fuzzy Hash: dabea464bc85c36b4411cc83672e19ff5768c85fc4c65aec36842f1966395034
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 6A510671A002199FCB10DFA9C9819EEB7F9EF48314B11416AF914E7395D738AD41CB68
                                                                                                                                                                                                      Function 0041CED8 Relevance: 10.7, APIs: 7, Instructions: 152windowCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • SetStretchBltMode.GDI32(00000000,00000003), ref: 0041CEFE
                                                                                                                                                                                                      • GetDeviceCaps.GDI32(00000000,00000026), ref: 0041CF1D
                                                                                                                                                                                                      • SelectPalette.GDI32(?,?,00000001), ref: 0041CF83
                                                                                                                                                                                                      • RealizePalette.GDI32(?), ref: 0041CF92
                                                                                                                                                                                                      • StretchBlt.GDI32(00000000,?,?,?,?,?,00000000,00000000,00000000,?,?), ref: 0041CFFC
                                                                                                                                                                                                      • StretchDIBits.GDI32(?,?,?,?,?,00000000,00000000,00000000,?,?,?,00000000,?), ref: 0041D03A
                                                                                                                                                                                                      • SelectPalette.GDI32(?,?,00000001), ref: 0041D05F
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: PaletteStretch$Select$BitsCapsDeviceModeRealize
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 2222416421-0
                                                                                                                                                                                                      • Opcode ID: c6a16a19dcf28552bada6898b81586dc49cb1edacb7efb66bca37046f5d7e7da
                                                                                                                                                                                                      • Instruction ID: 4b814cf558339e083a7fb5ccd56fb4ffad9fd0a27a4bfdacf16c2dd2476febac
                                                                                                                                                                                                      • Opcode Fuzzy Hash: c6a16a19dcf28552bada6898b81586dc49cb1edacb7efb66bca37046f5d7e7da
                                                                                                                                                                                                      • Instruction Fuzzy Hash: D2515EB0604200AFDB14DFA8C985F9BBBE9EF08304F10459AB549DB292C778ED81CB58
                                                                                                                                                                                                      Function 00457128 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 103windowCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • SendMessageA.USER32(00000000,?,?), ref: 0045717A
                                                                                                                                                                                                        • Part of subcall function 0042427C: GetWindowTextA.USER32(?,?,00000100), ref: 0042429C
                                                                                                                                                                                                        • Part of subcall function 0041EEA4: GetCurrentThreadId.KERNEL32 ref: 0041EEF3
                                                                                                                                                                                                        • Part of subcall function 0041EEA4: EnumThreadWindows.USER32(00000000,0041EE54,00000000), ref: 0041EEF9
                                                                                                                                                                                                        • Part of subcall function 004242C4: SetWindowTextA.USER32(?,00000000), ref: 004242DC
                                                                                                                                                                                                      • GetMessageA.USER32(?,00000000,00000000,00000000), ref: 004571E1
                                                                                                                                                                                                      • TranslateMessage.USER32(?), ref: 004571FF
                                                                                                                                                                                                      • DispatchMessageA.USER32(?), ref: 00457208
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Message$TextThreadWindow$CurrentDispatchEnumSendTranslateWindows
                                                                                                                                                                                                      • String ID: [Paused]
                                                                                                                                                                                                      • API String ID: 1007367021-4230553315
                                                                                                                                                                                                      • Opcode ID: fd37f0685e9949bc630816f418b91ae10989fde9f4c26f7dfdebc9041f05c988
                                                                                                                                                                                                      • Instruction ID: 9c65c5789669556775cb04b7d8b700a3e8427f17a0623b42c67a15115a154b53
                                                                                                                                                                                                      • Opcode Fuzzy Hash: fd37f0685e9949bc630816f418b91ae10989fde9f4c26f7dfdebc9041f05c988
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 3A3196309082449EDB11DFB5EC81FDEBBB8EB49314F5580B7F800E7292D6389909CB69
                                                                                                                                                                                                      Function 0046B294 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 99sleepCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetCursor.USER32(00000000,0046B3D3), ref: 0046B350
                                                                                                                                                                                                      • LoadCursorA.USER32(00000000,00007F02), ref: 0046B35E
                                                                                                                                                                                                      • SetCursor.USER32(00000000,00000000,00007F02,00000000,0046B3D3), ref: 0046B364
                                                                                                                                                                                                      • Sleep.KERNEL32(000002EE,00000000,00000000,00007F02,00000000,0046B3D3), ref: 0046B36E
                                                                                                                                                                                                      • SetCursor.USER32(00000000,000002EE,00000000,00000000,00007F02,00000000,0046B3D3), ref: 0046B374
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Cursor$LoadSleep
                                                                                                                                                                                                      • String ID: CheckPassword
                                                                                                                                                                                                      • API String ID: 4023313301-1302249611
                                                                                                                                                                                                      • Opcode ID: 9ec6fbb627a2037d8b10d3b03f13e16da416f17f6db7f06dbaba65bff406c05b
                                                                                                                                                                                                      • Instruction ID: 12e539274ef1f9e2a04eba0c68275a436143f563f239c7c10787bf1112b5c925
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 9ec6fbb627a2037d8b10d3b03f13e16da416f17f6db7f06dbaba65bff406c05b
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 883140347402449FD711DB69C899B9A7BE4EB05304F5580B6BC44DB392D7789E80CB99
                                                                                                                                                                                                      Function 004595D4 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 86libraryloaderCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(626D6573,CreateAssemblyCache), ref: 0045968F
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      • CreateAssemblyCache, xrefs: 00459686
                                                                                                                                                                                                      • Failed to get address of .NET Framework CreateAssemblyCache function, xrefs: 0045969A
                                                                                                                                                                                                      • Fusion.dll, xrefs: 0045962F
                                                                                                                                                                                                      • Failed to load .NET Framework DLL "%s", xrefs: 00459674
                                                                                                                                                                                                      • .NET Framework CreateAssemblyCache function failed, xrefs: 004596B2
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: AddressProc
                                                                                                                                                                                                      • String ID: .NET Framework CreateAssemblyCache function failed$CreateAssemblyCache$Failed to get address of .NET Framework CreateAssemblyCache function$Failed to load .NET Framework DLL "%s"$Fusion.dll
                                                                                                                                                                                                      • API String ID: 190572456-3990135632
                                                                                                                                                                                                      • Opcode ID: c76a925808990de0a4edfa3a9bd9e2f18b95e6c6c4d3f27ecf656a26428a2687
                                                                                                                                                                                                      • Instruction ID: 16de9e68b372fd706bfdce8394bce33e03e331de8444419fbf47e642e04e3cf3
                                                                                                                                                                                                      • Opcode Fuzzy Hash: c76a925808990de0a4edfa3a9bd9e2f18b95e6c6c4d3f27ecf656a26428a2687
                                                                                                                                                                                                      • Instruction Fuzzy Hash: E1318B71E10605EBCB01EFA9C88159EB7B4EF44315F50857BE814E7382DB389E08C799
                                                                                                                                                                                                      Function 0041C148 Relevance: 10.6, APIs: 7, Instructions: 70windowCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                        • Part of subcall function 0041C048: GetObjectA.GDI32(?,00000018), ref: 0041C055
                                                                                                                                                                                                      • GetFocus.USER32 ref: 0041C168
                                                                                                                                                                                                      • GetDC.USER32(?), ref: 0041C174
                                                                                                                                                                                                      • SelectPalette.GDI32(?,?,00000000), ref: 0041C195
                                                                                                                                                                                                      • RealizePalette.GDI32(?), ref: 0041C1A1
                                                                                                                                                                                                      • GetDIBits.GDI32(?,?,00000000,?,?,?,00000000), ref: 0041C1B8
                                                                                                                                                                                                      • SelectPalette.GDI32(?,00000000,00000000), ref: 0041C1E0
                                                                                                                                                                                                      • ReleaseDC.USER32(?,?), ref: 0041C1ED
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Palette$Select$BitsFocusObjectRealizeRelease
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 3303097818-0
                                                                                                                                                                                                      • Opcode ID: 26117fda3ddcda01a6cc84f42a4f6ec069d0e010bd6cdd98afb854c6c7779a8d
                                                                                                                                                                                                      • Instruction ID: 25a0b6576c779426e59073023ceed4ef49f3845c1b310514cd4f08ef327de147
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 26117fda3ddcda01a6cc84f42a4f6ec069d0e010bd6cdd98afb854c6c7779a8d
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 49116D71A44604BFDF10DBE9CC81FAFB7FCEB48700F50486AB518E7281DA7899008B28
                                                                                                                                                                                                      Function 00418C54 Relevance: 10.6, APIs: 7, Instructions: 67COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetSystemMetrics.USER32(0000000E), ref: 00418C70
                                                                                                                                                                                                      • GetSystemMetrics.USER32(0000000D), ref: 00418C78
                                                                                                                                                                                                      • 6F9A2980.COMCTL32(00000000,0000000D,00000000,0000000E,00000001,00000001,00000001,00000000), ref: 00418C7E
                                                                                                                                                                                                        • Part of subcall function 004107F8: 6F99C400.COMCTL32(0049B628,000000FF,00000000,00418CAC,00000000,00418D08,?,00000000,0000000D,00000000,0000000E,00000001,00000001,00000001,00000000), ref: 004107FC
                                                                                                                                                                                                      • 6FA0CB00.COMCTL32(0049B628,00000000,00000000,00000000,00000000,00418D08,?,00000000,0000000D,00000000,0000000E,00000001,00000001,00000001,00000000), ref: 00418CCE
                                                                                                                                                                                                      • 6FA0C740.COMCTL32(00000000,?,0049B628,00000000,00000000,00000000,00000000,00418D08,?,00000000,0000000D,00000000,0000000E,00000001,00000001,00000001), ref: 00418CD9
                                                                                                                                                                                                      • 6FA0CB00.COMCTL32(0049B628,00000001,?,?,00000000,?,0049B628,00000000,00000000,00000000,00000000,00418D08,?,00000000,0000000D,00000000), ref: 00418CEC
                                                                                                                                                                                                      • 6F9A0860.COMCTL32(0049B628,00418D0F,?,00000000,?,0049B628,00000000,00000000,00000000,00000000,00418D08,?,00000000,0000000D,00000000,0000000E), ref: 00418D02
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: MetricsSystem$A0860A2980C400C740
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 1086221473-0
                                                                                                                                                                                                      • Opcode ID: e2c7fe5230f8d2f143d47c0d6a7892a097693e1c100db4317caf46c6149257f7
                                                                                                                                                                                                      • Instruction ID: f48c8f8e6a400555c090207229051c9eae11b8a9b20c4da93df477ea8fa1a9e8
                                                                                                                                                                                                      • Opcode Fuzzy Hash: e2c7fe5230f8d2f143d47c0d6a7892a097693e1c100db4317caf46c6149257f7
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 6B112475744204BBDB50EBA9EC82FAD73F8DB08704F504066B514EB2C1DAB9AD808759
                                                                                                                                                                                                      Function 00483750 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 61registryCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                        • Part of subcall function 0042DE1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,004836C7,?,00000001,?,?,004836C7,?,00000001,00000000), ref: 0042DE38
                                                                                                                                                                                                      • RegCloseKey.ADVAPI32(?,?,00000001,00000000,00000000,00483808), ref: 004837ED
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CloseOpen
                                                                                                                                                                                                      • String ID: LanmanNT$ProductType$ServerNT$System\CurrentControlSet\Control\ProductOptions$WinNT
                                                                                                                                                                                                      • API String ID: 47109696-2530820420
                                                                                                                                                                                                      • Opcode ID: 6cffb51fcf675e5b5ff337e99a1a510b156e53e1e1d602fe7582bc6a3ac7d990
                                                                                                                                                                                                      • Instruction ID: c613687e0df8eb2305741995cd8b82d1e16d8def3fb188134640bd78fd3b844b
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 6cffb51fcf675e5b5ff337e99a1a510b156e53e1e1d602fe7582bc6a3ac7d990
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 7711AFB0B00204AAD700FBA68C12A5EBAE8DB55B09F208877A800E7681E73CDB01875C
                                                                                                                                                                                                      Function 00495078 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 57COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetDC.USER32(00000000), ref: 00495089
                                                                                                                                                                                                        • Part of subcall function 0041A1E8: CreateFontIndirectA.GDI32(?), ref: 0041A2A7
                                                                                                                                                                                                      • SelectObject.GDI32(00000000,00000000), ref: 004950AB
                                                                                                                                                                                                      • GetTextExtentPointA.GDI32(00000000,ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz,00000034,00495629), ref: 004950BF
                                                                                                                                                                                                      • GetTextMetricsA.GDI32(00000000,?), ref: 004950E1
                                                                                                                                                                                                      • ReleaseDC.USER32(00000000,00000000), ref: 004950FE
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      • ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz, xrefs: 004950B6
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Text$CreateExtentFontIndirectMetricsObjectPointReleaseSelect
                                                                                                                                                                                                      • String ID: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz
                                                                                                                                                                                                      • API String ID: 2948443157-222967699
                                                                                                                                                                                                      • Opcode ID: abee541f412f83cdbf8a3624064085eef96ac035cc50ff2f1c61c1b17b94f013
                                                                                                                                                                                                      • Instruction ID: d310c62e5609ca3062061d10b625b1d271ae10615434581f3ecc8597d6741426
                                                                                                                                                                                                      • Opcode Fuzzy Hash: abee541f412f83cdbf8a3624064085eef96ac035cc50ff2f1c61c1b17b94f013
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 76014875A04704BFDB05DBA5CC42F5EB7ECDB49714F614476F604E7281D5789E008B68
                                                                                                                                                                                                      Function 0041B462 Relevance: 10.6, APIs: 7, Instructions: 57windowCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • SelectObject.GDI32(00000000,?), ref: 0041B470
                                                                                                                                                                                                      • SelectObject.GDI32(?,00000000), ref: 0041B47F
                                                                                                                                                                                                      • StretchBlt.GDI32(?,00000000,00000000,0000000B,?,00000000,00000000,00000000,?,?,00CC0020), ref: 0041B4AB
                                                                                                                                                                                                      • SelectObject.GDI32(00000000,00000000), ref: 0041B4B9
                                                                                                                                                                                                      • SelectObject.GDI32(?,00000000), ref: 0041B4C7
                                                                                                                                                                                                      • DeleteDC.GDI32(00000000), ref: 0041B4D0
                                                                                                                                                                                                      • DeleteDC.GDI32(?), ref: 0041B4D9
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: ObjectSelect$Delete$Stretch
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 1458357782-0
                                                                                                                                                                                                      • Opcode ID: 8542cbb8adbe0fd8af4a730cfe3faeef428ae57c020086fb9cb954466ea4b08d
                                                                                                                                                                                                      • Instruction ID: 052e9154069abc57648b404522aaf552eddfcc6d95cd3388d63b7ef9ce004286
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 8542cbb8adbe0fd8af4a730cfe3faeef428ae57c020086fb9cb954466ea4b08d
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 7B115C72E40619ABDB10DAD9DC86FEFB7BCEF08704F144555B614F7282C678AC418BA8
                                                                                                                                                                                                      Function 00423394 Relevance: 10.6, APIs: 7, Instructions: 56threadwindowCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetCursorPos.USER32 ref: 004233AF
                                                                                                                                                                                                      • WindowFromPoint.USER32(?,?), ref: 004233BC
                                                                                                                                                                                                      • GetWindowThreadProcessId.USER32(00000000,00000000), ref: 004233CA
                                                                                                                                                                                                      • GetCurrentThreadId.KERNEL32 ref: 004233D1
                                                                                                                                                                                                      • SendMessageA.USER32(00000000,00000084,?,?), ref: 004233EA
                                                                                                                                                                                                      • SendMessageA.USER32(00000000,00000020,00000000,00000000), ref: 00423401
                                                                                                                                                                                                      • SetCursor.USER32(00000000), ref: 00423413
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CursorMessageSendThreadWindow$CurrentFromPointProcess
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 1770779139-0
                                                                                                                                                                                                      • Opcode ID: 134875e674979cd567c136abb418dc525a6250aa5b529fa10794d0eebf3240cc
                                                                                                                                                                                                      • Instruction ID: 22bb490dc700fc35bbf8fe9eba0271ced42fa0644d0760cf779c582944844a3d
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 134875e674979cd567c136abb418dc525a6250aa5b529fa10794d0eebf3240cc
                                                                                                                                                                                                      • Instruction Fuzzy Hash: BA01D4223046103AD6217B755D82E2F26E8DB85B15F50407FF504BB283DA3D9D11937D
                                                                                                                                                                                                      Function 00494E9C Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 47libraryloaderCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetModuleHandleA.KERNEL32(user32.dll), ref: 00494EAC
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,MonitorFromRect), ref: 00494EB9
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,GetMonitorInfoA), ref: 00494EC6
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: AddressProc$HandleModule
                                                                                                                                                                                                      • String ID: GetMonitorInfoA$MonitorFromRect$user32.dll
                                                                                                                                                                                                      • API String ID: 667068680-2254406584
                                                                                                                                                                                                      • Opcode ID: 86a2ddc52e299a4ebb71bf23d73df01b3b4fd34307be7bd5855d98afd1a17bd4
                                                                                                                                                                                                      • Instruction ID: 92166a125eb2f71293346f1714c1de0d588af794120117df170beecaff70c54b
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 86a2ddc52e299a4ebb71bf23d73df01b3b4fd34307be7bd5855d98afd1a17bd4
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 5FF0F65278171627DE1026668C41F7F6ACCDBD5761F050137BE05AB3C2E99C8C0242FD
                                                                                                                                                                                                      Function 0045CFD8 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 34libraryloaderCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,ISCryptGetVersion), ref: 0045CFE1
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,ArcFourInit), ref: 0045CFF1
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,ArcFourCrypt), ref: 0045D001
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: AddressProc
                                                                                                                                                                                                      • String ID: ArcFourCrypt$ArcFourInit$ISCryptGetVersion
                                                                                                                                                                                                      • API String ID: 190572456-508647305
                                                                                                                                                                                                      • Opcode ID: 6bea81dda9fbb2f0804f4d34ed7f3fdf770b10932dc8999661774a36d6befbc1
                                                                                                                                                                                                      • Instruction ID: 053e23ae93e59936775da3b85939a49c1ec117bb16e32bace9e6a444f988995f
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 6bea81dda9fbb2f0804f4d34ed7f3fdf770b10932dc8999661774a36d6befbc1
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 3EF0F9B0980700CBE728EFB6ACC67263795EB9570AF14813BA808A11E2D7780499CB1C
                                                                                                                                                                                                      Function 0045D4D8 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 33libraryloaderCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,BZ2_bzDecompressInit), ref: 0045D4E1
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,BZ2_bzDecompress), ref: 0045D4F1
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,BZ2_bzDecompressEnd), ref: 0045D501
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: AddressProc
                                                                                                                                                                                                      • String ID: BZ2_bzDecompress$BZ2_bzDecompressEnd$BZ2_bzDecompressInit
                                                                                                                                                                                                      • API String ID: 190572456-212574377
                                                                                                                                                                                                      • Opcode ID: 0cec18ecd77b334d9913731d687bcbf118ffb91831bb9c9ad7683d7253c977df
                                                                                                                                                                                                      • Instruction ID: f545bb075b74a91891c18b47f2e11744e93a99b0212facb5d31f4bd58d546edf
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 0cec18ecd77b334d9913731d687bcbf118ffb91831bb9c9ad7683d7253c977df
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 6EF0D0B0D01704EAE724DFB6ACC77363A959BA431AF14943B9A0D96263E678044DCF2D
                                                                                                                                                                                                      Function 0042EA1C Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 30libraryloaderwindowCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetModuleHandleA.KERNEL32(user32.dll,ChangeWindowMessageFilterEx,00000004,00499934,0045703D,004573E0,00456F94,00000000,00000B06,00000000,00000000,00000001,00000000,00000002,00000000,00480DAC), ref: 0042EA35
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0042EA3B
                                                                                                                                                                                                      • InterlockedExchange.KERNEL32(0049B668,00000001), ref: 0042EA4C
                                                                                                                                                                                                        • Part of subcall function 0042E9AC: GetModuleHandleA.KERNEL32(user32.dll,ChangeWindowMessageFilter,?,0042EA70,00000004,00499934,0045703D,004573E0,00456F94,00000000,00000B06,00000000,00000000,00000001,00000000,00000002), ref: 0042E9C2
                                                                                                                                                                                                        • Part of subcall function 0042E9AC: GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0042E9C8
                                                                                                                                                                                                        • Part of subcall function 0042E9AC: InterlockedExchange.KERNEL32(0049B660,00000001), ref: 0042E9D9
                                                                                                                                                                                                      • ChangeWindowMessageFilterEx.USER32(00000000,?,00000001,00000000,00000004,00499934,0045703D,004573E0,00456F94,00000000,00000B06,00000000,00000000,00000001,00000000,00000002), ref: 0042EA60
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: AddressExchangeHandleInterlockedModuleProc$ChangeFilterMessageWindow
                                                                                                                                                                                                      • String ID: ChangeWindowMessageFilterEx$user32.dll
                                                                                                                                                                                                      • API String ID: 142928637-2676053874
                                                                                                                                                                                                      • Opcode ID: 2e6935975283b392abf6eb535232e6e33c7297ce4864da2c850d0b2669d54df9
                                                                                                                                                                                                      • Instruction ID: 20967f7a279d57b19857f2ad39d34e10c6be6de8430a8d3efc5b40b14e24a4c3
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 2e6935975283b392abf6eb535232e6e33c7297ce4864da2c850d0b2669d54df9
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 99E092A1741B20EAEA10B7B67C86FAA2658EB1076DF500037F100A51F1C3BD1C80CE9E
                                                                                                                                                                                                      Function 0044C7DC Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 28libraryloaderCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • LoadLibraryA.KERNEL32(oleacc.dll,?,0044F089), ref: 0044C7EB
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,LresultFromObject), ref: 0044C7FC
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,CreateStdAccessibleObject), ref: 0044C80C
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: AddressProc$LibraryLoad
                                                                                                                                                                                                      • String ID: CreateStdAccessibleObject$LresultFromObject$oleacc.dll
                                                                                                                                                                                                      • API String ID: 2238633743-1050967733
                                                                                                                                                                                                      • Opcode ID: 580db4225bb49e0f2395934ae602c4dd6ca827d8c76c18c7318a842ee4a54372
                                                                                                                                                                                                      • Instruction ID: d6497c9818d993b67a5702c7731996643d684f189bbd4b702b1f6e54e13363b7
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 580db4225bb49e0f2395934ae602c4dd6ca827d8c76c18c7318a842ee4a54372
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 50F0DA70282305CAE750BBB5FDD57263694E3A470AF18277BE841551A2C7B94844CB8C
                                                                                                                                                                                                      Function 00478740 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 14libraryloaderCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetModuleHandleA.KERNEL32(kernel32.dll,?,00498794), ref: 00478746
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,VerSetConditionMask), ref: 00478753
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,VerifyVersionInfoW), ref: 00478763
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: AddressProc$HandleModule
                                                                                                                                                                                                      • String ID: VerSetConditionMask$VerifyVersionInfoW$kernel32.dll
                                                                                                                                                                                                      • API String ID: 667068680-222143506
                                                                                                                                                                                                      • Opcode ID: c231c6f2b70c156a9a87dd751a131f3597001cd76c60e66cfe2a3d12b45a0e7a
                                                                                                                                                                                                      • Instruction ID: d9a2c3c187cd73cba94933972f30ec689a131e62bb2a59a557d4d9670201d7da
                                                                                                                                                                                                      • Opcode Fuzzy Hash: c231c6f2b70c156a9a87dd751a131f3597001cd76c60e66cfe2a3d12b45a0e7a
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 79C0C9F02C0700EA9604B7F11CCBA7A2548C500729330803FB19EA6182D97C0C104A6C
                                                                                                                                                                                                      Function 0041B66C Relevance: 9.1, APIs: 6, Instructions: 144windowCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetFocus.USER32 ref: 0041B745
                                                                                                                                                                                                      • GetDC.USER32(?), ref: 0041B751
                                                                                                                                                                                                      • SelectPalette.GDI32(00000000,?,00000000), ref: 0041B786
                                                                                                                                                                                                      • RealizePalette.GDI32(00000000), ref: 0041B792
                                                                                                                                                                                                      • CreateDIBitmap.GDI32(00000000,?,00000004,?,?,00000000), ref: 0041B7C0
                                                                                                                                                                                                      • SelectPalette.GDI32(00000000,00000000,00000000), ref: 0041B7F4
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Palette$Select$BitmapCreateFocusRealize
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 3275473261-0
                                                                                                                                                                                                      • Opcode ID: 9b17a45ebd00e155e5aeae17ac6cac102e8e00fd56b9a0d3692e3d2bf0971335
                                                                                                                                                                                                      • Instruction ID: 38bdddf8d72f5571b31e8017bfcff87152bbfcb95d4f6cd7f9962c0a723fddb9
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 9b17a45ebd00e155e5aeae17ac6cac102e8e00fd56b9a0d3692e3d2bf0971335
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 8A512F70A002099FDF11DFA9C881AEEBBF9FF49704F104066F504A7791D7799981CBA9
                                                                                                                                                                                                      Function 0041B93C Relevance: 9.1, APIs: 6, Instructions: 142windowCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetFocus.USER32 ref: 0041BA17
                                                                                                                                                                                                      • GetDC.USER32(?), ref: 0041BA23
                                                                                                                                                                                                      • SelectPalette.GDI32(00000000,?,00000000), ref: 0041BA5D
                                                                                                                                                                                                      • RealizePalette.GDI32(00000000), ref: 0041BA69
                                                                                                                                                                                                      • CreateDIBitmap.GDI32(00000000,?,00000004,?,?,00000000), ref: 0041BA8D
                                                                                                                                                                                                      • SelectPalette.GDI32(00000000,00000000,00000000), ref: 0041BAC1
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Palette$Select$BitmapCreateFocusRealize
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 3275473261-0
                                                                                                                                                                                                      • Opcode ID: f1b656a7ede54f8d65f93cc35dc493626dae048aef23b352968a277fb398f08e
                                                                                                                                                                                                      • Instruction ID: 3fcaffe560058c7771eaec6053d79e0e1924f360d52694d27862de55114c0f48
                                                                                                                                                                                                      • Opcode Fuzzy Hash: f1b656a7ede54f8d65f93cc35dc493626dae048aef23b352968a277fb398f08e
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 9D512A74A002189FDB11DFA9C891AAEBBF9FF49700F154066F904EB751D738AD40CBA4
                                                                                                                                                                                                      Function 0041B508 Relevance: 9.1, APIs: 6, Instructions: 113windowCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetFocus.USER32 ref: 0041B57E
                                                                                                                                                                                                      • GetDC.USER32(?), ref: 0041B58A
                                                                                                                                                                                                      • GetDeviceCaps.GDI32(?,00000068), ref: 0041B5A6
                                                                                                                                                                                                      • GetSystemPaletteEntries.GDI32(?,00000000,00000008,?), ref: 0041B5C3
                                                                                                                                                                                                      • GetSystemPaletteEntries.GDI32(?,00000000,00000008,?), ref: 0041B5DA
                                                                                                                                                                                                      • ReleaseDC.USER32(?,?), ref: 0041B626
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: EntriesPaletteSystem$CapsDeviceFocusRelease
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 2502006586-0
                                                                                                                                                                                                      • Opcode ID: e956e6ae92597662ed98b2f51c6b506043ab8b509e5ceb21f610fa5f8f95298e
                                                                                                                                                                                                      • Instruction ID: 1753bd22f5710d4f749a3cf2d8329d0f84e6490acb09e3fae29671003709e3a5
                                                                                                                                                                                                      • Opcode Fuzzy Hash: e956e6ae92597662ed98b2f51c6b506043ab8b509e5ceb21f610fa5f8f95298e
                                                                                                                                                                                                      • Instruction Fuzzy Hash: D0410631A04258AFDF10DFA9C885AAFBBB4EF59704F1484AAF500EB351D3389D51CBA5
                                                                                                                                                                                                      Function 0045CE9C Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 73COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • SetLastError.KERNEL32(00000057,00000000,0045CF68,?,?,?,?,00000000), ref: 0045CF07
                                                                                                                                                                                                      • SetLastError.KERNEL32(00000000,00000002,?,?,?,0045CFD4,?,00000000,0045CF68,?,?,?,?,00000000), ref: 0045CF46
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: ErrorLast
                                                                                                                                                                                                      • String ID: CLASSES_ROOT$CURRENT_USER$MACHINE$USERS
                                                                                                                                                                                                      • API String ID: 1452528299-1580325520
                                                                                                                                                                                                      • Opcode ID: 1bdeb0a210bc513e3c49bf4cbd891cc1911c01b4b436513822a1df069e086b30
                                                                                                                                                                                                      • Instruction ID: 452c5d812052531473411f8275c40b5c85b18bf76fc7955a310c39f58cd58d14
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 1bdeb0a210bc513e3c49bf4cbd891cc1911c01b4b436513822a1df069e086b30
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 3811A536204304AFD711DAA1C9C2A9EB69EDB44706F604037AD00A62C7D67C5F0AD52D
                                                                                                                                                                                                      Function 0041BD8C Relevance: 9.1, APIs: 6, Instructions: 71COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetSystemMetrics.USER32(0000000B), ref: 0041BDD5
                                                                                                                                                                                                      • GetSystemMetrics.USER32(0000000C), ref: 0041BDDF
                                                                                                                                                                                                      • GetDC.USER32(00000000), ref: 0041BDE9
                                                                                                                                                                                                      • GetDeviceCaps.GDI32(00000000,0000000E), ref: 0041BE10
                                                                                                                                                                                                      • GetDeviceCaps.GDI32(00000000,0000000C), ref: 0041BE1D
                                                                                                                                                                                                      • ReleaseDC.USER32(00000000,00000000), ref: 0041BE56
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CapsDeviceMetricsSystem$Release
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 447804332-0
                                                                                                                                                                                                      • Opcode ID: 3bdc6123dd6674b0137b7fef1a93c0b96d54f33e4692062cf67464f69f8f60e7
                                                                                                                                                                                                      • Instruction ID: d5b995c8e3894394b735eabd433659eae54025482fea58e306a85006fdca5b97
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 3bdc6123dd6674b0137b7fef1a93c0b96d54f33e4692062cf67464f69f8f60e7
                                                                                                                                                                                                      • Instruction Fuzzy Hash: E5212A74E04648AFEB00EFA9C941BEEB7B4EB48714F10846AF514B7690D7785940CB69
                                                                                                                                                                                                      Function 0047E23C Relevance: 9.1, APIs: 6, Instructions: 57COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetWindowLongA.USER32(?,000000EC), ref: 0047E24A
                                                                                                                                                                                                      • SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000097,?,000000EC,?,0046CBBD), ref: 0047E270
                                                                                                                                                                                                      • GetWindowLongA.USER32(?,000000EC), ref: 0047E280
                                                                                                                                                                                                      • SetWindowLongA.USER32(?,000000EC,00000000), ref: 0047E2A1
                                                                                                                                                                                                      • ShowWindow.USER32(?,00000005,?,000000EC,00000000,?,000000EC,?,00000000,00000000,00000000,00000000,00000000,00000097,?,000000EC), ref: 0047E2B5
                                                                                                                                                                                                      • SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000057,?,000000EC,00000000,?,000000EC,?,00000000,00000000,00000000), ref: 0047E2D1
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Window$Long$Show
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 3609083571-0
                                                                                                                                                                                                      • Opcode ID: b4e19ff4e98ab52ecda950bfdcb646100cf30b97dd598c6192f2cb622b5c4e11
                                                                                                                                                                                                      • Instruction ID: c2beb8629b08809d81cb9269d2d7eee694fde7899d985d279cae8c77c91b058d
                                                                                                                                                                                                      • Opcode Fuzzy Hash: b4e19ff4e98ab52ecda950bfdcb646100cf30b97dd598c6192f2cb622b5c4e11
                                                                                                                                                                                                      • Instruction Fuzzy Hash: A40140B1641210ABE610D769DE41F2237DCAB0C360F0907A6BA44EF3E3C728E8408B49
                                                                                                                                                                                                      Function 0041B270 Relevance: 9.0, APIs: 6, Instructions: 43COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                        • Part of subcall function 0041A6E0: CreateBrushIndirect.GDI32 ref: 0041A74B
                                                                                                                                                                                                      • UnrealizeObject.GDI32(00000000), ref: 0041B27C
                                                                                                                                                                                                      • SelectObject.GDI32(?,00000000), ref: 0041B28E
                                                                                                                                                                                                      • SetBkColor.GDI32(?,00000000), ref: 0041B2B1
                                                                                                                                                                                                      • SetBkMode.GDI32(?,00000002), ref: 0041B2BC
                                                                                                                                                                                                      • SetBkColor.GDI32(?,00000000), ref: 0041B2D7
                                                                                                                                                                                                      • SetBkMode.GDI32(?,00000001), ref: 0041B2E2
                                                                                                                                                                                                        • Part of subcall function 0041A058: GetSysColor.USER32(?), ref: 0041A062
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Color$ModeObject$BrushCreateIndirectSelectUnrealize
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 3527656728-0
                                                                                                                                                                                                      • Opcode ID: 90af7722afa79acc590a6ee3060039fb524340e2cf7ce152cccbdcb584e8dbde
                                                                                                                                                                                                      • Instruction ID: d03b18a2b949c207061bd18b8e5d47ed8ce294e6be165222704fda36eef26a4f
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 90af7722afa79acc590a6ee3060039fb524340e2cf7ce152cccbdcb584e8dbde
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 56F0CD756015009BDE00FFAAD9CBE4B3B989F043097048496B908DF187CA3CD8649B3A
                                                                                                                                                                                                      Function 004978CC Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 97COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                        • Part of subcall function 004242C4: SetWindowTextA.USER32(?,00000000), ref: 004242DC
                                                                                                                                                                                                      • ShowWindow.USER32(?,00000005,00000000,00497B31,?,?,00000000), ref: 00497902
                                                                                                                                                                                                        • Part of subcall function 0042D8C4: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0042D8D7
                                                                                                                                                                                                        • Part of subcall function 004072A8: SetCurrentDirectoryA.KERNEL32(00000000,?,0049792A,00000000,00497AFD,?,?,00000005,00000000,00497B31,?,?,00000000), ref: 004072B3
                                                                                                                                                                                                        • Part of subcall function 0042D44C: GetModuleFileNameA.KERNEL32(00000000,?,00000104,00000000,0042D4DA,?,?,?,00000001,?,0045607E,00000000,004560E6), ref: 0042D481
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: DirectoryWindow$CurrentFileModuleNameShowSystemText
                                                                                                                                                                                                      • String ID: .dat$.msg$IMsg$Uninstall
                                                                                                                                                                                                      • API String ID: 3312786188-1660910688
                                                                                                                                                                                                      • Opcode ID: 7512cdbd572c9146c7922e267a2e3ec6043e3c2241cd3ad81f3df178027fada8
                                                                                                                                                                                                      • Instruction ID: 79fbc7277211ce2bf855d188aeb365c1f4e20c687b9dac3c04c4e1571c34c8ae
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 7512cdbd572c9146c7922e267a2e3ec6043e3c2241cd3ad81f3df178027fada8
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 44315E34A10214AFDB01EB65DC92D5E7B75FB89718B91847AF400AB392DB38BD018B58
                                                                                                                                                                                                      Function 0042EAA8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 49libraryloaderCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetModuleHandleA.KERNEL32(user32.dll,ShutdownBlockReasonCreate), ref: 0042EADA
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0042EAE0
                                                                                                                                                                                                      • MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000FFF,00000000,user32.dll,ShutdownBlockReasonCreate), ref: 0042EB09
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: AddressByteCharHandleModuleMultiProcWide
                                                                                                                                                                                                      • String ID: ShutdownBlockReasonCreate$user32.dll
                                                                                                                                                                                                      • API String ID: 828529508-2866557904
                                                                                                                                                                                                      • Opcode ID: dc376cfddf31d7f2fdf241a02509d8c694355095d88693d0378826b1ee5e642a
                                                                                                                                                                                                      • Instruction ID: 7e091cf0cf0c4dae12ae48626bdfb721f4796128e550bb25d34418d77cfbcdd5
                                                                                                                                                                                                      • Opcode Fuzzy Hash: dc376cfddf31d7f2fdf241a02509d8c694355095d88693d0378826b1ee5e642a
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 70F0C8D034061136E620B57F5C82F7B598C8F94759F140436B109E62C2D96CA905426E
                                                                                                                                                                                                      Function 00457E48 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 45COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • MsgWaitForMultipleObjects.USER32(00000001,00000001,00000000,000000FF,000000FF), ref: 00457E78
                                                                                                                                                                                                      • GetExitCodeProcess.KERNEL32(?,?), ref: 00457E99
                                                                                                                                                                                                      • CloseHandle.KERNEL32(?,00457ECC), ref: 00457EBF
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CloseCodeExitHandleMultipleObjectsProcessWait
                                                                                                                                                                                                      • String ID: GetExitCodeProcess$MsgWaitForMultipleObjects
                                                                                                                                                                                                      • API String ID: 2573145106-3235461205
                                                                                                                                                                                                      • Opcode ID: 1ea0d3176aedc3e092b8d1903486a3d6a13cecd7bb31937a8215cd8aa9781b6e
                                                                                                                                                                                                      • Instruction ID: b72ead612c96ea1451a2df619a1119c508d9f8e19ef45bb7a80fe0c677849c01
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 1ea0d3176aedc3e092b8d1903486a3d6a13cecd7bb31937a8215cd8aa9781b6e
                                                                                                                                                                                                      • Instruction Fuzzy Hash: DA01A235608304AFD711EBA9AC06A1A73A8EB49715F2040B6FC10E73D3D6389E04861D
                                                                                                                                                                                                      Function 0042E9AC Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetModuleHandleA.KERNEL32(user32.dll,ChangeWindowMessageFilter,?,0042EA70,00000004,00499934,0045703D,004573E0,00456F94,00000000,00000B06,00000000,00000000,00000001,00000000,00000002), ref: 0042E9C2
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0042E9C8
                                                                                                                                                                                                      • InterlockedExchange.KERNEL32(0049B660,00000001), ref: 0042E9D9
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: AddressExchangeHandleInterlockedModuleProc
                                                                                                                                                                                                      • String ID: ChangeWindowMessageFilter$user32.dll
                                                                                                                                                                                                      • API String ID: 3478007392-2498399450
                                                                                                                                                                                                      • Opcode ID: 3254194633b527647525dea76c004eb0f33bc99a9c522dc813bf1be520244ffe
                                                                                                                                                                                                      • Instruction ID: c922fa4e85abb1c6873f36dcd01b6443d81c66d6c3501223796626af46e79b09
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 3254194633b527647525dea76c004eb0f33bc99a9c522dc813bf1be520244ffe
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 5CE0ECB2740324EADA103B627E8AF663558E724B19F50043BF001751F1C7FD1C80CA9E
                                                                                                                                                                                                      Function 004776B4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderthreadCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetWindowThreadProcessId.USER32(00000000), ref: 004776BC
                                                                                                                                                                                                      • GetModuleHandleA.KERNEL32(user32.dll,AllowSetForegroundWindow,00000000,?,?,004777B3,0049C0A4,00000000), ref: 004776CF
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,user32.dll), ref: 004776D5
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: AddressHandleModuleProcProcessThreadWindow
                                                                                                                                                                                                      • String ID: AllowSetForegroundWindow$user32.dll
                                                                                                                                                                                                      • API String ID: 1782028327-3855017861
                                                                                                                                                                                                      • Opcode ID: 79b78db4dd9cdf85c2be20cd47b0727ffde78e70408e3af60258cd37bb1d66b3
                                                                                                                                                                                                      • Instruction ID: ee14923c72d036b6004e6d5d181e2ae3dde99fc96f584ef82141a9a0fe8b283c
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 79b78db4dd9cdf85c2be20cd47b0727ffde78e70408e3af60258cd37bb1d66b3
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 99D0C7D0249B02AAD910B3F94D47FAF365CA954768794C47B7404E218DDABCDC00D93D
                                                                                                                                                                                                      Function 00416C2C Relevance: 7.6, APIs: 5, Instructions: 104COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • BeginPaint.USER32(00000000,?), ref: 00416C52
                                                                                                                                                                                                      • SaveDC.GDI32(?), ref: 00416C83
                                                                                                                                                                                                      • ExcludeClipRect.GDI32(?,?,?,?,?,?,00000000,00416D45), ref: 00416CE4
                                                                                                                                                                                                      • RestoreDC.GDI32(?,?), ref: 00416D0B
                                                                                                                                                                                                      • EndPaint.USER32(00000000,?,00416D4C,00000000,00416D45), ref: 00416D3F
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Paint$BeginClipExcludeRectRestoreSave
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 3808407030-0
                                                                                                                                                                                                      • Opcode ID: ad781fe6fb59047a66b80eb53a3f65b2019eba16d1c733f202b60e39d660354f
                                                                                                                                                                                                      • Instruction ID: 8164e3b37c2b38cc39b91ef4074089abf19b8963c3e0e5cbd12a4ce3d65b1abe
                                                                                                                                                                                                      • Opcode Fuzzy Hash: ad781fe6fb59047a66b80eb53a3f65b2019eba16d1c733f202b60e39d660354f
                                                                                                                                                                                                      • Instruction Fuzzy Hash: A1415070A002049FCB14DBA9C585FAA77F9FF48304F1540AEE8459B362D778DD81CB58
                                                                                                                                                                                                      Function 00414800 Relevance: 7.6, APIs: 5, Instructions: 102COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                                      • Opcode ID: b6913cb722474124f75cff2ee5949f067bbdde1b56a592e148b6496e85af3d5a
                                                                                                                                                                                                      • Instruction ID: a833d86c80f2fb81cba799e3b93fc1891ddf3ebdd98a67124a25423b7ab76754
                                                                                                                                                                                                      • Opcode Fuzzy Hash: b6913cb722474124f75cff2ee5949f067bbdde1b56a592e148b6496e85af3d5a
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 563132746057809FC320EF69C984B9BB7E8AF89354F04491EF9D5C3752C638E8818F19
                                                                                                                                                                                                      Function 004297CC Relevance: 7.6, APIs: 5, Instructions: 83windowCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • SendMessageA.USER32(00000000,000000BB,?,00000000), ref: 00429808
                                                                                                                                                                                                      • SendMessageA.USER32(00000000,000000BB,?,00000000), ref: 00429837
                                                                                                                                                                                                      • SendMessageA.USER32(00000000,000000C1,00000000,00000000), ref: 00429853
                                                                                                                                                                                                      • SendMessageA.USER32(00000000,000000B1,00000000,00000000), ref: 0042987E
                                                                                                                                                                                                      • SendMessageA.USER32(00000000,000000C2,00000000,00000000), ref: 0042989C
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: MessageSend
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 3850602802-0
                                                                                                                                                                                                      • Opcode ID: 399f588db94bb8b810bf5b46e1237ea7bfd7cbebe0e15a3dbf36720fb68daebb
                                                                                                                                                                                                      • Instruction ID: 8b65b0e689063cc909dba6714575951256d1ad54ff8cece17fd29570ea6901c2
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 399f588db94bb8b810bf5b46e1237ea7bfd7cbebe0e15a3dbf36720fb68daebb
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 6E219D707107057BEB10AB62DC82F5B7AECAB41708F54443EB501AB2D2DFB8AE418228
                                                                                                                                                                                                      Function 0041BBB8 Relevance: 7.6, APIs: 5, Instructions: 83windowCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetSystemMetrics.USER32(0000000B), ref: 0041BBCA
                                                                                                                                                                                                      • GetSystemMetrics.USER32(0000000C), ref: 0041BBD4
                                                                                                                                                                                                      • GetDC.USER32(00000000), ref: 0041BC12
                                                                                                                                                                                                      • CreateDIBitmap.GDI32(00000000,?,00000004,?,?,00000000), ref: 0041BC59
                                                                                                                                                                                                      • DeleteObject.GDI32(00000000), ref: 0041BC9A
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: MetricsSystem$BitmapCreateDeleteObject
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 1095203571-0
                                                                                                                                                                                                      • Opcode ID: d6ecec59309c4539c21f746b1d4641e0a999657a412e1d938322a226e3514674
                                                                                                                                                                                                      • Instruction ID: 2a907a32995036c4e239f44386a828d3a2f1e7d44945ead90e55d18394f4d4ff
                                                                                                                                                                                                      • Opcode Fuzzy Hash: d6ecec59309c4539c21f746b1d4641e0a999657a412e1d938322a226e3514674
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 5D315C70E00208EFDB04DFA5C941AAEB7F5EB48700F2084AAF514AB781D7789E40DB98
                                                                                                                                                                                                      Function 0047344C Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 71COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                        • Part of subcall function 0045CE9C: SetLastError.KERNEL32(00000057,00000000,0045CF68,?,?,?,?,00000000), ref: 0045CF07
                                                                                                                                                                                                      • GetLastError.KERNEL32(00000000,00000000,00000000,00473520,?,?,0049C1DC,00000000), ref: 004734D9
                                                                                                                                                                                                      • GetLastError.KERNEL32(00000000,00000000,00000000,00473520,?,?,0049C1DC,00000000), ref: 004734EF
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      • Failed to set permissions on registry key (%d)., xrefs: 00473500
                                                                                                                                                                                                      • Setting permissions on registry key: %s\%s, xrefs: 0047349E
                                                                                                                                                                                                      • Could not set permissions on the registry key because it currently does not exist., xrefs: 004734E3
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: ErrorLast
                                                                                                                                                                                                      • String ID: Could not set permissions on the registry key because it currently does not exist.$Failed to set permissions on registry key (%d).$Setting permissions on registry key: %s\%s
                                                                                                                                                                                                      • API String ID: 1452528299-4018462623
                                                                                                                                                                                                      • Opcode ID: 0d5e79ee1334057aa5daa633f15edbea4dce667586b26377d0822845b181a9d1
                                                                                                                                                                                                      • Instruction ID: f6b37ec0c80c1520313a246a851a493010c524415d82476cd93cad017a8f966b
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 0d5e79ee1334057aa5daa633f15edbea4dce667586b26377d0822845b181a9d1
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 76218670A042445FCB10DFA9C8826EEBBE4DF49315F50817BE508E7392D7785E05876D
                                                                                                                                                                                                      Function 00403CA4 Relevance: 7.6, APIs: 5, Instructions: 55memoryCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000400), ref: 00403CDE
                                                                                                                                                                                                      • SysAllocStringLen.OLEAUT32(?,00000000), ref: 00403CE9
                                                                                                                                                                                                      • MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000,00000000,00000000), ref: 00403CFC
                                                                                                                                                                                                      • SysAllocStringLen.OLEAUT32(00000000,00000000), ref: 00403D06
                                                                                                                                                                                                      • MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 00403D15
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: ByteCharMultiWide$AllocString
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 262959230-0
                                                                                                                                                                                                      • Opcode ID: dcd45591e65b03bd276bb2a5b0fabad56ebf76f0c081827c2345b0a7b763a240
                                                                                                                                                                                                      • Instruction ID: 657f84db466bd1c54801a2b30447fc2084338491f8142acf58a262d5883cef98
                                                                                                                                                                                                      • Opcode Fuzzy Hash: dcd45591e65b03bd276bb2a5b0fabad56ebf76f0c081827c2345b0a7b763a240
                                                                                                                                                                                                      • Instruction Fuzzy Hash: FCF0A4917442043BF21025A65C43F6B198CCB82B9BF50053FB704FA1D2D87C9D04427D
                                                                                                                                                                                                      Function 004143E0 Relevance: 7.6, APIs: 5, Instructions: 51windowCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • SelectPalette.GDI32(00000000,00000000,00000000), ref: 00414419
                                                                                                                                                                                                      • RealizePalette.GDI32(00000000), ref: 00414421
                                                                                                                                                                                                      • SelectPalette.GDI32(00000000,00000000,00000001), ref: 00414435
                                                                                                                                                                                                      • RealizePalette.GDI32(00000000), ref: 0041443B
                                                                                                                                                                                                      • ReleaseDC.USER32(00000000,00000000), ref: 00414446
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Palette$RealizeSelect$Release
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 2261976640-0
                                                                                                                                                                                                      • Opcode ID: c9c8aa66f6917016d7555c0ac5b3df2d15848593dde74026b2272496f15e705b
                                                                                                                                                                                                      • Instruction ID: 3cc421e061c7a323c9855e33cbe13bf4890882f9e8533d15179bd5f7679f66d2
                                                                                                                                                                                                      • Opcode Fuzzy Hash: c9c8aa66f6917016d7555c0ac5b3df2d15848593dde74026b2272496f15e705b
                                                                                                                                                                                                      • Instruction Fuzzy Hash: A2018F7520C3806AE600A63D8C85A9F6BED9FCA718F15446EF495DB282DA7AC8018765
                                                                                                                                                                                                      Function 00424CE0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 190COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                        • Part of subcall function 0041F074: GetActiveWindow.USER32 ref: 0041F077
                                                                                                                                                                                                        • Part of subcall function 0041F074: GetCurrentThreadId.KERNEL32 ref: 0041F08C
                                                                                                                                                                                                        • Part of subcall function 0041F074: EnumThreadWindows.USER32(00000000,Function_0001F050), ref: 0041F092
                                                                                                                                                                                                        • Part of subcall function 004231A8: GetSystemMetrics.USER32(00000000), ref: 004231AA
                                                                                                                                                                                                      • OffsetRect.USER32(?,?,?), ref: 00424DC9
                                                                                                                                                                                                      • DrawTextA.USER32(00000000,00000000,000000FF,?,00000C10), ref: 00424E8C
                                                                                                                                                                                                      • OffsetRect.USER32(?,?,?), ref: 00424E9D
                                                                                                                                                                                                        • Part of subcall function 00423564: GetCurrentThreadId.KERNEL32 ref: 00423579
                                                                                                                                                                                                        • Part of subcall function 00423564: SetWindowsHookExA.USER32(00000003,00423520,00000000,00000000), ref: 00423589
                                                                                                                                                                                                        • Part of subcall function 00423564: CreateThread.KERNEL32(00000000,000003E8,004234D0,00000000,00000000), ref: 004235AD
                                                                                                                                                                                                        • Part of subcall function 00424B2C: SetTimer.USER32(00000000,00000001,?,004234B4), ref: 00424B47
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Thread$CurrentOffsetRectWindows$ActiveCreateDrawEnumHookMetricsSystemTextTimerWindow
                                                                                                                                                                                                      • String ID: vLB
                                                                                                                                                                                                      • API String ID: 1477829881-1797516613
                                                                                                                                                                                                      • Opcode ID: eca2d51684af674f105a04db108c275b2bf5eb64e8b50ed4b65912378cb963a7
                                                                                                                                                                                                      • Instruction ID: 1a85cd152e58b5c2614c87f396891e2b5808bef0cf689969089b0637ec596c27
                                                                                                                                                                                                      • Opcode Fuzzy Hash: eca2d51684af674f105a04db108c275b2bf5eb64e8b50ed4b65912378cb963a7
                                                                                                                                                                                                      • Instruction Fuzzy Hash: C5812675A003188FCB14DFA8D880ADEBBF4FF88314F50416AE905AB296E738AD45CF44
                                                                                                                                                                                                      Function 00406FA4 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 156shareCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • WNetGetUniversalNameA.MPR(00000000,00000001,?,00000400), ref: 00407003
                                                                                                                                                                                                      • WNetOpenEnumA.MPR(00000001,00000001,00000000,00000000,?), ref: 0040707D
                                                                                                                                                                                                      • WNetEnumResourceA.MPR(?,FFFFFFFF,?,?), ref: 004070D5
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Enum$NameOpenResourceUniversal
                                                                                                                                                                                                      • String ID: Z
                                                                                                                                                                                                      • API String ID: 3604996873-1505515367
                                                                                                                                                                                                      • Opcode ID: a9e747af3270ad6827a26b5e12e82ea9da9777e5f51a79d453bfa0d7b97e4fbe
                                                                                                                                                                                                      • Instruction ID: 78f4b6eea80f90a9c0d6dbacb1000d6f5057f9b0a0312f2c839bfa0eabc808a5
                                                                                                                                                                                                      • Opcode Fuzzy Hash: a9e747af3270ad6827a26b5e12e82ea9da9777e5f51a79d453bfa0d7b97e4fbe
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 14516470E04208AFDB11DF95C951AAFBBB9EF09304F1045BAE500BB3D1D778AE458B5A
                                                                                                                                                                                                      Function 0044CFC0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 126COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • SetRectEmpty.USER32(?), ref: 0044D04E
                                                                                                                                                                                                      • DrawTextA.USER32(00000000,00000000,00000000,?,00000D20), ref: 0044D079
                                                                                                                                                                                                      • DrawTextA.USER32(00000000,00000000,00000000,00000000,00000800), ref: 0044D101
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: DrawText$EmptyRect
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 182455014-2867612384
                                                                                                                                                                                                      • Opcode ID: 3cb455d8176bf3e5231f8dda4285d64bdc155d7a8260b5a0e5f680fe50550aac
                                                                                                                                                                                                      • Instruction ID: ac611c4ae9e9b4e435f74cd3b872a097dcdbbef8ea8fa2dc8c743a2ef399c877
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 3cb455d8176bf3e5231f8dda4285d64bdc155d7a8260b5a0e5f680fe50550aac
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 18517171E00248AFDB11DFA5C885BDEBBF8BF48308F18447AE845EB252D7789945CB64
                                                                                                                                                                                                      Function 0042EF74 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 106COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetDC.USER32(00000000), ref: 0042EF9E
                                                                                                                                                                                                        • Part of subcall function 0041A1E8: CreateFontIndirectA.GDI32(?), ref: 0041A2A7
                                                                                                                                                                                                      • SelectObject.GDI32(?,00000000), ref: 0042EFC1
                                                                                                                                                                                                      • ReleaseDC.USER32(00000000,?), ref: 0042F0A0
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CreateFontIndirectObjectReleaseSelect
                                                                                                                                                                                                      • String ID: ...\
                                                                                                                                                                                                      • API String ID: 3133960002-983595016
                                                                                                                                                                                                      • Opcode ID: 65766ae35a5ff9b042dd79c87bacb89811e544568082cefb05445997e7e8f61e
                                                                                                                                                                                                      • Instruction ID: de545d42c11d103cbad381cc3223c2b5efa9fdb4a6e9ae4bb0445229962d8c70
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 65766ae35a5ff9b042dd79c87bacb89811e544568082cefb05445997e7e8f61e
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 5A316370B00128AFDB11EB96D841BAEB7F8EB09348F90447BE410A7392D7785E49CA59
                                                                                                                                                                                                      Function 004538BC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 100fileCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • CreateFileA.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000,.tmp,00496991,_iu,?,00000000,004539F6), ref: 004539AB
                                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000,00000000,C0000000,00000000,00000000,00000002,00000080,00000000,.tmp,00496991,_iu,?,00000000,004539F6), ref: 004539BB
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CloseCreateFileHandle
                                                                                                                                                                                                      • String ID: .tmp$_iu
                                                                                                                                                                                                      • API String ID: 3498533004-10593223
                                                                                                                                                                                                      • Opcode ID: 1bf85a80132bbff87a9a827a47fd0c4a75e2f830b03f5f12b130a42208c1e1fd
                                                                                                                                                                                                      • Instruction ID: c819285d1904897ee35e15112b57b1097950df4cd651dd5525fdc5768647a91e
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 1bf85a80132bbff87a9a827a47fd0c4a75e2f830b03f5f12b130a42208c1e1fd
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 6531C5B0A00249ABCB11EFA5D842B9EBBB4AF44345F20453AF810B73C2D7785F058B69
                                                                                                                                                                                                      Function 00497D80 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 83COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetFileAttributesA.KERNEL32(00000000,004986D0,00000000,00497E76,?,?,00000000,0049B628), ref: 00497DF0
                                                                                                                                                                                                      • SetFileAttributesA.KERNEL32(00000000,00000000,00000000,004986D0,00000000,00497E76,?,?,00000000,0049B628), ref: 00497E19
                                                                                                                                                                                                      • MoveFileExA.KERNEL32(00000000,00000000,00000001(MOVEFILE_REPLACE_EXISTING)), ref: 00497E32
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: File$Attributes$Move
                                                                                                                                                                                                      • String ID: isRS-%.3u.tmp
                                                                                                                                                                                                      • API String ID: 3839737484-3657609586
                                                                                                                                                                                                      • Opcode ID: 84a051ea660f4be18fdf942d8d4b82cb5e1fe1d08e884f4cad26ecfab1bcf79f
                                                                                                                                                                                                      • Instruction ID: d3b1e0af9bc01606b4acbc4251c5ccfb03fd27bd09466a3f7c53cc9bc4e4fae9
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 84a051ea660f4be18fdf942d8d4b82cb5e1fe1d08e884f4cad26ecfab1bcf79f
                                                                                                                                                                                                      • Instruction Fuzzy Hash: F5214F71E14219AFCF11EFA9C881AAFBBB8EF44714F10457BB814B72D1D6389E018B59
                                                                                                                                                                                                      Function 00456A48 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 65registryCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                        • Part of subcall function 0042C804: GetFullPathNameA.KERNEL32(00000000,00001000,?), ref: 0042C828
                                                                                                                                                                                                        • Part of subcall function 00403CA4: MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000400), ref: 00403CDE
                                                                                                                                                                                                        • Part of subcall function 00403CA4: SysAllocStringLen.OLEAUT32(?,00000000), ref: 00403CE9
                                                                                                                                                                                                      • LoadTypeLib.OLEAUT32(00000000,00000000), ref: 00456A9C
                                                                                                                                                                                                      • RegisterTypeLib.OLEAUT32(00000000,00000000,00000000), ref: 00456AC9
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Type$AllocByteCharFullLoadMultiNamePathRegisterStringWide
                                                                                                                                                                                                      • String ID: LoadTypeLib$RegisterTypeLib
                                                                                                                                                                                                      • API String ID: 1312246647-2435364021
                                                                                                                                                                                                      • Opcode ID: c06c5e8b46d4cc008794e6ef7648282b6775267df5f2c1a0af32ed40ef5fa1a3
                                                                                                                                                                                                      • Instruction ID: f320f84dc8d434ac547319b1f88b10c46afed2bb2b034f8a1d5164c41c1038b2
                                                                                                                                                                                                      • Opcode Fuzzy Hash: c06c5e8b46d4cc008794e6ef7648282b6775267df5f2c1a0af32ed40ef5fa1a3
                                                                                                                                                                                                      • Instruction Fuzzy Hash: CE118430B00604AFDB11DFA6CD55A5AB7BDEB89705F518476FD04D3652DA389E04CA14
                                                                                                                                                                                                      Function 00456FA0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60windowCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • SendMessageA.USER32(00000000,00000B06,00000000,00000000), ref: 00456FBA
                                                                                                                                                                                                      • SendMessageA.USER32(00000000,00000B00,00000000,00000000), ref: 00457057
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      • Cannot debug. Debugger version ($%.8x) does not match Setup version ($%.8x), xrefs: 00456FE6
                                                                                                                                                                                                      • Failed to create DebugClientWnd, xrefs: 00457020
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: MessageSend
                                                                                                                                                                                                      • String ID: Cannot debug. Debugger version ($%.8x) does not match Setup version ($%.8x)$Failed to create DebugClientWnd
                                                                                                                                                                                                      • API String ID: 3850602802-3720027226
                                                                                                                                                                                                      • Opcode ID: 6dc4dd13ffff63052e532ec2970cf3a172fdf6ef35738a55e650b02f86b7c4d3
                                                                                                                                                                                                      • Instruction ID: 7b454b92cb1dfb233f50f2560aabdc39b6abe04e8f027f2194e5078dec578530
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 6dc4dd13ffff63052e532ec2970cf3a172fdf6ef35738a55e650b02f86b7c4d3
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 571127706083409BE310ABA8DC81B5FBBD89B14719F01403AFE849B3C3D7795818C7AE
                                                                                                                                                                                                      Function 0047820C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 55windowkeyboardCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                        • Part of subcall function 004242C4: SetWindowTextA.USER32(?,00000000), ref: 004242DC
                                                                                                                                                                                                      • GetFocus.USER32 ref: 00478277
                                                                                                                                                                                                      • GetKeyState.USER32(0000007A), ref: 00478289
                                                                                                                                                                                                      • WaitMessage.USER32(?,00000000,004782B0,?,00000000,004782D7,?,?,00000001,00000000,?,?,?,0047FEE6,00000000,00480DAC), ref: 00478293
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: FocusMessageStateTextWaitWindow
                                                                                                                                                                                                      • String ID: Wnd=$%x
                                                                                                                                                                                                      • API String ID: 1381870634-2927251529
                                                                                                                                                                                                      • Opcode ID: f1958697a4901136eb243dbe20eb39cbb326672f79de8de72c1a435ff1b0447b
                                                                                                                                                                                                      • Instruction ID: 17992b3effc84475d262d1a309b63da61542e22f0e105337c9737e95fd9359ad
                                                                                                                                                                                                      • Opcode Fuzzy Hash: f1958697a4901136eb243dbe20eb39cbb326672f79de8de72c1a435ff1b0447b
                                                                                                                                                                                                      • Instruction Fuzzy Hash: B811A730644644AFC701FF65DC5999E7BB8EB49304F9184FAF408E7692DB386900CA69
                                                                                                                                                                                                      Function 0046E484 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46timeCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • FileTimeToLocalFileTime.KERNEL32(?), ref: 0046E48C
                                                                                                                                                                                                      • FileTimeToSystemTime.KERNEL32(?,?,?), ref: 0046E49B
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Time$File$LocalSystem
                                                                                                                                                                                                      • String ID: %.4u-%.2u-%.2u %.2u:%.2u:%.2u.%.3u$(invalid)
                                                                                                                                                                                                      • API String ID: 1748579591-1013271723
                                                                                                                                                                                                      • Opcode ID: 2c82eb517319c4feb0678a2222fa1caa0c7cc9d70da35f771929cd42352f02e5
                                                                                                                                                                                                      • Instruction ID: a22b2a007e2cf2d6de8f80eb00497e2bff53ee2dc74e74251f844a221e221b1c
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 2c82eb517319c4feb0678a2222fa1caa0c7cc9d70da35f771929cd42352f02e5
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 3711F8A440C3919ED340DF6AC44432BBAE4AB89708F44496EF9C8D6381E77AC948DB67
                                                                                                                                                                                                      Function 00453F76 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 43fileCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • SetFileAttributesA.KERNEL32(00000000,00000020), ref: 00453F83
                                                                                                                                                                                                        • Part of subcall function 00406F50: DeleteFileA.KERNEL32(00000000,0049B628,00498261,00000000,004982B6,?,?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000), ref: 00406F5B
                                                                                                                                                                                                      • MoveFileA.KERNEL32(00000000,00000000), ref: 00453FA8
                                                                                                                                                                                                        • Part of subcall function 0045349C: GetLastError.KERNEL32(00000000,00454031,00000005,00000000,00454066,?,?,00000000,0049B628,00000004,00000000,00000000,00000000,?,00497F15,00000000), ref: 0045349F
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: File$AttributesDeleteErrorLastMove
                                                                                                                                                                                                      • String ID: DeleteFile$MoveFile
                                                                                                                                                                                                      • API String ID: 3024442154-139070271
                                                                                                                                                                                                      • Opcode ID: 75fc53fd0ddaa48128ef6cce4dae119495c42920ad3f5386662393d2e6d8c133
                                                                                                                                                                                                      • Instruction ID: b5871bee3d194af1fa843ac656f6d820fc0ba16d57580c91db5694710367c43f
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 75fc53fd0ddaa48128ef6cce4dae119495c42920ad3f5386662393d2e6d8c133
                                                                                                                                                                                                      • Instruction Fuzzy Hash: AEF062716142045BD701FBA2D84266EA7ECDB8435EF60443BB900BB6C3DA3C9E094529
                                                                                                                                                                                                      Function 004591B4 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 39registryCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                        • Part of subcall function 0042DE1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,004836C7,?,00000001,?,?,004836C7,?,00000001,00000000), ref: 0042DE38
                                                                                                                                                                                                      • RegCloseKey.ADVAPI32(00000000,00000000,00000001,00000000,?,00000000,?,00000002,004592F1,00000000,004594A9,?,00000000,00000000,00000000), ref: 00459201
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CloseOpen
                                                                                                                                                                                                      • String ID: .NET Framework not found$InstallRoot$SOFTWARE\Microsoft\.NETFramework
                                                                                                                                                                                                      • API String ID: 47109696-2631785700
                                                                                                                                                                                                      • Opcode ID: 7bfc696592b003d8a6b238063e783ff3189b4dca7eb8d211325608debd19b0e7
                                                                                                                                                                                                      • Instruction ID: d749d17306166952b18a3f7a40743e5d4d539800c31903ae925bcb827c574b5e
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 7bfc696592b003d8a6b238063e783ff3189b4dca7eb8d211325608debd19b0e7
                                                                                                                                                                                                      • Instruction Fuzzy Hash: EEF0C231700150EBCB10EB9AD895B4E7398DB95356F50453BF980CB263C63CCC0ACA6E
                                                                                                                                                                                                      Function 004836A8 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 39registryCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                        • Part of subcall function 0042DE1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,004836C7,?,00000001,?,?,004836C7,?,00000001,00000000), ref: 0042DE38
                                                                                                                                                                                                      • RegQueryValueExA.ADVAPI32(?,CSDVersion,00000000,?,?,?,?,00000001,00000000), ref: 004836E9
                                                                                                                                                                                                      • RegCloseKey.ADVAPI32(?,?,CSDVersion,00000000,?,?,?,?,00000001,00000000), ref: 0048370C
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      • CSDVersion, xrefs: 004836E0
                                                                                                                                                                                                      • System\CurrentControlSet\Control\Windows, xrefs: 004836B6
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CloseOpenQueryValue
                                                                                                                                                                                                      • String ID: CSDVersion$System\CurrentControlSet\Control\Windows
                                                                                                                                                                                                      • API String ID: 3677997916-1910633163
                                                                                                                                                                                                      • Opcode ID: ac38c0a6fddcdff28a20f47b1b449cf76bf4b895b686ccae82cf61b3a02b2cad
                                                                                                                                                                                                      • Instruction ID: e2e1efa57e06e253ed5c33608a99233e6d60fcd3e82f395225068b7938859aaf
                                                                                                                                                                                                      • Opcode Fuzzy Hash: ac38c0a6fddcdff28a20f47b1b449cf76bf4b895b686ccae82cf61b3a02b2cad
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 07F036F5A40209B6DF10EBD1CC45B9F77FC9B04B05F108567E910E7280E678DB048B59
                                                                                                                                                                                                      Function 0042D8F0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 27libraryloaderCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetModuleHandleA.KERNEL32(kernel32.dll,GetSystemWow64DirectoryA,?,00453B5A,00000000,00453BFD,?,?,00000000,00000000,00000000,00000000,00000000,?,00453FED,00000000), ref: 0042D90A
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0042D910
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: AddressHandleModuleProc
                                                                                                                                                                                                      • String ID: GetSystemWow64DirectoryA$kernel32.dll
                                                                                                                                                                                                      • API String ID: 1646373207-4063490227
                                                                                                                                                                                                      • Opcode ID: 3965e48138ab8598cb17ff311cd558fd433aca8a834515e354a81fb776e31baf
                                                                                                                                                                                                      • Instruction ID: 657275fb9dfacbe144619f02b172540cf2f0c5a6f4252bec6bd03a25d2dd35a2
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 3965e48138ab8598cb17ff311cd558fd433aca8a834515e354a81fb776e31baf
                                                                                                                                                                                                      • Instruction Fuzzy Hash: A5E0DFE0B40B0122D70032BA1C82B6B108D4B84728F90053B3894E62D6DDBCD9840A6D
                                                                                                                                                                                                      Function 0042EB54 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 23libraryloaderCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetModuleHandleA.KERNEL32(user32.dll,ShutdownBlockReasonDestroy,?,00000000,0042EAD0), ref: 0042EB62
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0042EB68
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: AddressHandleModuleProc
                                                                                                                                                                                                      • String ID: ShutdownBlockReasonDestroy$user32.dll
                                                                                                                                                                                                      • API String ID: 1646373207-260599015
                                                                                                                                                                                                      • Opcode ID: 88ce12e330a2fc51ece58c284b54de3a76b504cb94a4c995bd1a3fb2c6ea0693
                                                                                                                                                                                                      • Instruction ID: e1ec077e445c8734ae54db5ffdd633522f5c412f0b7fee52e54de0d29bb4c321
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 88ce12e330a2fc51ece58c284b54de3a76b504cb94a4c995bd1a3fb2c6ea0693
                                                                                                                                                                                                      • Instruction Fuzzy Hash: A2D0C793311732665D10B1F73CD1EAB058C891527935404B7F515E5641D55DEC1115AD
                                                                                                                                                                                                      Function 0044F744 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 16libraryloaderCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetModuleHandleA.KERNEL32(user32.dll,NotifyWinEvent,00498762), ref: 0044F77F
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0044F785
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: AddressHandleModuleProc
                                                                                                                                                                                                      • String ID: NotifyWinEvent$user32.dll
                                                                                                                                                                                                      • API String ID: 1646373207-597752486
                                                                                                                                                                                                      • Opcode ID: f97c3de5cacafbf63d36e16939e29d51eb7e912e87a0fb2b79f6fc39cd446e20
                                                                                                                                                                                                      • Instruction ID: 5e946f17392c81a4f172a46fe169fb9a1f72c9003761a5edf28bd31acc2f1150
                                                                                                                                                                                                      • Opcode Fuzzy Hash: f97c3de5cacafbf63d36e16939e29d51eb7e912e87a0fb2b79f6fc39cd446e20
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 59E012F0E417049AFF00BBB57B86B1A3A90E764719B00057FF414A6292DB7C481C4F9D
                                                                                                                                                                                                      Function 004984D8 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 9libraryloaderCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetModuleHandleA.KERNEL32(user32.dll,DisableProcessWindowsGhosting,004987B8,00000001,00000000,004987DC), ref: 004984E2
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,user32.dll), ref: 004984E8
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: AddressHandleModuleProc
                                                                                                                                                                                                      • String ID: DisableProcessWindowsGhosting$user32.dll
                                                                                                                                                                                                      • API String ID: 1646373207-834958232
                                                                                                                                                                                                      • Opcode ID: 0a6869f336692cffb72a3d37b5043cace6ddfe1b26e102b83d1b95de8ab3ca94
                                                                                                                                                                                                      • Instruction ID: 53974a48addda20669242eeec291eced9f9b3ea586a0102388b68221815f3be9
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 0a6869f336692cffb72a3d37b5043cace6ddfe1b26e102b83d1b95de8ab3ca94
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 8EB092C0280703689C8032BA0C02F1F08484C4272CB10003F3810A40C7ED6CDC00083D
                                                                                                                                                                                                      Function 00464468 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 8libraryloaderCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                        • Part of subcall function 0044B658: LoadLibraryA.KERNEL32(uxtheme.dll,?,0044F775,00498762), ref: 0044B67F
                                                                                                                                                                                                        • Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,OpenThemeData), ref: 0044B697
                                                                                                                                                                                                        • Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,CloseThemeData), ref: 0044B6A9
                                                                                                                                                                                                        • Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,DrawThemeBackground), ref: 0044B6BB
                                                                                                                                                                                                        • Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,DrawThemeText), ref: 0044B6CD
                                                                                                                                                                                                        • Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,GetThemeBackgroundContentRect), ref: 0044B6DF
                                                                                                                                                                                                        • Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,GetThemeBackgroundContentRect), ref: 0044B6F1
                                                                                                                                                                                                        • Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,GetThemePartSize), ref: 0044B703
                                                                                                                                                                                                        • Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,GetThemeTextExtent), ref: 0044B715
                                                                                                                                                                                                        • Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,GetThemeTextMetrics), ref: 0044B727
                                                                                                                                                                                                        • Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,GetThemeBackgroundRegion), ref: 0044B739
                                                                                                                                                                                                        • Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,HitTestThemeBackground), ref: 0044B74B
                                                                                                                                                                                                        • Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,DrawThemeEdge), ref: 0044B75D
                                                                                                                                                                                                        • Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,DrawThemeIcon), ref: 0044B76F
                                                                                                                                                                                                        • Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,IsThemePartDefined), ref: 0044B781
                                                                                                                                                                                                        • Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,IsThemeBackgroundPartiallyTransparent), ref: 0044B793
                                                                                                                                                                                                        • Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,GetThemeColor), ref: 0044B7A5
                                                                                                                                                                                                        • Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,GetThemeMetric), ref: 0044B7B7
                                                                                                                                                                                                      • LoadLibraryA.KERNEL32(shell32.dll,SHPathPrepareForWriteA,0049878A), ref: 00464477
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,shell32.dll), ref: 0046447D
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: AddressProc$LibraryLoad
                                                                                                                                                                                                      • String ID: SHPathPrepareForWriteA$shell32.dll
                                                                                                                                                                                                      • API String ID: 2238633743-2683653824
                                                                                                                                                                                                      • Opcode ID: 43e9449c42c64eafa185df201a3e78782dc27b2a49daecccd0491a4bbbb3dbf6
                                                                                                                                                                                                      • Instruction ID: aee408708d02c77079155b2370532760acd370d0883c3ae68736bebce920fed0
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 43e9449c42c64eafa185df201a3e78782dc27b2a49daecccd0491a4bbbb3dbf6
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 73B09290681740A8CA007BB2289BB0F2A4894B072E7A2463B7008710C6EF7C84204A6E
                                                                                                                                                                                                      Function 0047D16C Relevance: 6.2, APIs: 4, Instructions: 195fileCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • FindNextFileA.KERNEL32(000000FF,?,00000000,0047D2E0,?,?,?,?,00000000,0047D435,?,?,?,00000000,?,0047D544), ref: 0047D2BC
                                                                                                                                                                                                      • FindClose.KERNEL32(000000FF,0047D2E7,0047D2E0,?,?,?,?,00000000,0047D435,?,?,?,00000000,?,0047D544,00000000), ref: 0047D2DA
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Find$CloseFileNext
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 2066263336-0
                                                                                                                                                                                                      • Opcode ID: 1bb33653f71372efa694325d8d6b641fbfb84b71fff8fb7ce2a7bf965ad77fdb
                                                                                                                                                                                                      • Instruction ID: 813c4c7e096b0537259228c6ce98783779beb739e450e2ccca0bb42f0b61749a
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 1bb33653f71372efa694325d8d6b641fbfb84b71fff8fb7ce2a7bf965ad77fdb
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 6A813B30D0024D9FDF11DFA5C845ADFBBB9EF49304F5080EAE808A3292D639AA46CF55
                                                                                                                                                                                                      Function 00475420 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 114COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                        • Part of subcall function 0042EE30: GetTickCount.KERNEL32 ref: 0042EE36
                                                                                                                                                                                                        • Part of subcall function 0042EC88: MoveFileExA.KERNEL32(00000000,00000000,00000001(MOVEFILE_REPLACE_EXISTING)), ref: 0042ECBD
                                                                                                                                                                                                      • GetLastError.KERNEL32(00000000,00475595,?,?,0049C1DC,00000000), ref: 0047547E
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CountErrorFileLastMoveTick
                                                                                                                                                                                                      • String ID: $LoggedMsgBox returned an unexpected value. Assuming Cancel.$MoveFileEx
                                                                                                                                                                                                      • API String ID: 2406187244-2685451598
                                                                                                                                                                                                      • Opcode ID: 4ffc49a1bca9248947b89d41c066e74b90e1b7b3b53b81dc03e4593538e7a596
                                                                                                                                                                                                      • Instruction ID: cb6e190203de8706f01eb9277cb95c8d8a5d25c2e0fbb05709c61410d89611bd
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 4ffc49a1bca9248947b89d41c066e74b90e1b7b3b53b81dc03e4593538e7a596
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 9E41B770A006099BCB10EFA5D882AEE77B5EF48314F608537E404BB355D7789A418BAD
                                                                                                                                                                                                      Function 00413CF8 Relevance: 6.1, APIs: 4, Instructions: 107COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetDesktopWindow.USER32 ref: 00413D46
                                                                                                                                                                                                      • GetDesktopWindow.USER32 ref: 00413DFE
                                                                                                                                                                                                        • Part of subcall function 00418EC0: 6FA0C6F0.COMCTL32(?,00000000,00413FC3,00000000,004140D3,?,?,0049B628), ref: 00418EDC
                                                                                                                                                                                                        • Part of subcall function 00418EC0: ShowCursor.USER32(00000001,?,00000000,00413FC3,00000000,004140D3,?,?,0049B628), ref: 00418EF9
                                                                                                                                                                                                      • SetCursor.USER32(00000000,?,?,?,?,00413AF3,00000000,00413B06), ref: 00413E3C
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CursorDesktopWindow$Show
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 2074268717-0
                                                                                                                                                                                                      • Opcode ID: 48e3412c1a46991eea637d4b1b247886da5b7466a2ee9d80c19fa9edf3c8b710
                                                                                                                                                                                                      • Instruction ID: d0219f8535474b9b7e790bb207accfb6dce16a9ac66decbe361331da1304c66b
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 48e3412c1a46991eea637d4b1b247886da5b7466a2ee9d80c19fa9edf3c8b710
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 91412C75600210AFC710DF2AFA84B56B7E1EB65329B16817BE405CB365DB38DD81CF98
                                                                                                                                                                                                      Function 00408A54 Relevance: 6.1, APIs: 4, Instructions: 95windowCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetModuleFileNameA.KERNEL32(00400000,?,00000100), ref: 00408A75
                                                                                                                                                                                                      • LoadStringA.USER32(00400000,0000FF9E,?,00000040), ref: 00408AE4
                                                                                                                                                                                                      • LoadStringA.USER32(00400000,0000FF9F,?,00000040), ref: 00408B7F
                                                                                                                                                                                                      • MessageBoxA.USER32(00000000,?,?,00002010), ref: 00408BBE
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: LoadString$FileMessageModuleName
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 704749118-0
                                                                                                                                                                                                      • Opcode ID: ede814ba8b2c905ab74f80468cae56b5ab65d73ed59c96bbcc76a4520df8398d
                                                                                                                                                                                                      • Instruction ID: 7d65b0a5aa49ad722f3f3263bbe29e3330acee4661d9e2153cfe083702b22da2
                                                                                                                                                                                                      • Opcode Fuzzy Hash: ede814ba8b2c905ab74f80468cae56b5ab65d73ed59c96bbcc76a4520df8398d
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 1F3123716083849AD370EB65C945BDF77D89B85704F40483FB6C8E72D1EB7859048B6B
                                                                                                                                                                                                      Function 0044E8C4 Relevance: 6.1, APIs: 4, Instructions: 83windowCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • SendMessageA.USER32(00000000,000001A1,?,00000000), ref: 0044E90D
                                                                                                                                                                                                        • Part of subcall function 0044CF50: SendMessageA.USER32(00000000,000001A0,?,00000000), ref: 0044CF82
                                                                                                                                                                                                      • InvalidateRect.USER32(00000000,00000000,00000001,00000000,000001A1,?,00000000), ref: 0044E991
                                                                                                                                                                                                        • Part of subcall function 0042BBB4: SendMessageA.USER32(00000000,0000018E,00000000,00000000), ref: 0042BBC8
                                                                                                                                                                                                      • IsRectEmpty.USER32(?), ref: 0044E953
                                                                                                                                                                                                      • ScrollWindowEx.USER32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000006), ref: 0044E976
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: MessageSend$Rect$EmptyInvalidateScrollWindow
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 855768636-0
                                                                                                                                                                                                      • Opcode ID: e9e3cf1fe88063870224b64a3ffaafaa7ea9294743723d0f52b5b35edb71e9c8
                                                                                                                                                                                                      • Instruction ID: f7bad605b8f68185b4e834990bb8ca2287257270a928060092b59a923d315d7c
                                                                                                                                                                                                      • Opcode Fuzzy Hash: e9e3cf1fe88063870224b64a3ffaafaa7ea9294743723d0f52b5b35edb71e9c8
                                                                                                                                                                                                      • Instruction Fuzzy Hash: E5114A71B0030067E650BA7B8C86B5B76C9AB88748F15083FB545EB387DE7DDD094299
                                                                                                                                                                                                      Function 00495494 Relevance: 6.1, APIs: 4, Instructions: 81COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • OffsetRect.USER32(?,?,00000000), ref: 004954F8
                                                                                                                                                                                                      • OffsetRect.USER32(?,00000000,?), ref: 00495513
                                                                                                                                                                                                      • OffsetRect.USER32(?,?,00000000), ref: 0049552D
                                                                                                                                                                                                      • OffsetRect.USER32(?,00000000,?), ref: 00495548
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: OffsetRect
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 177026234-0
                                                                                                                                                                                                      • Opcode ID: 189e9286564265d853a06d191ff0450012ffb6c3854856ebd751307d5f0fca29
                                                                                                                                                                                                      • Instruction ID: 0cb6fc954a72117405a3be1f948335ff5a15e1e1cf1cb616ea1ff77106a83dd0
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 189e9286564265d853a06d191ff0450012ffb6c3854856ebd751307d5f0fca29
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 372181B6700601AFCB00DE69CD85E6B77DAEBC4344F248A2AF944C7249D638ED448755
                                                                                                                                                                                                      Function 00417218 Relevance: 6.1, APIs: 4, Instructions: 72COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetCursorPos.USER32 ref: 00417260
                                                                                                                                                                                                      • SetCursor.USER32(00000000), ref: 004172A3
                                                                                                                                                                                                      • GetLastActivePopup.USER32(?), ref: 004172CD
                                                                                                                                                                                                      • GetForegroundWindow.USER32(?), ref: 004172D4
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Cursor$ActiveForegroundLastPopupWindow
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 1959210111-0
                                                                                                                                                                                                      • Opcode ID: 91e518c38a31ca7625fb588aad7019b4c9de7d4d342085b92a126d71c6fd930d
                                                                                                                                                                                                      • Instruction ID: de3f0dc6b436800086b9427ec8ddd2ec86eeedce3a35093462374e80c8eda50e
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 91e518c38a31ca7625fb588aad7019b4c9de7d4d342085b92a126d71c6fd930d
                                                                                                                                                                                                      • Instruction Fuzzy Hash: C52183313086118AD720AFA9E945AE733F1EF44754B0544ABF8558B352DB3DDC82CB9E
                                                                                                                                                                                                      Function 0049514C Relevance: 6.1, APIs: 4, Instructions: 59COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • MulDiv.KERNEL32(?,00000008,?), ref: 00495161
                                                                                                                                                                                                      • MulDiv.KERNEL32(?,00000008,?), ref: 00495175
                                                                                                                                                                                                      • MulDiv.KERNEL32(?,00000008,?), ref: 00495189
                                                                                                                                                                                                      • MulDiv.KERNEL32(?,00000008,?), ref: 004951A7
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                                      • Opcode ID: b0bc83cb44cddb6cfb83e9cff79c84a8c4632dee95d4fc6912c32f85648e17c5
                                                                                                                                                                                                      • Instruction ID: ece1589fda812a565620013fcb1ed5a997ef569cae5724ba48b6fbd062de1f9b
                                                                                                                                                                                                      • Opcode Fuzzy Hash: b0bc83cb44cddb6cfb83e9cff79c84a8c4632dee95d4fc6912c32f85648e17c5
                                                                                                                                                                                                      • Instruction Fuzzy Hash: E8115172A05104AFCB40DEA9D8C5E8B7BECEF4D320B24416AF908DB346D634EC408BA4
                                                                                                                                                                                                      Function 0041F480 Relevance: 6.1, APIs: 4, Instructions: 56registryCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetClassInfoA.USER32(00400000,0041F470,?), ref: 0041F4A1
                                                                                                                                                                                                      • UnregisterClassA.USER32(0041F470,00400000), ref: 0041F4CA
                                                                                                                                                                                                      • RegisterClassA.USER32(00499598), ref: 0041F4D4
                                                                                                                                                                                                      • SetWindowLongA.USER32(00000000,000000FC,00000000), ref: 0041F50F
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Class$InfoLongRegisterUnregisterWindow
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 4025006896-0
                                                                                                                                                                                                      • Opcode ID: 7a514111b6068dfbbdb04c48d1a2146d17cf63cab41d43eccfd0167b2dbd8d5c
                                                                                                                                                                                                      • Instruction ID: 7a0dc659497f48f9aad4428a0df7724adcaf244520b53866b591a9b3b5545ee4
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 7a514111b6068dfbbdb04c48d1a2146d17cf63cab41d43eccfd0167b2dbd8d5c
                                                                                                                                                                                                      • Instruction Fuzzy Hash: F6011B72240104AADA10EBACED81E9B33999729314B11423BB615E72A2D6399C558BAC
                                                                                                                                                                                                      Function 0040D010 Relevance: 6.1, APIs: 4, Instructions: 51COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • FindResourceA.KERNEL32(00400000,?,00000000), ref: 0040D027
                                                                                                                                                                                                      • LoadResource.KERNEL32(00400000,72756F73,0040A7C8,00400000,00000001,00000000,?,0040CF84,00000000,?,00000000,?,?,0047C648,0000000A,00000000), ref: 0040D041
                                                                                                                                                                                                      • SizeofResource.KERNEL32(00400000,72756F73,00400000,72756F73,0040A7C8,00400000,00000001,00000000,?,0040CF84,00000000,?,00000000,?,?,0047C648), ref: 0040D05B
                                                                                                                                                                                                      • LockResource.KERNEL32(74536563,00000000,00400000,72756F73,00400000,72756F73,0040A7C8,00400000,00000001,00000000,?,0040CF84,00000000,?,00000000,?), ref: 0040D065
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Resource$FindLoadLockSizeof
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 3473537107-0
                                                                                                                                                                                                      • Opcode ID: f701ce4f04cb0ebdd1143b5585c75acb70ffd029a82b31343d3be87257736b7b
                                                                                                                                                                                                      • Instruction ID: ce77ce8360aa458f47a01e9b0563465317cd85cc21d7bcd45488e041df035c61
                                                                                                                                                                                                      • Opcode Fuzzy Hash: f701ce4f04cb0ebdd1143b5585c75acb70ffd029a82b31343d3be87257736b7b
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 49F04F726056046F9B14EE59A881D5B77ECDE88268310013AF908E7286DA38DD018B68
                                                                                                                                                                                                      Function 004019CC Relevance: 6.0, APIs: 4, Instructions: 48memoryCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • RtlInitializeCriticalSection.KERNEL32(0049B420,00000000,00401A82,?,?,0040222E,021D84D4,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 004019E2
                                                                                                                                                                                                      • RtlEnterCriticalSection.KERNEL32(0049B420,0049B420,00000000,00401A82,?,?,0040222E,021D84D4,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 004019F5
                                                                                                                                                                                                      • LocalAlloc.KERNEL32(00000000,00000FF8,0049B420,00000000,00401A82,?,?,0040222E,021D84D4,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 00401A1F
                                                                                                                                                                                                      • RtlLeaveCriticalSection.KERNEL32(0049B420,00401A89,00000000,00401A82,?,?,0040222E,021D84D4,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 00401A7C
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CriticalSection$AllocEnterInitializeLeaveLocal
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 730355536-0
                                                                                                                                                                                                      • Opcode ID: 0971dfa849a4ffc4cae04a3e1ff9e59bd0eaa306d87ad714f1f0155365df5b79
                                                                                                                                                                                                      • Instruction ID: 91310e2de28581c92a9b529d79901d52005bdf0b1253609ef7109df0d78d257f
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 0971dfa849a4ffc4cae04a3e1ff9e59bd0eaa306d87ad714f1f0155365df5b79
                                                                                                                                                                                                      • Instruction Fuzzy Hash: D001A1706482409EE719AB69BA467253FD4D795B48F11803BF840A6BF3C77C4440EBAD
                                                                                                                                                                                                      Function 00470414 Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 41COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetLastError.KERNEL32(?,00000000), ref: 00470465
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      • Unsetting NTFS compression on file: %s, xrefs: 0047044B
                                                                                                                                                                                                      • Setting NTFS compression on file: %s, xrefs: 00470433
                                                                                                                                                                                                      • Failed to set NTFS compression state (%d)., xrefs: 00470476
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: ErrorLast
                                                                                                                                                                                                      • String ID: Failed to set NTFS compression state (%d).$Setting NTFS compression on file: %s$Unsetting NTFS compression on file: %s
                                                                                                                                                                                                      • API String ID: 1452528299-3038984924
                                                                                                                                                                                                      • Opcode ID: 9040784ae72163802a56a0e87c3d1011300904a9d3e4aa7b771e9079db376fcb
                                                                                                                                                                                                      • Instruction ID: 5508092d392c29e30f7e419f1558a5efa53bd64671fa73d33ea5aa8feab5f6e0
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 9040784ae72163802a56a0e87c3d1011300904a9d3e4aa7b771e9079db376fcb
                                                                                                                                                                                                      • Instruction Fuzzy Hash: CA016730E1924896CB14D7AD54812EDBBF49F49308F44C1EFA55DE7382DA781A08879A
                                                                                                                                                                                                      Function 0046FC68 Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 41COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetLastError.KERNEL32(00000000,00000000), ref: 0046FCB9
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      • Failed to set NTFS compression state (%d)., xrefs: 0046FCCA
                                                                                                                                                                                                      • Unsetting NTFS compression on directory: %s, xrefs: 0046FC9F
                                                                                                                                                                                                      • Setting NTFS compression on directory: %s, xrefs: 0046FC87
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: ErrorLast
                                                                                                                                                                                                      • String ID: Failed to set NTFS compression state (%d).$Setting NTFS compression on directory: %s$Unsetting NTFS compression on directory: %s
                                                                                                                                                                                                      • API String ID: 1452528299-1392080489
                                                                                                                                                                                                      • Opcode ID: 5c813659b9ce42f7edadfe38bb11ec1456057053b7eed776f741b2efd26d76a6
                                                                                                                                                                                                      • Instruction ID: 966577c707f49859c08c22ad5a588f09726d737875f6d95343439a3241496ead
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 5c813659b9ce42f7edadfe38bb11ec1456057053b7eed776f741b2efd26d76a6
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 55011720D1824C56CB14D7AD74812DDBBB4AF49314F54C1BFA899E7342EB791A0C879B
                                                                                                                                                                                                      Function 00455D9C Relevance: 6.0, APIs: 4, Instructions: 41registrywindowCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                        • Part of subcall function 0042DE1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,004836C7,?,00000001,?,?,004836C7,?,00000001,00000000), ref: 0042DE38
                                                                                                                                                                                                      • RegDeleteValueA.ADVAPI32(?,00000000,00000082,00000002,00000000,?,?,00000000,0045B5FE,?,?,?,?,?,00000000,0045B625), ref: 00455DD8
                                                                                                                                                                                                      • RegCloseKey.ADVAPI32(00000000,?,00000000,00000082,00000002,00000000,?,?,00000000,0045B5FE,?,?,?,?,?,00000000), ref: 00455DE1
                                                                                                                                                                                                      • RemoveFontResourceA.GDI32(00000000), ref: 00455DEE
                                                                                                                                                                                                      • SendNotifyMessageA.USER32(0000FFFF,0000001D,00000000,00000000), ref: 00455E02
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CloseDeleteFontMessageNotifyOpenRemoveResourceSendValue
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 4283692357-0
                                                                                                                                                                                                      • Opcode ID: 876c7f592335f26f534d3a610f48d9a4b9bf1bdf8c7f8d73d654af2b8de839a9
                                                                                                                                                                                                      • Instruction ID: 71ccc6c4ad223293e5fa71c014565a1ca4f3f808124b73c5b0663eb55104ffd2
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 876c7f592335f26f534d3a610f48d9a4b9bf1bdf8c7f8d73d654af2b8de839a9
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 57F0BEB174070036EA10B6BAAC4BF2B26CC8F54745F10883ABA00EF2C3D97CDC04962D
                                                                                                                                                                                                      Function 00477D24 Relevance: 6.0, APIs: 4, Instructions: 31COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetCurrentProcess.KERNEL32(00000008,?,?,?,00000001,00000000,00000002,00000000,00480DAC,?,?,?,?,?,0049884B,00000000), ref: 00477D2D
                                                                                                                                                                                                      • OpenProcessToken.ADVAPI32(00000000,00000008,?,?,?,00000001,00000000,00000002,00000000,00480DAC,?,?,?,?,?,0049884B), ref: 00477D33
                                                                                                                                                                                                      • GetTokenInformation.ADVAPI32(00000008,00000012(TokenIntegrityLevel),00000000,00000004,00000008,00000000,00000008,?,?,?,00000001,00000000,00000002,00000000,00480DAC), ref: 00477D55
                                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000,00000008,TokenIntegrityLevel,00000000,00000004,00000008,00000000,00000008,?,?,?,00000001,00000000,00000002,00000000,00480DAC), ref: 00477D66
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: ProcessToken$CloseCurrentHandleInformationOpen
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 215268677-0
                                                                                                                                                                                                      • Opcode ID: 3a93110a626b43f3eadaa74cf541c0290f0e8f026231ea58c1b57ecd76d8e3ea
                                                                                                                                                                                                      • Instruction ID: 7d1e0899fa26f13c2a6683c6024d2156ea27cbafc883e2ae306b9283f9cebe78
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 3a93110a626b43f3eadaa74cf541c0290f0e8f026231ea58c1b57ecd76d8e3ea
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 85F037616447007BD610E6B58C81E6B73DCEF44754F04893A7E94C72C1D678D8089726
                                                                                                                                                                                                      Function 00424240 Relevance: 6.0, APIs: 4, Instructions: 26windowCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetLastActivePopup.USER32(?), ref: 0042424C
                                                                                                                                                                                                      • IsWindowVisible.USER32(?), ref: 0042425D
                                                                                                                                                                                                      • IsWindowEnabled.USER32(?), ref: 00424267
                                                                                                                                                                                                      • SetForegroundWindow.USER32(?), ref: 00424271
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Window$ActiveEnabledForegroundLastPopupVisible
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 2280970139-0
                                                                                                                                                                                                      • Opcode ID: f5eb756bdd9929eb0187d31ee3fb53ef02cbc66ad04bc69917a7cf098bede398
                                                                                                                                                                                                      • Instruction ID: 2c5ff33fc315f6eb6fab431e1453bcb0e66c5aaaa6596e28cc8dc28fd0b03a53
                                                                                                                                                                                                      • Opcode Fuzzy Hash: f5eb756bdd9929eb0187d31ee3fb53ef02cbc66ad04bc69917a7cf098bede398
                                                                                                                                                                                                      • Instruction Fuzzy Hash: C7E0EC61B02672D6AE31FA7B2881A9F518C9D45BE434641EBBC04FB38ADB2CDC1141BD
                                                                                                                                                                                                      Function 0040626C Relevance: 6.0, APIs: 4, Instructions: 11memoryCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GlobalHandle.KERNEL32 ref: 0040626F
                                                                                                                                                                                                      • GlobalUnlock.KERNEL32(00000000), ref: 00406276
                                                                                                                                                                                                      • GlobalReAlloc.KERNEL32(00000000,00000000), ref: 0040627B
                                                                                                                                                                                                      • GlobalLock.KERNEL32(00000000), ref: 00406281
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Global$AllocHandleLockUnlock
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 2167344118-0
                                                                                                                                                                                                      • Opcode ID: cbc5b304f88c7a08b053d0b09bd11fc9f2d944e51c7d356257a26bde9ab667b0
                                                                                                                                                                                                      • Instruction ID: 5df08fd8dc2b017785a639aa93036e57be915985ffe03f20f856cac12e18577c
                                                                                                                                                                                                      • Opcode Fuzzy Hash: cbc5b304f88c7a08b053d0b09bd11fc9f2d944e51c7d356257a26bde9ab667b0
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 0BB009C4810A01BEEC0473B24C0BE3F245CD88172C3904A6F3448BA183987C9C405A3A
                                                                                                                                                                                                      Function 00479D3C Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 210registryCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • RegCloseKey.ADVAPI32(?,?,?,?,00000001,00000000,00000000,0047B625,?,00000000,00000000,00000001,00000000,00479FD9,?,00000000), ref: 00479F9D
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      • Failed to parse "reg" constant, xrefs: 00479FA4
                                                                                                                                                                                                      • Cannot access a 64-bit key in a "reg" constant on this version of Windows, xrefs: 00479E11
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Close
                                                                                                                                                                                                      • String ID: Cannot access a 64-bit key in a "reg" constant on this version of Windows$Failed to parse "reg" constant
                                                                                                                                                                                                      • API String ID: 3535843008-1938159461
                                                                                                                                                                                                      • Opcode ID: 16d8054e143327fe44f194470e69b7b3affe626307b8d2e4c87d8a967639857b
                                                                                                                                                                                                      • Instruction ID: 47cfa27444033e2517bbb80e4c41b37ce2323e10df06c4a21d1f595548a21c80
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 16d8054e143327fe44f194470e69b7b3affe626307b8d2e4c87d8a967639857b
                                                                                                                                                                                                      • Instruction Fuzzy Hash: EB814F74E00108AFCB10EFA5D881ADEBBF9EF49314F50816AE814E7391D7389E45CB98
                                                                                                                                                                                                      Function 0046CA80 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 89COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      • Failed to proceed to next wizard page; showing wizard., xrefs: 0046CBAC
                                                                                                                                                                                                      • Failed to proceed to next wizard page; aborting., xrefs: 0046CB98
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                      • String ID: Failed to proceed to next wizard page; aborting.$Failed to proceed to next wizard page; showing wizard.
                                                                                                                                                                                                      • API String ID: 0-1974262853
                                                                                                                                                                                                      • Opcode ID: 5c21498a53a12cfa8e7fd6d0fca4a53d4e4662c611673a7e38899ae354c5c1cd
                                                                                                                                                                                                      • Instruction ID: f767aec7694c3a706269651ece3f491ea64dc64c3ef09eb99a1787ebd09846f2
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 5c21498a53a12cfa8e7fd6d0fca4a53d4e4662c611673a7e38899ae354c5c1cd
                                                                                                                                                                                                      • Instruction Fuzzy Hash: A7317230604204DFD711EB99D5C6BA977E5AB05704F5500BBE048AB392D778BE40CB5E
                                                                                                                                                                                                      Function 004789B8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 86registryCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                        • Part of subcall function 0042DE1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,004836C7,?,00000001,?,?,004836C7,?,00000001,00000000), ref: 0042DE38
                                                                                                                                                                                                      • RegCloseKey.ADVAPI32(?,00478A9E,?,?,00000001,00000000,00000000,00478AB9), ref: 00478A87
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      • Software\Microsoft\Windows\CurrentVersion\Uninstall, xrefs: 00478A12
                                                                                                                                                                                                      • %s\%s_is1, xrefs: 00478A30
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CloseOpen
                                                                                                                                                                                                      • String ID: %s\%s_is1$Software\Microsoft\Windows\CurrentVersion\Uninstall
                                                                                                                                                                                                      • API String ID: 47109696-1598650737
                                                                                                                                                                                                      • Opcode ID: cbbb33293de64dd8a9f9caa67a5b3cda024617d485473e40b666104571127f40
                                                                                                                                                                                                      • Instruction ID: dc80809357616fc60b3df9076f922e914a3229883baf2cade8178dd1eb90c67d
                                                                                                                                                                                                      • Opcode Fuzzy Hash: cbbb33293de64dd8a9f9caa67a5b3cda024617d485473e40b666104571127f40
                                                                                                                                                                                                      • Instruction Fuzzy Hash: C2218170B042446FDB01DFA9CC55ADEBBE8EB88304F90847BE508E7381DA789D01CB59
                                                                                                                                                                                                      Function 00450168 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 78windowCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • SendMessageA.USER32(00000000,0000044B,00000000,?), ref: 004501FD
                                                                                                                                                                                                      • ShellExecuteA.SHELL32(00000000,open,00000000,00000000,00000000,00000001), ref: 0045022E
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: ExecuteMessageSendShell
                                                                                                                                                                                                      • String ID: open
                                                                                                                                                                                                      • API String ID: 812272486-2758837156
                                                                                                                                                                                                      • Opcode ID: ea446b968c091deb5619fe0c64f284e9fafe3e6cb185d1fb8701354efc215884
                                                                                                                                                                                                      • Instruction ID: 7f57506e0c07b49dd0b520b237e7736b759e9f4ed638734fb0c833ac5abbff07
                                                                                                                                                                                                      • Opcode Fuzzy Hash: ea446b968c091deb5619fe0c64f284e9fafe3e6cb185d1fb8701354efc215884
                                                                                                                                                                                                      • Instruction Fuzzy Hash: A1216074E00204AFDB10DFA9C896B9EBBF8EB44705F1081BAB404E7292D678DE45CA59
                                                                                                                                                                                                      Function 00402584 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • RtlEnterCriticalSection.KERNEL32(0049B420,00000000,)), ref: 004025C7
                                                                                                                                                                                                      • RtlLeaveCriticalSection.KERNEL32(0049B420,0040263D), ref: 00402630
                                                                                                                                                                                                        • Part of subcall function 004019CC: RtlInitializeCriticalSection.KERNEL32(0049B420,00000000,00401A82,?,?,0040222E,021D84D4,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 004019E2
                                                                                                                                                                                                        • Part of subcall function 004019CC: RtlEnterCriticalSection.KERNEL32(0049B420,0049B420,00000000,00401A82,?,?,0040222E,021D84D4,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 004019F5
                                                                                                                                                                                                        • Part of subcall function 004019CC: LocalAlloc.KERNEL32(00000000,00000FF8,0049B420,00000000,00401A82,?,?,0040222E,021D84D4,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 00401A1F
                                                                                                                                                                                                        • Part of subcall function 004019CC: RtlLeaveCriticalSection.KERNEL32(0049B420,00401A89,00000000,00401A82,?,?,0040222E,021D84D4,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 00401A7C
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CriticalSection$EnterLeave$AllocInitializeLocal
                                                                                                                                                                                                      • String ID: )
                                                                                                                                                                                                      • API String ID: 2227675388-1084416617
                                                                                                                                                                                                      • Opcode ID: 09cf32ac568926239da630a480ec85c7fe0e44c3c7351229851fbcf18ccaddb2
                                                                                                                                                                                                      • Instruction ID: 77bd95ba853a3ee3b707a504883d316aad751082ca23ba06a0d8aa2ba3da16af
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 09cf32ac568926239da630a480ec85c7fe0e44c3c7351229851fbcf18ccaddb2
                                                                                                                                                                                                      • Instruction Fuzzy Hash: E11104317042046FEB15AB796F5962B6AD4D795758B24087FF404F33D2DABD8C02929C
                                                                                                                                                                                                      Function 0049669E Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 66COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000097), ref: 004966D9
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Window
                                                                                                                                                                                                      • String ID: /INITPROCWND=$%x $@
                                                                                                                                                                                                      • API String ID: 2353593579-4169826103
                                                                                                                                                                                                      • Opcode ID: b4f4c19a8bc55ff90c2e9b73843465f76c245e37ca3079c0cf601615490e7546
                                                                                                                                                                                                      • Instruction ID: 2823dcf8e8ddb1ccfa98fa5e384fb34ae0e14248cce506d77a4005fc3c11fa4c
                                                                                                                                                                                                      • Opcode Fuzzy Hash: b4f4c19a8bc55ff90c2e9b73843465f76c245e37ca3079c0cf601615490e7546
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 4711A531A042089FDF01DFA4D851BAE7FE8EB48318F5144BBE504E7291DB7C9905C658
                                                                                                                                                                                                      Function 00447414 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 64COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                        • Part of subcall function 00403CA4: MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000400), ref: 00403CDE
                                                                                                                                                                                                        • Part of subcall function 00403CA4: SysAllocStringLen.OLEAUT32(?,00000000), ref: 00403CE9
                                                                                                                                                                                                      • SysFreeString.OLEAUT32(?), ref: 004474C6
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: String$AllocByteCharFreeMultiWide
                                                                                                                                                                                                      • String ID: NIL Interface Exception$Unknown Method
                                                                                                                                                                                                      • API String ID: 3952431833-1023667238
                                                                                                                                                                                                      • Opcode ID: 4f43f2048f3271615f10b1acac82c539bd88d3f79065c454e3b767f871ffd8a8
                                                                                                                                                                                                      • Instruction ID: eb0132878ffe7144b3db707554455947565e11d0cdd4dc78092451a8fec87e99
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 4f43f2048f3271615f10b1acac82c539bd88d3f79065c454e3b767f871ffd8a8
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 8011B9706082089FEB10DFA58C52A6EBBBCEB09704F91407AF504F7681D77C9D01CB69
                                                                                                                                                                                                      Function 00495F10 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59processCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,000000FC,?,00495FD8,?,00495FCC,00000000,00495FB3), ref: 00495F7E
                                                                                                                                                                                                      • CloseHandle.KERNEL32(00496018,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,000000FC,?,00495FD8,?,00495FCC,00000000), ref: 00495F95
                                                                                                                                                                                                        • Part of subcall function 00495E68: GetLastError.KERNEL32(00000000,00495F00,?,?,?,?), ref: 00495E8C
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CloseCreateErrorHandleLastProcess
                                                                                                                                                                                                      • String ID: D
                                                                                                                                                                                                      • API String ID: 3798668922-2746444292
                                                                                                                                                                                                      • Opcode ID: 2cac3968973140c3bf288dcd51b8fea51afb9ccec72b099e887b62547fa5ce6a
                                                                                                                                                                                                      • Instruction ID: f27f12c2402a3b04c6ef5f500e2c30b4f6e8a0b8f5398e8f95c33b3eb070371b
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 2cac3968973140c3bf288dcd51b8fea51afb9ccec72b099e887b62547fa5ce6a
                                                                                                                                                                                                      • Instruction Fuzzy Hash: FC015EB1644648AFDF05DBA2DD42E9EBBACDB08714F61003AF904E72C5D6789E048B68
                                                                                                                                                                                                      Function 0042DD64 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56registryCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • RegQueryValueExA.ADVAPI32(?,Inno Setup: No Icons,00000000,00000000,00000000,00000000), ref: 0042DD78
                                                                                                                                                                                                      • RegEnumValueA.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000,?,Inno Setup: No Icons,00000000,00000000,00000000), ref: 0042DDB8
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Value$EnumQuery
                                                                                                                                                                                                      • String ID: Inno Setup: No Icons
                                                                                                                                                                                                      • API String ID: 1576479698-2016326496
                                                                                                                                                                                                      • Opcode ID: 961f39f434988a41e2ccb6005e0c2b113ae21886c7545b5cb0c067107fc7e7ed
                                                                                                                                                                                                      • Instruction ID: 8d080c6700cf8453afd411d185ff7d2dd707f59376968ad674d2e7d16536e1ed
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 961f39f434988a41e2ccb6005e0c2b113ae21886c7545b5cb0c067107fc7e7ed
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 1B012B33B55B7179FB3045256D01F7B57889B82B60F64013BF942EA2C0D6999C04936E
                                                                                                                                                                                                      Function 004973D4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 43COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                        • Part of subcall function 004555E4: GetCurrentProcess.KERNEL32(00000028), ref: 004555F3
                                                                                                                                                                                                        • Part of subcall function 004555E4: OpenProcessToken.ADVAPI32(00000000,00000028), ref: 004555F9
                                                                                                                                                                                                      • SetForegroundWindow.USER32(?), ref: 00497406
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      • Restarting Windows., xrefs: 004973E3
                                                                                                                                                                                                      • Not restarting Windows because Uninstall is being run from the debugger., xrefs: 00497431
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Process$CurrentForegroundOpenTokenWindow
                                                                                                                                                                                                      • String ID: Not restarting Windows because Uninstall is being run from the debugger.$Restarting Windows.
                                                                                                                                                                                                      • API String ID: 3179053593-4147564754
                                                                                                                                                                                                      • Opcode ID: 4193847a8af397455179383c4cf3c5e93af51966d3aee1b0e62b09f4ca4c6cf6
                                                                                                                                                                                                      • Instruction ID: 81a48865aaf16d48f947dda4b05133a8651c2c420a775bb83d5095b98b759fde
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 4193847a8af397455179383c4cf3c5e93af51966d3aee1b0e62b09f4ca4c6cf6
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 1C01B5B0618244AAEB01FB66E992B983F989B44308F80407BF5446B2D3C73C994AC75D
                                                                                                                                                                                                      Function 00497B74 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                        • Part of subcall function 0047CBBC: FreeLibrary.KERNEL32(00000000,00481513), ref: 0047CBD2
                                                                                                                                                                                                        • Part of subcall function 0047C88C: GetTickCount.KERNEL32 ref: 0047C8D6
                                                                                                                                                                                                        • Part of subcall function 004570E0: SendMessageA.USER32(00000000,00000B01,00000000,00000000), ref: 004570FF
                                                                                                                                                                                                      • GetCurrentProcess.KERNEL32(00000001,?,?,?,?,004984CB), ref: 00497BC9
                                                                                                                                                                                                      • TerminateProcess.KERNEL32(00000000,00000001,?,?,?,?,004984CB), ref: 00497BCF
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      • Detected restart. Removing temporary directory., xrefs: 00497B83
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Process$CountCurrentFreeLibraryMessageSendTerminateTick
                                                                                                                                                                                                      • String ID: Detected restart. Removing temporary directory.
                                                                                                                                                                                                      • API String ID: 1717587489-3199836293
                                                                                                                                                                                                      • Opcode ID: edd495a3eb806bce708dfd09f75f47a0044e32d2cd5383a21bd3adb2a5963435
                                                                                                                                                                                                      • Instruction ID: d50bc6c630895905583a3a2fadab6dc9590d78cbbd3fad9bb3e23ee4b0713a5b
                                                                                                                                                                                                      • Opcode Fuzzy Hash: edd495a3eb806bce708dfd09f75f47a0044e32d2cd5383a21bd3adb2a5963435
                                                                                                                                                                                                      • Instruction Fuzzy Hash: C8E0E57221C7042EDA1177B7BC62A573F8CD74576C761447FF90881992C42D6810C67D
                                                                                                                                                                                                      Function 00455674 Relevance: 5.0, APIs: 4, Instructions: 45sleepCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.2682686175.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682588019.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2682955217.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683001592.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683105539.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.2683286489.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_iDentalSoftBridgeSetup_12.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: ErrorLastSleep
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 1458359878-0
                                                                                                                                                                                                      • Opcode ID: 7798a5e799e1e244a54c6bcb5719b9525f3608fd5ab78f1f7778d7f0ef8e9fed
                                                                                                                                                                                                      • Instruction ID: f31041694d7e6b08a2ea33ec2b58b28b25921f40701f973673b956735a8b67d8
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 7798a5e799e1e244a54c6bcb5719b9525f3608fd5ab78f1f7778d7f0ef8e9fed
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 42F02B32705F58A78B21B56A889157FB2A8DB81366750012BFC0CD7313C878CC058BBC

                                                                                                                                                                                                      Execution Graph

                                                                                                                                                                                                      Execution Coverage:22.6%
                                                                                                                                                                                                      Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                                                      Signature Coverage:0.5%
                                                                                                                                                                                                      Total number of Nodes:1371
                                                                                                                                                                                                      Total number of Limit Nodes:45
                                                                                                                                                                                                      execution_graph 3176 401000 memset GetModuleHandleA HeapCreate 3177 401044 3176->3177 3469 4089c0 HeapCreate RtlAllocateHeap 3177->3469 3179 401049 3470 407220 3179->3470 3189 401067 3486 4065d8 3189->3486 3195 401076 3503 404310 HeapCreate 3195->3503 3197 401080 3504 403954 3197->3504 3199 401085 3509 40367d 3199->3509 3201 40108a 3512 40451b 3201->3512 3207 4010ce 3531 404340 3207->3531 3209 4010d8 GetUserDefaultLangID VerLanguageNameA 3534 404360 3209->3534 3211 401118 3538 4030c0 3211->3538 3213 401126 3544 4031f0 3213->3544 3217 40113e 3551 4043b0 HeapFree 3217->3551 3219 401149 3220 401160 3219->3220 3221 401235 3219->3221 3673 403068 3220->3673 3222 403068 4 API calls 3221->3222 3224 401245 3222->3224 3226 403068 4 API calls 3224->3226 3228 401255 3226->3228 3227 403068 4 API calls 3229 401180 3227->3229 3230 403068 4 API calls 3228->3230 3231 403068 4 API calls 3229->3231 3232 401265 3230->3232 3233 401190 3231->3233 3235 403068 4 API calls 3232->3235 3234 403068 4 API calls 3233->3234 3236 4011a0 3234->3236 3237 401275 3235->3237 3238 403068 4 API calls 3236->3238 3239 403068 4 API calls 3237->3239 3240 4011b0 3238->3240 3241 401285 3239->3241 3242 403068 4 API calls 3240->3242 3243 403068 4 API calls 3241->3243 3245 4011c0 3242->3245 3244 401295 3243->3244 3246 403068 4 API calls 3244->3246 3247 403068 4 API calls 3245->3247 3248 4012a5 3246->3248 3249 4011d0 3247->3249 3250 403068 4 API calls 3248->3250 3251 403068 4 API calls 3249->3251 3252 4012b5 3250->3252 3253 4011e0 3251->3253 3254 403068 4 API calls 3252->3254 3255 403068 4 API calls 3253->3255 3256 4012c5 3254->3256 3257 4011f0 3255->3257 3258 403068 4 API calls 3256->3258 3259 403068 4 API calls 3257->3259 3260 4012d5 3258->3260 3261 401200 3259->3261 3262 403068 4 API calls 3260->3262 3263 403068 4 API calls 3261->3263 3264 4012e5 3262->3264 3265 401210 3263->3265 3267 403068 4 API calls 3264->3267 3266 403068 4 API calls 3265->3266 3268 401220 3266->3268 3269 4012f5 3267->3269 3270 403068 4 API calls 3268->3270 3271 403068 4 API calls 3269->3271 3272 401230 3270->3272 3271->3272 3552 404227 GetVersionExA 3272->3552 3275 401311 3676 40368b 3275->3676 3276 40132c 3557 4040c0 3276->3557 3279 401338 3563 403a92 3279->3563 3282 401bcd ExitProcess HeapDestroy ExitProcess 3283 4013d3 3567 4020bb 3283->3567 3286 4013e7 3574 401c0b 3286->3574 3287 4013fe 3290 40368b 16 API calls 3287->3290 3291 401327 3290->3291 3291->3282 3293 408a10 2 API calls 3294 401390 PathQuoteSpacesA 3293->3294 3295 408ac0 2 API calls 3294->3295 3304 40135b 3295->3304 3296 4020bb 6 API calls 3297 40142e 3296->3297 3298 401432 3297->3298 3299 401456 3297->3299 3300 404360 RtlReAllocateHeap 3298->3300 3301 40368b 16 API calls 3299->3301 3303 40144a 3300->3303 3301->3291 3302 408ac0 strlen RtlReAllocateHeap 3302->3304 3305 408a10 2 API calls 3303->3305 3304->3283 3304->3293 3304->3302 3306 408a10 2 API calls 3304->3306 3683 403a44 3304->3683 3307 401454 3305->3307 3306->3304 3308 4020bb 6 API calls 3307->3308 3309 401486 3308->3309 3310 4014aa 3309->3310 3311 40148a 3309->3311 3312 40368b 16 API calls 3310->3312 3313 4020bb 6 API calls 3311->3313 3312->3291 3314 4014da 3313->3314 3315 4020bb 6 API calls 3314->3315 3316 40150c 3315->3316 3317 4020bb 6 API calls 3316->3317 3318 40153e 3317->3318 3319 401793 3318->3319 3689 405481 3318->3689 3320 404360 RtlReAllocateHeap 3319->3320 3323 4017ab 3320->3323 3325 408a10 2 API calls 3323->3325 3327 4017b5 3325->3327 3329 404360 RtlReAllocateHeap 3327->3329 3331 4017cd 3329->3331 3332 408a10 2 API calls 3331->3332 3334 4017d7 3332->3334 3336 4020bb 6 API calls 3334->3336 3338 4017e7 3336->3338 3340 401a3c 3338->3340 3342 403a44 3 API calls 3338->3342 3608 408ac0 3340->3608 3344 401800 3342->3344 3347 404360 RtlReAllocateHeap 3344->3347 3345 401a4d 3348 408ac0 2 API calls 3345->3348 3353 40181e 3347->3353 3349 401a57 3348->3349 3351 408ac0 2 API calls 3349->3351 3350 40160c RemoveDirectoryA 3350->3282 3352 401a62 3351->3352 3355 408a10 2 API calls 3352->3355 3353->3340 3361 401855 3353->3361 3354 4015fc 3354->3350 3357 401640 3354->3357 3360 401687 3354->3360 3720 405706 3354->3720 3356 401a6c 3355->3356 3612 407360 3356->3612 3723 404c42 3357->3723 3365 404c42 4 API calls 3360->3365 3782 406fb6 3361->3782 3364 401651 3370 408a10 2 API calls 3364->3370 3366 401698 3365->3366 3371 408a10 2 API calls 3366->3371 3367 401868 3786 4036e1 3367->3786 3368 401a80 3615 4073a0 3368->3615 3369 401a9c 3375 407081 DeleteFileA 3369->3375 3374 40165b 3370->3374 3376 4016a2 3371->3376 3729 404fa3 3374->3729 3380 401aa7 3375->3380 3381 404fa3 13 API calls 3376->3381 3377 401883 3382 408a10 2 API calls 3377->3382 3378 401a90 3622 4071b0 3378->3622 3385 40202f 6 API calls 3380->3385 3384 401665 3381->3384 3391 40188d 3382->3391 3386 4016b8 3384->3386 3387 401aac 3385->3387 3747 407c10 3386->3747 3388 40368b 16 API calls 3387->3388 3389 401ac2 RemoveDirectoryA 3388->3389 3389->3282 3390 401a9a 3394 401af1 3390->3394 3398 402122 52 API calls 3390->3398 3392 4019ec 3391->3392 3396 408ac0 2 API calls 3391->3396 3395 403aa5 4 API calls 3392->3395 3400 408ac0 2 API calls 3394->3400 3399 401a05 3395->3399 3401 4018b1 3396->3401 3398->3394 3403 406ff6 2 API calls 3399->3403 3404 401b13 3400->3404 3405 408a10 2 API calls 3401->3405 3402 404360 RtlReAllocateHeap 3406 4016f4 3402->3406 3407 401a13 3403->3407 3408 408ac0 2 API calls 3404->3408 3419 4018bb 3405->3419 3411 40173a 3406->3411 3412 40170f 3406->3412 3409 407071 SetCurrentDirectoryA 3407->3409 3410 401b1e 3408->3410 3413 401a21 RemoveDirectoryA 3409->3413 3630 403f4a 3410->3630 3416 4020bb 6 API calls 3411->3416 3415 40368b 16 API calls 3412->3415 3413->3282 3421 401725 RemoveDirectoryA 3415->3421 3423 40174a 3416->3423 3418 4018d5 3854 407380 3418->3854 3419->3418 3807 402122 3419->3807 3421->3282 3753 401d66 3423->3753 3427 4019be 3431 407360 9 API calls 3427->3431 3430 4071b0 5 API calls 3433 4018f7 3430->3433 3434 4019ce 3431->3434 3432 401b5a 3637 403fb0 CloseHandle 3432->3637 3437 408ac0 2 API calls 3433->3437 3434->3392 3440 4073a0 6 API calls 3434->3440 3436 401b6a 3650 40202f 3436->3650 3439 401913 3437->3439 3442 408ac0 2 API calls 3439->3442 3443 4019e2 3440->3443 3446 40191d 3442->3446 3444 4071b0 5 API calls 3443->3444 3444->3392 3448 408ac0 2 API calls 3446->3448 3450 401928 3448->3450 3452 408ac0 2 API calls 3450->3452 3451 401b93 3664 406ff6 3451->3664 3454 401932 3452->3454 3456 408ac0 2 API calls 3454->3456 3457 40193d 3456->3457 3459 40368b 16 API calls 3457->3459 3461 401958 3459->3461 3461->3427 3462 40196e 3461->3462 3463 403aa5 4 API calls 3462->3463 3464 401987 3463->3464 3465 406ff6 2 API calls 3464->3465 3466 401995 3465->3466 3467 407071 SetCurrentDirectoryA 3466->3467 3468 4019a3 RemoveDirectoryA 3467->3468 3468->3282 3469->3179 3857 407642 RtlAllocateHeap RtlAllocateHeap 3470->3857 3472 401053 3473 40677c LoadLibraryA 3472->3473 3474 40679e GetProcAddress 3473->3474 3475 4067af GetVersionExA 3473->3475 3474->3475 3477 4067ce 3475->3477 3476 401058 3479 406688 3476->3479 3477->3476 3858 4066c3 LoadLibraryA 3477->3858 3868 407692 RtlAllocateHeap 3479->3868 3482 406674 3870 407642 RtlAllocateHeap RtlAllocateHeap 3482->3870 3484 401062 3485 4065ef TlsAlloc 3484->3485 3485->3189 3487 407692 RtlAllocateHeap 3486->3487 3488 40106c 3487->3488 3489 405131 3488->3489 3871 407642 RtlAllocateHeap RtlAllocateHeap 3489->3871 3491 40513f 3492 407692 RtlAllocateHeap 3491->3492 3493 405152 LoadIconA LoadCursorA 3492->3493 3494 40572c 3493->3494 3495 407692 RtlAllocateHeap 3494->3495 3496 401071 3495->3496 3497 40472b RtlInitializeCriticalSection GetStockObject 3496->3497 3872 407642 RtlAllocateHeap RtlAllocateHeap 3497->3872 3499 404756 3500 407692 RtlAllocateHeap 3499->3500 3501 40476c memset 3500->3501 3502 404799 3501->3502 3502->3195 3503->3197 3505 407692 RtlAllocateHeap 3504->3505 3506 40395f 3505->3506 3873 407642 RtlAllocateHeap RtlAllocateHeap 3506->3873 3508 403972 RtlInitializeCriticalSection 3508->3199 3510 4098fb 3509->3510 3511 403682 CoInitialize 3510->3511 3511->3201 3513 401095 3512->3513 3514 404527 3512->3514 3521 404470 RtlAllocateHeap 3513->3521 3874 4046a0 3514->3874 3518 404536 3519 404558 HeapFree 3518->3519 3520 40454c HeapFree 3518->3520 3519->3513 3520->3519 3522 40448f RtlAllocateHeap 3521->3522 3523 4044a2 3521->3523 3522->3523 3896 4076ba RtlAllocateHeap 3523->3896 3526 408817 3898 4088c7 3526->3898 3529 408846 memset 3530 408883 3529->3530 3530->3207 3532 404348 RtlAllocateHeap 3531->3532 3533 40435a 3531->3533 3532->3209 3533->3209 3535 40436a 3534->3535 3904 408c90 3535->3904 3537 404377 3537->3211 3539 4030cd 3538->3539 3540 408c90 RtlReAllocateHeap 3539->3540 3542 4030e2 3540->3542 3541 403119 3541->3213 3542->3541 3542->3542 3543 40310c CharLowerA 3542->3543 3543->3213 3907 403130 3544->3907 3546 401134 3547 408a10 3546->3547 3548 408a43 RtlReAllocateHeap 3547->3548 3549 408a27 RtlAllocateHeap 3547->3549 3550 408a64 3548->3550 3549->3550 3550->3217 3551->3219 3553 404253 3552->3553 3554 40130a 3552->3554 3553->3554 3555 404264 GetVersionExA 3553->3555 3554->3275 3554->3276 3556 40427d 3555->3556 3556->3554 3558 4040e0 3557->3558 3559 4040e8 3558->3559 3560 40410a SetUnhandledExceptionFilter 3558->3560 3561 4040f1 SetUnhandledExceptionFilter 3559->3561 3562 4040fb SetUnhandledExceptionFilter 3559->3562 3560->3279 3561->3562 3562->3279 3564 403a9d 3563->3564 3911 403983 3564->3911 3916 403060 3567->3916 3570 4020e8 LoadResource SizeofResource 3571 40210c 3570->3571 3572 408b20 HeapFree 3571->3572 3573 4013e3 3572->3573 3573->3286 3573->3287 3575 404340 RtlAllocateHeap 3574->3575 3576 401c1b 3575->3576 3922 407093 3576->3922 3578 401c2a 3579 408a10 2 API calls 3578->3579 3580 401c34 GetTempFileNameA 3579->3580 3929 4043d0 3580->3929 3583 408a10 2 API calls 3584 401c64 3583->3584 3935 4043b0 HeapFree 3584->3935 3586 401c6c 3587 407081 DeleteFileA 3586->3587 3588 401c77 3587->3588 3936 4070f4 3588->3936 3591 406fb6 2 API calls 3592 401c8e 3591->3592 3593 408a10 2 API calls 3592->3593 3594 401c98 3593->3594 3595 401cec 3594->3595 3596 401cbc PathQuoteSpacesA 3594->3596 3602 401d07 3594->3602 3597 408ac0 2 API calls 3595->3597 3598 408ac0 2 API calls 3596->3598 3599 401cfd 3597->3599 3600 401cd7 3598->3600 3601 408a10 2 API calls 3599->3601 3603 408ac0 2 API calls 3600->3603 3601->3602 3605 408b20 HeapFree 3602->3605 3604 401ce2 3603->3604 3607 408a10 2 API calls 3604->3607 3606 4013fc 3605->3606 3606->3296 3607->3595 3609 408acf strlen 3608->3609 3611 408aee 3608->3611 3610 408c90 RtlReAllocateHeap 3609->3610 3610->3611 3611->3345 3941 407240 3612->3941 3614 401a7c 3614->3368 3614->3369 3616 4073b0 3615->3616 3617 4073e8 3615->3617 3616->3617 3618 4073f0 3616->3618 3619 4073d5 3616->3619 3617->3378 3618->3618 3620 4073f9 WriteFile 3618->3620 3619->3619 3974 407480 3619->3974 3620->3378 3623 407202 3622->3623 3624 4071ba 3622->3624 3623->3390 3624->3623 3625 4071d3 3624->3625 3626 4071ec CloseHandle 3624->3626 3627 407170 WriteFile 3625->3627 3628 40760c 2 API calls 3626->3628 3629 4071d9 HeapFree 3627->3629 3628->3623 3629->3626 3988 403b37 memset 3630->3988 3632 401b39 3633 403f84 3632->3633 4059 403f64 3633->4059 3636 403f92 GetExitCodeProcess 3636->3432 3638 403fc7 CloseHandle 3637->3638 3639 403fca 3637->3639 3638->3639 3640 403fd1 CloseHandle 3639->3640 3641 403fd4 3639->3641 3640->3641 3642 403fdb CloseHandle 3641->3642 3643 403fde 3641->3643 3642->3643 3644 403ff6 3643->3644 3645 403feb HeapFree 3643->3645 3646 404008 RtlEnterCriticalSection 3644->3646 3647 403ffd HeapFree 3644->3647 3645->3644 3648 407bc4 HeapFree 3646->3648 3647->3646 3649 40401f RtlLeaveCriticalSection 3648->3649 3649->3436 3651 401b6f 3650->3651 3652 40203c 3650->3652 3656 407081 3651->3656 3652->3651 3654 402067 3652->3654 3654->3652 3655 407081 DeleteFileA 3654->3655 4062 407d10 3654->4062 3655->3654 3657 407088 DeleteFileA 3656->3657 3658 401b7a 3656->3658 3657->3658 3659 403aa5 3658->3659 3660 408c90 RtlReAllocateHeap 3659->3660 3661 403ab7 GetModuleFileNameA strcmp 3660->3661 3662 403ada memmove 3661->3662 3663 403aee 3661->3663 3662->3663 3663->3451 3667 407006 3664->3667 3665 408c90 RtlReAllocateHeap 3666 407043 3665->3666 3668 401ba1 3666->3668 3669 407057 strncpy 3666->3669 3667->3665 3670 407071 3668->3670 3669->3668 3671 407078 SetCurrentDirectoryA 3670->3671 3672 401baf RemoveDirectoryA 3670->3672 3671->3672 3672->3282 4070 408ba0 3673->4070 3675 401170 3675->3227 4077 4038a1 3676->4077 3681 4038a1 12 API calls 3682 4036b4 3681->3682 3682->3291 3684 403a57 3683->3684 3685 403983 GetCommandLineA 3684->3685 3686 403a6c 3685->3686 3687 408c90 RtlReAllocateHeap 3686->3687 3688 403a7a strncpy 3687->3688 3688->3304 4095 405181 3689->4095 3691 40156f 3692 404908 3691->3692 4133 40481a 3692->4133 3695 4049e2 3696 4049f3 3695->3696 3697 404a03 memset 3696->3697 3698 404a56 CreateWindowExA 3696->3698 3697->3698 3700 404aa6 3698->3700 3704 4015bb 3698->3704 3701 40757d 2 API calls 3700->3701 3702 404ab4 SetWindowLongA 3701->3702 3703 404e01 4 API calls 3702->3703 3703->3704 3705 404be7 3704->3705 4147 404b24 3705->4147 3708 4054a4 3713 4054be 3708->3713 3709 4015f2 3716 404c07 3709->3716 3710 40552a RtlAllocateHeap 3712 40553c 3710->3712 3711 40554d RtlReAllocateHeap 3711->3712 3714 4055a1 DestroyAcceleratorTable 3712->3714 3715 4055a8 CreateAcceleratorTableA 3712->3715 3713->3709 3713->3710 3713->3711 3713->3712 3714->3715 3715->3709 3719 404c0e 3716->3719 3717 404c39 SetFocus 3718 404c32 3717->3718 3718->3354 3719->3717 3719->3718 4157 4055bf 3720->4157 3724 404c52 3723->3724 3725 404c62 3724->3725 3726 404c6b GetWindowTextLengthA 3724->3726 3725->3364 3727 408c90 RtlReAllocateHeap 3726->3727 3728 404c81 GetWindowTextA strlen 3727->3728 3728->3725 3730 404fbb 3729->3730 3731 404fc5 GetWindow 3730->3731 3732 40508c 3730->3732 3733 404fe0 RemovePropA RemovePropA 3731->3733 3734 404fd3 3731->3734 3732->3384 3736 405006 3733->3736 3737 404ffe RevokeDragDrop 3733->3737 3734->3733 3735 404fd9 SetActiveWindow 3734->3735 3735->3733 3738 40500d SendMessageA 3736->3738 3739 40501f sprintf UnregisterClassA 3736->3739 3737->3736 3740 405051 3738->3740 3739->3740 3742 405070 3740->3742 3743 405058 HeapFree DestroyAcceleratorTable 3740->3743 3744 405077 DeleteObject 3742->3744 3745 40507e 3742->3745 3743->3742 3744->3745 3746 40760c 2 API calls 3745->3746 3746->3732 3748 407c1d 3747->3748 4172 408760 3748->4172 3750 407c40 3751 408c90 RtlReAllocateHeap 3750->3751 3752 4016d6 3751->3752 3752->3402 3754 401d6e 3753->3754 3754->3754 3755 403060 2 API calls 3754->3755 3756 401d87 3755->3756 3757 408817 4 API calls 3756->3757 3758 401da5 3757->3758 3759 408817 4 API calls 3758->3759 3760 401dc3 3759->3760 3761 408817 4 API calls 3760->3761 3762 401de1 3761->3762 4175 4024b0 3762->4175 3765 4024b0 6 API calls 3766 401e05 3765->3766 3767 4024b0 6 API calls 3766->3767 3780 401e19 3767->3780 3768 401f9b 3769 408b20 HeapFree 3768->3769 3770 402009 3769->3770 3771 4088c7 2 API calls 3770->3771 3772 402013 3771->3772 3773 4088c7 2 API calls 3772->3773 3775 40201c 3773->3775 3774 404340 RtlAllocateHeap 3774->3780 3776 4088c7 2 API calls 3775->3776 3778 402025 3776->3778 3777 401f66 RemoveDirectoryA 3779 40368b 16 API calls 3777->3779 3778->3319 3779->3780 3780->3768 3780->3774 3780->3777 4189 404440 3780->4189 3783 408c90 RtlReAllocateHeap 3782->3783 3784 406fc8 GetCurrentDirectoryA 3783->3784 3785 406fd8 3784->3785 3785->3367 3787 4036f6 CoInitialize 3786->3787 3788 403707 memset LoadLibraryA 3786->3788 3787->3788 3789 403820 3788->3789 3790 403734 GetProcAddress GetProcAddress 3788->3790 3793 408c90 RtlReAllocateHeap 3789->3793 3791 403758 3790->3791 3792 40375f strncpy strlen 3790->3792 3791->3792 3794 40378a 3792->3794 3797 403829 3793->3797 3795 4038f9 3 API calls 3794->3795 3796 4037a3 3795->3796 3798 4038a1 12 API calls 3796->3798 3797->3377 3799 4037c4 3798->3799 3800 4038a1 12 API calls 3799->3800 3802 4037d4 3800->3802 3801 403811 FreeLibrary 3801->3789 3801->3797 3802->3801 3803 408c90 RtlReAllocateHeap 3802->3803 3804 4037e2 CoTaskMemFree strlen 3803->3804 3804->3801 3806 403808 3804->3806 3806->3801 3808 402129 3807->3808 3808->3808 3809 403060 2 API calls 3808->3809 3810 402142 3809->3810 3811 407071 SetCurrentDirectoryA 3810->3811 3815 402155 3811->3815 3813 408a10 RtlAllocateHeap RtlReAllocateHeap 3813->3815 3814 408ac0 2 API calls 3814->3815 3815->3813 3815->3814 3850 4021e5 3815->3850 4196 403240 3815->4196 3816 4023b7 4216 403660 3816->4216 3819 4031f0 RtlReAllocateHeap 3821 4023e7 3819->3821 3820 407380 9 API calls 3820->3850 3822 402478 3821->3822 3824 408ac0 2 API calls 3821->3824 3825 408b20 HeapFree 3822->3825 3823 407360 9 API calls 3823->3850 3826 40241d 3824->3826 3827 40248d 3825->3827 3828 408ac0 2 API calls 3826->3828 3830 408b20 HeapFree 3827->3830 3831 402427 3828->3831 3832 402496 3830->3832 3833 408ac0 2 API calls 3831->3833 3836 408b20 HeapFree 3832->3836 3834 402430 3833->3834 3838 408ac0 2 API calls 3834->3838 3835 4071b0 WriteFile HeapFree CloseHandle memset HeapFree 3835->3850 3837 40249f 3836->3837 3839 408b20 HeapFree 3837->3839 3840 40243a 3838->3840 3842 4024a8 3839->3842 3843 408ac0 2 API calls 3840->3843 3842->3418 3846 402445 3843->3846 3844 408ac0 strlen RtlReAllocateHeap 3844->3850 3845 408a10 RtlAllocateHeap RtlReAllocateHeap 3845->3850 3847 40368b 16 API calls 3846->3847 3848 402460 3847->3848 3848->3822 3852 40202f 6 API calls 3848->3852 3849 40368b 16 API calls 3849->3850 3850->3816 3850->3820 3850->3822 3850->3823 3850->3835 3850->3844 3850->3845 3850->3849 3851 407d10 5 API calls 3850->3851 3853 40202f 6 API calls 3850->3853 4205 407420 3850->4205 4212 4045bb 3850->4212 3851->3850 3852->3822 3853->3850 3855 407240 9 API calls 3854->3855 3856 4018e5 3855->3856 3856->3427 3856->3430 3857->3472 3859 4066f0 GetProcAddress 3858->3859 3860 406738 LoadLibraryA 3858->3860 3863 406731 FreeLibrary 3859->3863 3864 4066ff memset 3859->3864 3861 406774 3860->3861 3862 406745 GetProcAddress 3860->3862 3861->3476 3865 40676d FreeLibrary 3862->3865 3867 406751 3862->3867 3863->3860 3866 40671d 3864->3866 3865->3861 3866->3863 3867->3865 3869 40105d 3868->3869 3869->3482 3870->3484 3871->3491 3872->3499 3873->3508 3875 4046c5 3874->3875 3879 4046b0 3874->3879 3888 40781c 3875->3888 3879->3875 3883 409716 3879->3883 3880 40786c 3881 40781c 2 API calls 3880->3881 3882 407875 HeapFree 3881->3882 3882->3518 3884 4097e0 3883->3884 3887 40972c 3883->3887 3884->3879 3885 409716 HeapFree 3885->3887 3887->3884 3887->3885 3893 408b20 3887->3893 3889 407833 HeapFree 3888->3889 3890 407845 3888->3890 3889->3889 3889->3890 3891 40784b HeapFree 3890->3891 3892 40452e 3890->3892 3891->3891 3891->3892 3892->3880 3894 408b2b HeapFree 3893->3894 3895 408b3e 3893->3895 3894->3895 3895->3887 3897 4010b0 3896->3897 3897->3526 3899 4088d0 3898->3899 3900 408827 RtlAllocateHeap 3898->3900 3901 4088f9 HeapFree 3899->3901 3902 4088f7 3899->3902 3903 409716 HeapFree 3899->3903 3900->3529 3900->3530 3901->3900 3902->3901 3903->3899 3905 408ce2 3904->3905 3906 408caf RtlReAllocateHeap 3904->3906 3905->3537 3906->3905 3908 403141 3907->3908 3908->3908 3909 408c90 RtlReAllocateHeap 3908->3909 3910 4031b8 3909->3910 3910->3546 3915 40768b 3911->3915 3913 403995 GetCommandLineA 3914 40133d GetModuleHandleA 3913->3914 3914->3283 3914->3304 3915->3913 3919 408b50 3916->3919 3918 4020cb FindResourceA 3918->3570 3918->3571 3920 408b97 3919->3920 3921 408b5a strlen RtlAllocateHeap 3919->3921 3920->3918 3921->3920 3923 408c90 RtlReAllocateHeap 3922->3923 3924 4070a6 GetTempPathA LoadLibraryA 3923->3924 3925 4070e1 3924->3925 3926 4070c3 GetProcAddress 3924->3926 3925->3578 3927 4070d3 GetLongPathNameA 3926->3927 3928 4070da FreeLibrary 3926->3928 3927->3928 3928->3925 3931 4043dd 3929->3931 3930 408c90 RtlReAllocateHeap 3932 4043fa 3930->3932 3931->3930 3933 404400 memcpy 3932->3933 3934 401c5a 3932->3934 3933->3934 3934->3583 3935->3586 3937 407103 strncpy strlen 3936->3937 3938 401c82 3936->3938 3939 407133 CreateDirectoryA 3937->3939 3938->3591 3939->3938 3957 40757d 3941->3957 3944 407261 CreateFileA 3946 4072dc 3944->3946 3945 40727d 3947 407282 CreateFileA 3945->3947 3948 40729f 3945->3948 3950 407336 3946->3950 3953 4072eb 3946->3953 3947->3946 3948->3946 3949 4072a4 CreateFileA 3948->3949 3949->3946 3952 4072c6 CreateFileA 3949->3952 3951 40734a 3950->3951 3963 40760c 3950->3963 3951->3614 3952->3946 3955 4072f4 RtlAllocateHeap 3953->3955 3956 407308 3953->3956 3955->3956 3956->3614 3958 407587 3957->3958 3959 40759e 3957->3959 3969 407b97 RtlAllocateHeap 3958->3969 3960 4075a8 RtlReAllocateHeap 3959->3960 3962 40725a 3959->3962 3960->3962 3962->3944 3962->3945 3964 407633 3963->3964 3965 407618 3963->3965 3971 407bc4 3964->3971 3965->3964 3966 40761d memset 3965->3966 3968 40763d 3966->3968 3968->3951 3970 407bad 3969->3970 3970->3962 3972 407bd5 HeapFree 3971->3972 3972->3968 3975 4074b5 3974->3975 3976 407495 SetFilePointer 3974->3976 3977 4074c0 3975->3977 3978 40752e 3975->3978 3976->3975 3979 4074f3 3977->3979 3982 4074d9 memcpy 3977->3982 3985 407170 3978->3985 3979->3617 3982->3617 3983 40755b memcpy 3983->3617 3984 40753b WriteFile 3984->3617 3986 407181 WriteFile 3985->3986 3987 4071a5 3985->3987 3986->3987 3987->3983 3987->3984 3989 403b95 3988->3989 3990 403bbe 3989->3990 3992 403bd7 CreatePipe 3989->3992 3991 403c7c 3990->3991 3993 403c1b CreatePipe 3990->3993 3994 403c4e 3990->3994 3995 403cb6 strlen strlen RtlAllocateHeap 3991->3995 3999 403c97 GetStdHandle 3991->3999 4000 403c9e 3991->4000 3992->3990 3996 403bee 3992->3996 3993->3994 3997 403c32 3993->3997 3994->3991 3998 403c54 CreatePipe 3994->3998 4010 403cfa _mbscpy _mbscat _mbscat 3995->4010 4011 403d1d _mbscpy 3995->4011 4001 403b00 4 API calls 3996->4001 4004 403b00 4 API calls 3997->4004 3998->3991 4006 403c6b 3998->4006 3999->4000 4002 403ca3 GetStdHandle 4000->4002 4003 403caa 4000->4003 4007 403bff 4001->4007 4002->4003 4003->3995 4008 403caf GetStdHandle 4003->4008 4009 403c43 4004->4009 4056 403b00 GetCurrentProcess GetCurrentProcess DuplicateHandle 4006->4056 4007->3990 4008->3995 4009->3994 4013 403d26 4010->4013 4011->4013 4014 403d46 CreateProcessA 4013->4014 4015 403d2d _mbscat _mbscat 4013->4015 4017 403d80 4014->4017 4018 403e08 4014->4018 4015->4014 4019 403d85 CloseHandle 4017->4019 4020 403d8a 4017->4020 4021 403e12 4018->4021 4022 403e0d CloseHandle 4018->4022 4019->4020 4025 403d94 4020->4025 4026 403d8f CloseHandle 4020->4026 4023 403e17 CloseHandle 4021->4023 4024 403e1c 4021->4024 4022->4021 4023->4024 4027 403e21 CloseHandle 4024->4027 4028 403e26 4024->4028 4029 403d99 CloseHandle 4025->4029 4030 403d9e CloseHandle 4025->4030 4026->4025 4027->4028 4031 403e30 4028->4031 4032 403e2b CloseHandle 4028->4032 4029->4030 4033 403db4 4030->4033 4034 403da9 WaitForSingleObject 4030->4034 4035 403e35 CloseHandle 4031->4035 4036 403e3a 4031->4036 4032->4031 4037 403db9 RtlEnterCriticalSection 4033->4037 4038 403dfe CloseHandle 4033->4038 4034->4033 4035->4036 4039 403e44 4036->4039 4040 403e3f CloseHandle 4036->4040 4041 407b97 RtlAllocateHeap 4037->4041 4042 403f18 4038->4042 4043 403f2d HeapFree 4039->4043 4045 403e53 strlen 4039->4045 4046 403e87 memset ShellExecuteEx 4039->4046 4040->4039 4044 403dd1 RtlLeaveCriticalSection 4041->4044 4042->4043 4043->3632 4044->4042 4045->4046 4048 403e62 4045->4048 4046->4043 4047 403ecd 4046->4047 4049 403ed3 WaitForSingleObject 4047->4049 4050 403ede 4047->4050 4048->4046 4053 403e70 _mbscpy 4048->4053 4049->4050 4051 403ee3 RtlEnterCriticalSection 4050->4051 4052 403f1d CloseHandle 4050->4052 4054 407b97 RtlAllocateHeap 4051->4054 4052->4042 4053->4046 4055 403efb RtlLeaveCriticalSection 4054->4055 4055->4042 4057 403b35 4056->4057 4058 403b28 CloseHandle 4056->4058 4057->3991 4058->4057 4060 403f6c WaitForSingleObject 4059->4060 4061 401b4f 4059->4061 4060->4061 4061->3636 4063 407d23 CreateFileA 4062->4063 4064 407ec4 4062->4064 4063->4064 4065 407d4c RtlAllocateHeap 4063->4065 4064->3654 4066 407ebc CloseHandle 4065->4066 4068 407d6e 4065->4068 4066->4064 4067 407d70 ReadFile 4067->4068 4068->4067 4068->4068 4069 407eab HeapFree 4068->4069 4069->4066 4071 408bb1 strlen 4070->4071 4072 408c1a 4070->4072 4073 408be4 RtlReAllocateHeap 4071->4073 4074 408bc8 RtlAllocateHeap 4071->4074 4075 408c22 HeapFree 4072->4075 4076 408c05 4072->4076 4073->4076 4074->4076 4075->4076 4076->3675 4078 4038a8 EnumWindows 4077->4078 4082 4038b9 4077->4082 4079 403693 4078->4079 4087 40383a GetWindowThreadProcessId GetCurrentThreadId 4078->4087 4084 4038f9 GetForegroundWindow 4079->4084 4080 4038c6 GetCurrentThreadId 4081 4038d5 EnableWindow 4080->4081 4080->4082 4083 407bc4 HeapFree 4081->4083 4082->4079 4082->4080 4083->4082 4085 4036a4 MessageBoxA 4084->4085 4086 40390a GetWindowThreadProcessId GetCurrentProcessId 4084->4086 4085->3681 4086->4085 4088 403898 4087->4088 4089 403858 IsWindowVisible 4087->4089 4089->4088 4090 403863 IsWindowEnabled 4089->4090 4090->4088 4091 40386e GetForegroundWindow 4090->4091 4091->4088 4092 403878 EnableWindow 4091->4092 4093 407b97 RtlAllocateHeap 4092->4093 4094 40388d GetCurrentThreadId 4093->4094 4094->4088 4096 40757d 2 API calls 4095->4096 4097 4051a7 sprintf 4096->4097 4099 4051d6 4097->4099 4100 4051dd memset RegisterClassA 4097->4100 4099->4100 4102 405237 AdjustWindowRectEx 4100->4102 4103 4052be 4102->4103 4104 4052d5 GetSystemMetrics 4103->4104 4105 40530c 4103->4105 4107 4052e2 4104->4107 4108 4052e5 GetSystemMetrics 4104->4108 4106 405362 CreateWindowExA 4105->4106 4109 405322 GetWindowRect 4105->4109 4110 405318 GetActiveWindow 4105->4110 4111 405457 UnregisterClassA 4106->4111 4112 40539c SetPropA 4106->4112 4107->4108 4113 4052fc 4108->4113 4109->4113 4110->4106 4110->4109 4114 40760c 2 API calls 4111->4114 4115 4053b2 ShowWindow 4112->4115 4116 4053d4 RtlAllocateHeap CreateAcceleratorTableA 4112->4116 4113->4106 4118 40544c 4114->4118 4115->4116 4117 405445 4116->4117 4116->4118 4121 4099ca 4117->4121 4118->3691 4122 4099dd 4121->4122 4123 409a68 4122->4123 4124 4099fc sprintf 4122->4124 4123->4118 4125 409a20 GetPropA 4124->4125 4126 409a44 GetPropA 4124->4126 4125->4126 4127 409a53 4126->4127 4128 409a85 4126->4128 4127->4123 4129 409a5a HeapFree 4127->4129 4130 409a90 RtlAllocateHeap 4128->4130 4131 409aac 4128->4131 4129->4123 4132 409aaf RtlAllocateHeap SetPropA SetWindowLongA 4130->4132 4131->4132 4132->4123 4134 40482b 4133->4134 4135 40483b memset 4134->4135 4136 40488e CreateWindowExA 4134->4136 4135->4136 4138 4048dc 4136->4138 4142 401593 4136->4142 4139 40757d 2 API calls 4138->4139 4140 4048ea 4139->4140 4143 404e01 4140->4143 4142->3695 4144 404e13 4143->4144 4145 404e22 SetWindowLongA SetWindowLongA SetPropA SendMessageA 4144->4145 4146 404e73 4145->4146 4146->4142 4148 404b36 4147->4148 4149 404b48 memset 4148->4149 4150 404b7f CreateWindowExA 4148->4150 4149->4150 4152 404bc3 4150->4152 4153 4015de 4150->4153 4154 40757d 2 API calls 4152->4154 4153->3708 4155 404bd1 4154->4155 4156 404e01 4 API calls 4155->4156 4156->4153 4158 4055d3 4157->4158 4159 4055f5 HeapFree 4158->4159 4160 4055eb HeapFree 4158->4160 4161 405604 4158->4161 4159->4161 4160->4159 4162 40561f 4161->4162 4163 405636 PeekMessageA 4161->4163 4164 40567f GetMessageA 4161->4164 4162->3354 4165 405646 4163->4165 4166 405689 GetActiveWindow 4163->4166 4164->4166 4165->4162 4167 405652 MsgWaitForMultipleObjects 4165->4167 4169 405698 4166->4169 4167->4162 4168 40566a PeekMessageA 4167->4168 4168->4162 4168->4166 4170 40569c TranslateAccelerator 4169->4170 4171 4056ae TranslateMessage DispatchMessageA 4169->4171 4170->4162 4170->4171 4171->4162 4173 408770 4172->4173 4174 408805 memset 4173->4174 4174->3750 4176 4024b8 4175->4176 4176->4176 4177 403060 2 API calls 4176->4177 4178 4024d1 4177->4178 4179 408817 4 API calls 4178->4179 4180 4024ef 4179->4180 4181 408817 4 API calls 4180->4181 4182 40250d 4181->4182 4183 408b20 HeapFree 4182->4183 4184 40273b 4183->4184 4185 4088c7 2 API calls 4184->4185 4186 402745 4185->4186 4187 4088c7 2 API calls 4186->4187 4188 401df1 4187->4188 4188->3765 4190 404448 4189->4190 4191 40446b 4189->4191 4192 404451 RtlReAllocateHeap 4190->4192 4193 404463 4190->4193 4191->3780 4192->3780 4194 404340 RtlAllocateHeap 4193->4194 4195 404468 4194->4195 4195->3780 4197 4032cb 4196->4197 4198 40324d 4196->4198 4197->3815 4199 4032a8 4198->4199 4201 40329d strncpy 4198->4201 4200 408c90 RtlReAllocateHeap 4199->4200 4202 4032af 4200->4202 4201->4199 4203 4032c0 4202->4203 4204 4032b5 strncpy 4202->4204 4203->3815 4204->4203 4206 407474 4205->4206 4207 407430 4205->4207 4206->3850 4207->4206 4208 407462 WriteFile 4207->4208 4209 407454 4207->4209 4208->4206 4210 407480 5 API calls 4209->4210 4211 40745c 4210->4211 4211->3850 4213 4076ff 4212->4213 4214 4045ca memset 4213->4214 4215 4045e0 4214->4215 4215->3850 4219 403460 4216->4219 4218 4023d9 4218->3819 4220 40346f 4219->4220 4221 408c90 RtlReAllocateHeap 4220->4221 4223 4034b2 4221->4223 4222 4035fb 4222->4218 4223->4222 4224 403540 4223->4224 4225 40351e RtlAllocateHeap 4223->4225 4226 40356e strncpy 4224->4226 4229 403590 4224->4229 4225->4224 4226->4229 4227 4035e0 4227->4222 4228 4035e7 HeapFree 4227->4228 4228->4222 4229->4227 4230 4035bc strncpy 4229->4230 4230->4227 4662 404080 4664 40408a 4662->4664 4663 4040b2 4664->4663 4665 404099 GetCurrentProcess TerminateProcess 4664->4665 4665->4663 4666 409901 sprintf GetPropA 4667 4099b2 NtdllDefWindowProc_A 4666->4667 4668 409935 4666->4668 4669 4099c4 4667->4669 4670 409996 4668->4670 4672 409974 HeapFree 4668->4672 4673 40997e HeapFree RemovePropA 4668->4673 4670->4667 4671 40999b CallWindowProcA 4670->4671 4671->4669 4672->4673 4673->4670 4674 402483 4675 402485 4674->4675 4676 408b20 HeapFree 4675->4676 4677 40248d 4676->4677 4678 408b20 HeapFree 4677->4678 4679 402496 4678->4679 4680 408b20 HeapFree 4679->4680 4681 40249f 4680->4681 4682 408b20 HeapFree 4681->4682 4683 4024a8 4682->4683 4443 404cc6 4444 404cdb 4443->4444 4447 404cd3 4443->4447 4445 404cee 4444->4445 4444->4447 4449 404f54 RtlEnterCriticalSection 4444->4449 4445->4447 4455 404ee7 RtlEnterCriticalSection 4445->4455 4450 404f6a 4449->4450 4451 404f97 RtlLeaveCriticalSection 4450->4451 4452 404f80 DeleteObject 4450->4452 4454 404f79 4450->4454 4451->4445 4453 407bc4 HeapFree 4452->4453 4453->4454 4454->4451 4456 404f03 4455->4456 4457 404f45 RtlLeaveCriticalSection 4456->4457 4458 407b97 RtlAllocateHeap 4456->4458 4457->4447 4459 404f27 4458->4459 4460 404f44 4459->4460 4461 404f2f CreateSolidBrush 4459->4461 4460->4457 4461->4460 4462 404d46 4463 404d51 4462->4463 4464 404d57 4462->4464 4465 404f54 4 API calls 4463->4465 4465->4464 4684 404b09 SendMessageA 4466 404651 4467 40465e 4466->4467 4469 404697 4466->4469 4468 4046a0 3 API calls 4467->4468 4467->4469 4471 404670 4467->4471 4468->4471 4470 4045bb memset 4470->4471 4471->4469 4471->4470 4473 4094ba 4471->4473 4475 4096e7 4473->4475 4477 4094d2 4473->4477 4474 409708 memcpy 4476 409710 4474->4476 4475->4474 4475->4476 4476->4471 4477->4475 4478 4094ba HeapFree strlen RtlAllocateHeap 4477->4478 4479 4096be memcpy 4477->4479 4480 408b20 HeapFree 4477->4480 4481 408b50 2 API calls 4477->4481 4478->4477 4479->4477 4480->4477 4481->4477 4482 401d54 4483 401d56 4482->4483 4484 408b20 HeapFree 4483->4484 4485 401d5f 4484->4485 4689 404715 HeapFree 4690 402098 4691 40368b 16 API calls 4690->4691 4692 4020ae 4691->4692 4693 408918 4694 408929 4693->4694 4700 40898d 4693->4700 4695 40894f 4694->4695 4696 408817 4 API calls 4694->4696 4694->4700 4697 408960 4695->4697 4698 40898f memcpy 4695->4698 4695->4700 4696->4695 4699 4094ba 5 API calls 4697->4699 4697->4700 4698->4700 4699->4697 4486 404d5a GetWindowLongA 4487 404d72 4486->4487 4488 404deb NtdllDefWindowProc_A 4486->4488 4489 404d7f CallWindowProcA 4487->4489 4491 404de5 4488->4491 4490 404da0 RemovePropA RemovePropA 4489->4490 4489->4491 4493 404dc7 RevokeDragDrop 4490->4493 4494 404dce SetWindowLongA 4490->4494 4493->4494 4495 40760c 2 API calls 4494->4495 4495->4491 4496 4022dc 4513 4021f8 4496->4513 4497 407360 9 API calls 4497->4513 4498 407420 6 API calls 4498->4513 4499 4071b0 WriteFile HeapFree CloseHandle memset HeapFree 4499->4513 4500 4045bb memset 4500->4513 4501 408ac0 strlen RtlReAllocateHeap 4501->4513 4502 4023b7 4503 403660 5 API calls 4502->4503 4504 4023d9 4503->4504 4506 4031f0 RtlReAllocateHeap 4504->4506 4505 407d10 5 API calls 4505->4513 4509 4023e7 4506->4509 4507 408a10 RtlAllocateHeap RtlReAllocateHeap 4507->4513 4508 407380 9 API calls 4508->4513 4510 408ac0 2 API calls 4509->4510 4533 402478 4509->4533 4512 40241d 4510->4512 4511 408b20 HeapFree 4514 40248d 4511->4514 4515 408ac0 2 API calls 4512->4515 4513->4497 4513->4498 4513->4499 4513->4500 4513->4501 4513->4502 4513->4505 4513->4507 4513->4508 4531 40368b 16 API calls 4513->4531 4513->4533 4534 40202f 6 API calls 4513->4534 4516 408b20 HeapFree 4514->4516 4517 402427 4515->4517 4518 402496 4516->4518 4519 408ac0 2 API calls 4517->4519 4521 408b20 HeapFree 4518->4521 4520 402430 4519->4520 4523 408ac0 2 API calls 4520->4523 4522 40249f 4521->4522 4524 408b20 HeapFree 4522->4524 4525 40243a 4523->4525 4526 4024a8 4524->4526 4527 408ac0 2 API calls 4525->4527 4528 402445 4527->4528 4529 40368b 16 API calls 4528->4529 4530 402460 4529->4530 4532 40202f 6 API calls 4530->4532 4530->4533 4531->4513 4532->4533 4533->4511 4534->4513 4535 4062de IsWindowEnabled 4536 4062f2 IsWindowVisible 4535->4536 4537 406329 4535->4537 4536->4537 4538 4062fd GetWindowLongA 4536->4538 4538->4537 4539 40630d 4538->4539 4539->4537 4540 40631d SetFocus 4539->4540 4540->4537 4231 401621 4237 4015fc 4231->4237 4232 405706 10 API calls 4232->4237 4233 40160c RemoveDirectoryA 4234 401bcd ExitProcess HeapDestroy ExitProcess 4233->4234 4235 401640 4236 404c42 4 API calls 4235->4236 4239 401651 4236->4239 4237->4232 4237->4233 4237->4235 4238 401687 4237->4238 4240 404c42 4 API calls 4238->4240 4242 408a10 2 API calls 4239->4242 4241 401698 4240->4241 4243 408a10 2 API calls 4241->4243 4244 40165b 4242->4244 4245 4016a2 4243->4245 4246 404fa3 13 API calls 4244->4246 4247 404fa3 13 API calls 4245->4247 4248 401665 4246->4248 4247->4248 4249 4016b8 4248->4249 4250 407c10 2 API calls 4249->4250 4251 4016d6 4250->4251 4252 404360 RtlReAllocateHeap 4251->4252 4253 4016f4 4252->4253 4254 40173a 4253->4254 4255 40170f 4253->4255 4257 4020bb 6 API calls 4254->4257 4256 40368b 16 API calls 4255->4256 4258 401725 RemoveDirectoryA 4256->4258 4259 40174a 4257->4259 4258->4234 4260 401d66 25 API calls 4259->4260 4261 401793 4260->4261 4262 404360 RtlReAllocateHeap 4261->4262 4263 4017ab 4262->4263 4264 408a10 2 API calls 4263->4264 4265 4017b5 4264->4265 4266 404360 RtlReAllocateHeap 4265->4266 4267 4017cd 4266->4267 4268 408a10 2 API calls 4267->4268 4269 4017d7 4268->4269 4270 4020bb 6 API calls 4269->4270 4271 4017e7 4270->4271 4272 401a3c 4271->4272 4273 403a44 3 API calls 4271->4273 4274 408ac0 2 API calls 4272->4274 4275 401800 4273->4275 4276 401a4d 4274->4276 4277 404360 RtlReAllocateHeap 4275->4277 4278 408ac0 2 API calls 4276->4278 4282 40181e 4277->4282 4279 401a57 4278->4279 4280 408ac0 2 API calls 4279->4280 4281 401a62 4280->4281 4283 408a10 2 API calls 4281->4283 4282->4272 4286 401855 4282->4286 4284 401a6c 4283->4284 4285 407360 9 API calls 4284->4285 4288 401a7c 4285->4288 4287 406fb6 2 API calls 4286->4287 4289 401868 4287->4289 4290 401a80 4288->4290 4291 401a9c 4288->4291 4292 4036e1 26 API calls 4289->4292 4293 4073a0 6 API calls 4290->4293 4294 407081 DeleteFileA 4291->4294 4295 401883 4292->4295 4296 401a90 4293->4296 4297 401aa7 4294->4297 4298 408a10 2 API calls 4295->4298 4299 4071b0 5 API calls 4296->4299 4300 40202f 6 API calls 4297->4300 4305 40188d 4298->4305 4304 401a9a 4299->4304 4301 401aac 4300->4301 4302 40368b 16 API calls 4301->4302 4303 401ac2 RemoveDirectoryA 4302->4303 4303->4234 4307 401af1 4304->4307 4310 402122 52 API calls 4304->4310 4306 4019ec 4305->4306 4309 408ac0 2 API calls 4305->4309 4308 403aa5 4 API calls 4306->4308 4312 408ac0 2 API calls 4307->4312 4311 401a05 4308->4311 4313 4018b1 4309->4313 4310->4307 4314 406ff6 2 API calls 4311->4314 4315 401b13 4312->4315 4316 408a10 2 API calls 4313->4316 4317 401a13 4314->4317 4318 408ac0 2 API calls 4315->4318 4325 4018bb 4316->4325 4319 407071 SetCurrentDirectoryA 4317->4319 4320 401b1e 4318->4320 4321 401a21 RemoveDirectoryA 4319->4321 4322 403f4a 45 API calls 4320->4322 4321->4234 4323 401b39 4322->4323 4328 403f84 WaitForSingleObject 4323->4328 4324 4018d5 4327 407380 9 API calls 4324->4327 4325->4324 4326 402122 52 API calls 4325->4326 4326->4324 4329 4018e5 4327->4329 4330 401b4f 4328->4330 4331 4019be 4329->4331 4333 4071b0 5 API calls 4329->4333 4372 403f92 GetExitCodeProcess 4330->4372 4334 407360 9 API calls 4331->4334 4336 4018f7 4333->4336 4337 4019ce 4334->4337 4335 401b5a 4338 403fb0 9 API calls 4335->4338 4340 408ac0 2 API calls 4336->4340 4337->4306 4343 4073a0 6 API calls 4337->4343 4339 401b6a 4338->4339 4341 40202f 6 API calls 4339->4341 4342 401913 4340->4342 4344 401b6f 4341->4344 4345 408ac0 2 API calls 4342->4345 4346 4019e2 4343->4346 4348 407081 DeleteFileA 4344->4348 4349 40191d 4345->4349 4347 4071b0 5 API calls 4346->4347 4347->4306 4350 401b7a 4348->4350 4351 408ac0 2 API calls 4349->4351 4352 403aa5 4 API calls 4350->4352 4353 401928 4351->4353 4354 401b93 4352->4354 4355 408ac0 2 API calls 4353->4355 4356 406ff6 2 API calls 4354->4356 4357 401932 4355->4357 4358 401ba1 4356->4358 4359 408ac0 2 API calls 4357->4359 4361 407071 SetCurrentDirectoryA 4358->4361 4360 40193d 4359->4360 4362 40368b 16 API calls 4360->4362 4363 401baf RemoveDirectoryA 4361->4363 4364 401958 4362->4364 4363->4234 4364->4331 4365 40196e 4364->4365 4366 403aa5 4 API calls 4365->4366 4367 401987 4366->4367 4368 406ff6 2 API calls 4367->4368 4369 401995 4368->4369 4370 407071 SetCurrentDirectoryA 4369->4370 4371 4019a3 RemoveDirectoryA 4370->4371 4371->4234 4372->4335 4373 401be2 4397 404064 4373->4397 4375 401be7 4384 404210 SetUnhandledExceptionFilter 4375->4384 4377 401bec 4385 405091 4377->4385 4383 401c05 4384->4377 4386 4050a1 4385->4386 4387 4050cb 4386->4387 4389 404fa3 13 API calls 4386->4389 4388 401bfb 4387->4388 4390 4050e0 HeapFree 4387->4390 4391 4050eb HeapFree 4387->4391 4392 406646 4388->4392 4389->4386 4390->4391 4391->4388 4393 406655 4392->4393 4394 401c00 4393->4394 4403 4065fb 4393->4403 4396 40680a FreeLibrary 4394->4396 4396->4383 4398 40402d 4397->4398 4399 404044 4398->4399 4400 404036 CloseHandle 4398->4400 4401 404063 4399->4401 4402 40404d HeapFree 4399->4402 4400->4399 4401->4375 4402->4401 4404 406641 4403->4404 4405 406605 4403->4405 4404->4393 4405->4404 4406 406618 GetObjectType 4405->4406 4407 406627 DeleteObject 4406->4407 4408 40662f DestroyCursor 4406->4408 4409 406635 4407->4409 4408->4409 4410 40760c 2 API calls 4409->4410 4410->4404 4541 4061e3 4550 405d45 4541->4550 4543 4061fd 4544 406254 SetLastError 4543->4544 4545 406205 GetPropA 4543->4545 4547 406266 NtdllDefWindowProc_A 4544->4547 4549 406240 4544->4549 4545->4544 4546 406215 4545->4546 4548 40624a DefFrameProcA 4546->4548 4546->4549 4547->4549 4548->4549 4551 405d5b 4550->4551 4581 4058e9 4551->4581 4554 405d84 GetPropA 4555 405d99 GetParent 4554->4555 4556 405da9 4554->4556 4555->4554 4555->4556 4557 4060ed 4556->4557 4558 405e0e 4556->4558 4577 405de5 4556->4577 4568 406151 4557->4568 4571 405fcd 4557->4571 4559 405e14 4558->4559 4560 406069 4558->4560 4561 405e1d 4559->4561 4562 405f9e 4559->4562 4621 405ccf 4560->4621 4564 405f41 4561->4564 4572 405e23 4561->4572 4566 405fac 4562->4566 4567 405fdd 4562->4567 4562->4577 4569 405f4b GetClientRect FillRect 4564->4569 4564->4577 4565 406078 4570 40608f GetWindowLongA 4565->4570 4565->4577 4566->4571 4575 405fba RemovePropA 4566->4575 4566->4577 4576 405ff6 GetWindowLongA 4567->4576 4567->4577 4573 406185 PostMessageA 4568->4573 4569->4577 4570->4577 4574 405ccf 2 API calls 4571->4574 4571->4577 4572->4577 4578 405e87 GetFocus SetPropA 4572->4578 4579 405e58 GetPropA 4572->4579 4573->4577 4574->4577 4575->4571 4576->4577 4577->4543 4578->4577 4579->4577 4580 405e6a SetFocus 4579->4580 4580->4577 4582 4058fd 4581->4582 4583 405910 4582->4583 4584 405a68 4582->4584 4588 405932 SystemParametersInfoA 4583->4588 4620 405a60 4583->4620 4585 405a72 MapWindowPoints 4584->4585 4586 405ad3 4584->4586 4624 40576b 4585->4624 4589 405c91 4586->4589 4590 405ade 4586->4590 4592 405949 GetWindowRect GetWindowRect GetSystemMetrics GetSystemMetrics GetWindowLongA 4588->4592 4588->4620 4593 405c98 4589->4593 4594 405c89 ReleaseCapture 4589->4594 4590->4594 4599 405af3 4590->4599 4596 4059a1 GetWindowLongA 4592->4596 4597 405999 GetSystemMetrics 4592->4597 4598 405c9f PostMessageA 4593->4598 4593->4620 4594->4620 4601 4059c2 4596->4601 4602 4059b2 GetSystemMetrics 4596->4602 4600 4059b8 GetSystemMetrics 4597->4600 4603 405cb6 SetCursorPos 4598->4603 4598->4620 4604 405c34 GetCursorPos 4599->4604 4605 405afe 4599->4605 4606 4059c8 6 API calls 4600->4606 4601->4606 4602->4600 4603->4620 4615 405b37 4604->4615 4618 405b20 4604->4618 4607 405b05 4605->4607 4608 405bd7 GetCursorPos 4605->4608 4609 405a10 SetCapture PostMessageA 4606->4609 4610 405a03 SendMessageA 4606->4610 4611 405b84 GetCursorPos 4607->4611 4612 405b08 4607->4612 4608->4615 4608->4618 4614 405a2e GetCursorPos LoadImageA SetCursor 4609->4614 4609->4620 4610->4609 4611->4615 4611->4618 4613 405b0f GetCursorPos 4612->4613 4612->4620 4613->4615 4613->4618 4614->4620 4617 405b7c 4615->4617 4615->4618 4630 40589b SetCursorPos 4617->4630 4629 40573d SetCursorPos LoadImageA SetCursor 4618->4629 4620->4554 4620->4556 4620->4577 4622 405cde GetPropA GetWindowLongA 4621->4622 4623 405cfe 4621->4623 4622->4623 4623->4565 4625 405778 SendMessageA 4624->4625 4626 40584d GetWindowLongA 4625->4626 4627 405862 GetParent MapWindowPoints 4626->4627 4628 40587a MoveWindow 4626->4628 4627->4628 4628->4620 4629->4620 4631 40576b 4630->4631 4632 4058bb SendMessageA 4631->4632 4633 40584d 4 API calls 4632->4633 4634 4058e2 4633->4634 4634->4620 4701 4049a3 4702 4049ac 4701->4702 4703 4049c6 CallWindowProcA 4702->4703 4705 404eaf 4702->4705 4709 404e7c 4705->4709 4708 404ee1 4708->4703 4710 404e9f GetParent 4709->4710 4711 404ea7 GetPropA GetWindowLongA 4710->4711 4712 404e8c GetPropA 4710->4712 4711->4708 4712->4711 4713 404e9c 4712->4713 4713->4710 4635 404ae7 4636 404af0 SendMessageA 4635->4636 4714 403927 4715 403936 4714->4715 4716 403951 4715->4716 4717 40393a CloseHandle 4715->4717 4718 40760c 2 API calls 4717->4718 4718->4716 4638 4046e8 RtlAllocateHeap 4719 404928 4720 404953 4719->4720 4721 40493d 4719->4721 4724 404967 SetTextColor 4720->4724 4725 40498b 4720->4725 4722 404947 IsWindowEnabled 4721->4722 4723 40499a 4721->4723 4722->4720 4722->4723 4724->4725 4726 404975 GetSysColor SetBkColor GetSysColorBrush 4724->4726 4725->4723 4727 404993 SetBkColor 4725->4727 4726->4725 4727->4723 4411 409ba9 4412 409bc0 4411->4412 4418 409c2e 4411->4418 4412->4418 4423 409be8 GetModuleHandleA 4412->4423 4413 409c74 4414 409c37 GetModuleHandleA 4416 409c41 4414->4416 4416->4416 4416->4418 4419 409c61 GetProcAddress 4416->4419 4417 409bdf 4417->4416 4417->4418 4420 409c02 GetProcAddress 4417->4420 4418->4413 4418->4414 4418->4416 4419->4418 4420->4418 4421 409c0f VirtualProtect 4420->4421 4421->4418 4422 409c1e VirtualProtect 4421->4422 4422->4418 4424 409bf1 4423->4424 4430 409c2e 4423->4430 4435 409c05 GetProcAddress 4424->4435 4426 409bf6 4429 409c02 GetProcAddress 4426->4429 4426->4430 4427 409c74 4428 409c37 GetModuleHandleA 4433 409c41 4428->4433 4429->4430 4431 409c0f VirtualProtect 4429->4431 4430->4427 4430->4428 4430->4433 4431->4430 4432 409c1e VirtualProtect 4431->4432 4432->4430 4433->4430 4434 409c61 GetProcAddress 4433->4434 4434->4430 4436 409c2e 4435->4436 4437 409c0f VirtualProtect 4435->4437 4439 409c74 4436->4439 4440 409c37 GetModuleHandleA 4436->4440 4437->4436 4438 409c1e VirtualProtect 4437->4438 4438->4436 4441 409c41 4440->4441 4441->4436 4441->4441 4442 409c61 GetProcAddress 4441->4442 4442->4441 4729 402731 4730 402733 4729->4730 4731 408b20 HeapFree 4730->4731 4732 40273b 4731->4732 4733 4088c7 2 API calls 4732->4733 4734 402745 4733->4734 4735 4088c7 2 API calls 4734->4735 4736 40274e 4735->4736 4737 4047b5 4738 4047c5 4737->4738 4742 404811 4737->4742 4739 404802 4738->4739 4740 4047de SetTextColor 4738->4740 4739->4742 4743 40480a SetBkColor 4739->4743 4740->4739 4741 4047ec GetSysColor SetBkColor GetSysColorBrush 4740->4741 4741->4739 4743->4742 4639 406279 IsWindowEnabled 4640 40628d IsWindowVisible 4639->4640 4646 4062cf 4639->4646 4641 406298 GetWindowLongA 4640->4641 4640->4646 4642 4062a8 4641->4642 4641->4646 4643 4062b3 SetFocus 4642->4643 4644 4062be 4642->4644 4643->4646 4645 4062c4 SetFocus 4644->4645 4644->4646 4645->4646 4744 4036ba 4745 4036c1 4744->4745 4746 4036dc 4744->4746 4745->4746 4747 4036c7 SendMessageA 4745->4747 4747->4746 4647 4050fc 4648 405108 4647->4648 4649 40512f 4647->4649 4650 405121 HeapFree 4648->4650 4651 405116 HeapFree 4648->4651 4650->4649 4651->4650 4652 401fff 4653 402001 4652->4653 4654 408b20 HeapFree 4653->4654 4655 402009 4654->4655 4656 4088c7 2 API calls 4655->4656 4657 402013 4656->4657 4658 4088c7 2 API calls 4657->4658 4659 40201c 4658->4659 4660 4088c7 2 API calls 4659->4660 4661 402025 4660->4661

                                                                                                                                                                                                      Executed Functions

                                                                                                                                                                                                      Function 00401000 Relevance: 74.2, APIs: 16, Strings: 26, Instructions: 668memoryCOMMON
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                      control_flow_graph 0 401000-40115a memset GetModuleHandleA HeapCreate call 403000 call 4089c0 call 4088a8 call 407220 call 40677c call 406688 call 406674 call 4065ef call 4065d8 call 405131 call 40472b call 4044fc call 404310 call 403954 call 40367d call 40451b call 404470 call 408817 call 404340 GetUserDefaultLangID VerLanguageNameA call 404360 call 4030c0 call 4031f0 call 408a10 call 4043b0 call 408a90 51 401160-401230 call 403068 * 13 0->51 52 401235-401300 call 403068 * 13 0->52 104 401305-40130f call 404227 51->104 52->104 107 401311-401bc8 call 40368b 104->107 108 40132c-401359 call 4040c0 call 403a92 GetModuleHandleA 104->108 116 401bcd-401bdd ExitProcess HeapDestroy ExitProcess 107->116 117 4013d3-4013e5 call 4020bb 108->117 118 40135b 108->118 123 4013e7-401430 call 401c0b call 4020bb 117->123 124 4013fe-401419 call 40368b 117->124 120 401365-401372 118->120 120->117 122 401374-4013d1 call 403a44 call 408a10 PathQuoteSpacesA call 408ac0 * 3 call 408a10 120->122 122->117 122->120 139 401432-401488 call 404360 call 408a10 call 4020bb 123->139 140 401456-401471 call 40368b 123->140 124->116 155 4014aa-4014c5 call 40368b 139->155 156 40148a-4014dc call 4020bb 139->156 140->116 155->116 162 4014fc-40150e call 4020bb 156->162 163 4014de-4014f7 156->163 166 401510-401529 162->166 167 40152e-401540 call 4020bb 162->167 163->162 166->167 170 401793-4017e9 call 404360 call 408a10 call 404360 call 408a10 call 4020bb 167->170 171 401546-4015f7 call 405481 call 404908 call 4049e2 call 404be7 call 4054a4 call 404c07 167->171 192 401a3c-401a7e call 408ac0 * 3 call 408a10 call 407360 170->192 193 4017ef-401837 call 403a44 call 404360 call 408a90 170->193 197 4015fc-40160a call 405706 171->197 239 401a80-401ae4 call 4073a0 call 4071b0 call 408a90 192->239 240 401a9c-401ad2 call 407081 call 40202f call 40368b RemoveDirectoryA 192->240 218 401839-401842 193->218 219 40184b 193->219 206 401626-40162e 197->206 207 40160c-40161c RemoveDirectoryA 197->207 210 401630-40163e call 40570e 206->210 211 40166d-401675 206->211 207->116 223 401640-401668 call 404c42 call 408a10 call 404fa3 210->223 224 40166a-40166b 210->224 214 4016b2-4016b3 211->214 215 401677-401685 call 40571d 211->215 214->197 230 4016b1 215->230 231 401687-4016af call 404c42 call 408a10 call 404fa3 215->231 218->219 225 401844-401849 218->225 227 40184d-40184f 219->227 260 4016b8-40170d call 403210 call 407c10 call 404360 call 408a90 223->260 224->214 225->227 227->192 232 401855-40189a call 406fb6 call 4036e1 call 408a10 call 408a90 227->232 230->214 231->260 271 4018a0-4018c8 call 408ac0 call 408a10 call 408a90 232->271 272 4019ec-401a37 call 403aa5 call 406ff6 call 407071 RemoveDirectoryA 232->272 274 401af1-401bc6 call 408ac0 * 2 call 403f4a call 403f84 call 403f92 call 403fb0 call 40202f call 407081 call 403aa5 call 406ff6 call 407071 RemoveDirectoryA 239->274 275 401ae6-401aec call 402122 239->275 240->116 296 40173a-40174c call 4020bb 260->296 297 40170f-401735 call 40368b RemoveDirectoryA 260->297 304 4018d5-4018e7 call 407380 271->304 305 4018ca-4018d0 call 402122 271->305 272->116 274->116 275->274 312 401758-40178e call 401d66 296->312 313 40174e-401753 296->313 297->116 315 4018ed-40196c call 4071b0 call 408ac0 * 5 call 40368b 304->315 316 4019be-4019d0 call 407360 304->316 305->304 312->170 313->312 315->316 352 40196e-4019b9 call 403aa5 call 406ff6 call 407071 RemoveDirectoryA 315->352 316->272 327 4019d2-4019e7 call 4073a0 call 4071b0 316->327 327->272 352->116
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • memset.MSVCRT ref: 0040100F
                                                                                                                                                                                                      • GetModuleHandleA.KERNEL32(00000000), ref: 0040101C
                                                                                                                                                                                                      • HeapCreate.KERNEL32(00000000,00001000,00000000,00000000), ref: 00401035
                                                                                                                                                                                                        • Part of subcall function 004089C0: HeapCreate.KERNELBASE(00000000,00001000,00000000), ref: 004089CC
                                                                                                                                                                                                        • Part of subcall function 004089C0: RtlAllocateHeap.NTDLL(02060000,00000000,0000400E), ref: 004089FA
                                                                                                                                                                                                        • Part of subcall function 0040677C: LoadLibraryA.KERNELBASE(msimg32.dll), ref: 0040678D
                                                                                                                                                                                                        • Part of subcall function 0040677C: GetProcAddress.KERNEL32(00000000,AlphaBlend), ref: 004067A4
                                                                                                                                                                                                        • Part of subcall function 0040677C: GetVersionExA.KERNEL32(?), ref: 004067C4
                                                                                                                                                                                                        • Part of subcall function 004065EF: TlsAlloc.KERNEL32(00401067,00000000,00001000,00000000,00000000), ref: 004065EF
                                                                                                                                                                                                        • Part of subcall function 00405131: LoadIconA.USER32(00000001,00000038), ref: 0040515F
                                                                                                                                                                                                        • Part of subcall function 00405131: LoadCursorA.USER32(00000000,00007F00), ref: 00405171
                                                                                                                                                                                                        • Part of subcall function 0040472B: RtlInitializeCriticalSection.NTDLL(0040C6FC), ref: 00404735
                                                                                                                                                                                                        • Part of subcall function 0040472B: GetStockObject.GDI32(00000011), ref: 0040473D
                                                                                                                                                                                                        • Part of subcall function 0040472B: memset.MSVCRT ref: 00404779
                                                                                                                                                                                                        • Part of subcall function 00404310: HeapCreate.KERNELBASE(00000000,00001000,00000000,00401080,00000000,00001000,00000000,00000000), ref: 00404319
                                                                                                                                                                                                        • Part of subcall function 00403954: RtlInitializeCriticalSection.NTDLL(0040C6AC), ref: 0040397C
                                                                                                                                                                                                        • Part of subcall function 0040367D: CoInitialize.OLE32(00000000), ref: 00403684
                                                                                                                                                                                                        • Part of subcall function 0040451B: HeapFree.KERNEL32(00000000,?,?,00001000,?,?,?,00401095,00000000,00001000,00000000,00000000), ref: 00404556
                                                                                                                                                                                                        • Part of subcall function 0040451B: HeapFree.KERNEL32(00000000,00001000,?,00001000,?,?,?,00401095,00000000,00001000,00000000,00000000), ref: 00404560
                                                                                                                                                                                                        • Part of subcall function 00404470: RtlAllocateHeap.NTDLL(00000000,00000030), ref: 00404483
                                                                                                                                                                                                        • Part of subcall function 00404470: RtlAllocateHeap.NTDLL(00000007,00000008), ref: 00404498
                                                                                                                                                                                                        • Part of subcall function 00408817: RtlAllocateHeap.NTDLL(00000000,00000FE8,0040B380), ref: 0040883A
                                                                                                                                                                                                        • Part of subcall function 00408817: memset.MSVCRT ref: 00408871
                                                                                                                                                                                                        • Part of subcall function 00404340: RtlAllocateHeap.NTDLL(02350000,00000008,00000000), ref: 00404351
                                                                                                                                                                                                      • GetUserDefaultLangID.KERNEL32(00000008,00000400,00000008,00000401,00000007,0040B378,0040C414,00000008,00000000,0040B380,00000007,00000000,00001000,00000000,00000000), ref: 004010E8
                                                                                                                                                                                                      • VerLanguageNameA.KERNEL32(00000000,00000008,00000400,00000008,00000401,00000007,0040B378,0040C414,00000008,00000000,0040B380,00000007,00000000,00001000,00000000,00000000), ref: 004010EE
                                                                                                                                                                                                        • Part of subcall function 004030C0: CharLowerA.USER32(00000000,00000000,00000007,00001000,?,?,?,00401126,00000008,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0040310D
                                                                                                                                                                                                        • Part of subcall function 00408A10: RtlAllocateHeap.NTDLL(02060000,00000000,?), ref: 00408A36
                                                                                                                                                                                                        • Part of subcall function 004043B0: HeapFree.KERNEL32(02350000,00000000,00000000,00401149,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000008,00000400,00000008,00000401,00000007), ref: 004043BE
                                                                                                                                                                                                      • PathQuoteSpacesA.SHLWAPI(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000008,00000400,00000008,00000401,00000007,0040B378,0040C414,00000008,00000000), ref: 00401396
                                                                                                                                                                                                        • Part of subcall function 00408AC0: strlen.MSVCRT ref: 00408AD3
                                                                                                                                                                                                        • Part of subcall function 0040368B: MessageBoxA.USER32(00000000,00000007,00001000,00000000), ref: 004036A5
                                                                                                                                                                                                      • GetModuleHandleA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000008,00000400,00000008,00000401,00000007,0040B378,0040C414,00000008), ref: 00401347
                                                                                                                                                                                                        • Part of subcall function 00403A44: strncpy.MSVCRT ref: 00403A7F
                                                                                                                                                                                                        • Part of subcall function 00408A10: RtlReAllocateHeap.NTDLL(02060000,00000000,?,?), ref: 00408A59
                                                                                                                                                                                                      • ExitProcess.KERNEL32(00000001,00000010,OPS,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000008,00000400,00000008,00000401,00000007), ref: 00401BCD
                                                                                                                                                                                                      • HeapDestroy.KERNEL32(00000001,00000010,OPS,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000008,00000400,00000008,00000401,00000007), ref: 00401BD8
                                                                                                                                                                                                      • ExitProcess.KERNEL32(00000001,00000010,OPS,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000008,00000400,00000008,00000401,00000007), ref: 00401BDD
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      • Einige Include Dateien konnten nicht erstellt werden., xrefs: 00401180
                                                                                                                                                                                                      • Die Datei , xrefs: 004011C0
                                                                                                                                                                                                      • Wrong password., xrefs: 00401275
                                                                                                                                                                                                      • Fehler!, xrefs: 00401170
                                                                                                                                                                                                      • Can not allocate the memory., xrefs: 00401265
                                                                                                                                                                                                      • Passwort, xrefs: 00401210
                                                                                                                                                                                                      • The file , xrefs: 00401295
                                                                                                                                                                                                      • Overwrite?, xrefs: 00401285
                                                                                                                                                                                                      • Fortfahren?, xrefs: 00401160
                                                                                                                                                                                                      • Please enter the password., xrefs: 004012F5
                                                                                                                                                                                                      • Password, xrefs: 004012E5
                                                                                                                                                                                                      • Continue?, xrefs: 00401235
                                                                                                                                                                                                      • Choose a location to save the files., xrefs: 004012D5
                                                                                                                                                                                                      • An unknown error occured. The program will be terminated., xrefs: 004012B5
                                                                                                                                                                                                      • Bitte geben Sie das Passwort ein., xrefs: 00401220
                                                                                                                                                                                                      • Ein unbekannter Fehler ist aufgetreten. Das Programm wird beendet., xrefs: 004011E0
                                                                                                                                                                                                      • Bitte whlen Sie einen Ordner zum Speichern der Dateien aus., xrefs: 00401200
                                                                                                                                                                                                      • Error!, xrefs: 00401245
                                                                                                                                                                                                      • This program is not supported on this operating system., xrefs: 004012C5
                                                                                                                                                                                                      • 2, xrefs: 0040130C
                                                                                                                                                                                                      • Falsches Passwort., xrefs: 004011A0
                                                                                                                                                                                                      • already exists in the current directory. Overwrite?, xrefs: 004012A5
                                                                                                                                                                                                      • "*, xrefs: 004013B7
                                                                                                                                                                                                      • deutsch, xrefs: 0040114F
                                                                                                                                                                                                      • \BDFINOPS, xrefs: 00401A4D
                                                                                                                                                                                                      • Can not create some of your include files., xrefs: 00401255
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000008.00000002.2668306735.0000000000401000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000008.00000002.2668275549.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000008.00000002.2668343196.000000000040F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_8_2_400000_iDentalSoft-Bridge.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Heap$Allocate$CreateFreeInitializeLoadmemset$CriticalExitHandleModuleProcessSection$AddressAllocCharCursorDefaultDestroyIconLangLanguageLibraryLowerMessageNameObjectPathProcQuoteSpacesStockUserVersionstrlenstrncpy
                                                                                                                                                                                                      • String ID: "*$ already exists in the current directory. Overwrite?$2$An unknown error occured. The program will be terminated.$Bitte geben Sie das Passwort ein.$Bitte whlen Sie einen Ordner zum Speichern der Dateien aus.$Can not allocate the memory.$Can not create some of your include files.$Choose a location to save the files.$Continue?$Die Datei $Ein unbekannter Fehler ist aufgetreten. Das Programm wird beendet.$Einige Include Dateien konnten nicht erstellt werden.$Error!$Falsches Passwort.$Fehler!$Fortfahren?$Overwrite?$Password$Passwort$Please enter the password.$The file $This program is not supported on this operating system.$Wrong password.$\BDFINOPS$deutsch
                                                                                                                                                                                                      • API String ID: 3877291893-4079455548
                                                                                                                                                                                                      • Opcode ID: 4ed4bd7ca7b019a891f4ac48cb93879d90e8faf06c9dfc4c03e9ed6e0b72a16d
                                                                                                                                                                                                      • Instruction ID: 3937e50b38ceb4ea3237217d6733fdce36a192474f66c71d08239df795d55f11
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 4ed4bd7ca7b019a891f4ac48cb93879d90e8faf06c9dfc4c03e9ed6e0b72a16d
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 7B422770260200EFD710BB61EEC2E2A3665EB44708F50963FBA41B61F6CB7E5851DB5E
                                                                                                                                                                                                      Function 00403B37 Relevance: 60.4, APIs: 40, Instructions: 362memorystringpipeCOMMON
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                      control_flow_graph 359 403b37-403b93 memset 360 403ba2 359->360 361 403b95-403ba0 359->361 362 403ba6-403bae 360->362 361->362 363 403bb0-403bb5 362->363 364 403bcd-403bd0 362->364 363->364 365 403bb7-403bbc 363->365 366 403bd2-403bd5 364->366 367 403c0a-403c13 364->367 365->364 370 403bbe-403bcb 365->370 366->367 371 403bd7-403bec CreatePipe 366->371 368 403c15-403c19 367->368 369 403c87-403c8a 367->369 372 403c1b-403c30 CreatePipe 368->372 373 403c4e-403c52 368->373 375 403cb6-403cbb 369->375 376 403c8c-403c95 369->376 374 403c06 370->374 371->367 377 403bee-403bff call 403b00 371->377 372->373 378 403c32-403c47 call 403b00 372->378 373->369 381 403c54-403c69 CreatePipe 373->381 374->367 379 403cc2-403cc5 375->379 380 403cbd 375->380 382 403c97-403c9b GetStdHandle 376->382 383 403c9e-403ca1 376->383 377->374 378->373 388 403cc7 379->388 389 403cce-403cf8 strlen * 2 RtlAllocateHeap 379->389 380->379 381->369 390 403c6b-403c77 call 403b00 381->390 382->383 385 403ca3-403ca7 GetStdHandle 383->385 386 403caa-403cad 383->386 385->386 386->375 392 403caf-403cb3 GetStdHandle 386->392 388->389 394 403cfa-403d1b _mbscpy _mbscat * 2 389->394 395 403d1d-403d25 _mbscpy 389->395 398 403c7c-403c80 390->398 392->375 397 403d26-403d2b 394->397 395->397 399 403d46-403d4b 397->399 400 403d2d-403d43 _mbscat * 2 397->400 398->369 401 403d54-403d7a CreateProcessA 399->401 402 403d4d-403d4f 399->402 400->399 403 403d80-403d83 401->403 404 403e08-403e0b 401->404 402->401 405 403d51 402->405 406 403d85-403d88 CloseHandle 403->406 407 403d8a-403d8d 403->407 408 403e12-403e15 404->408 409 403e0d-403e10 CloseHandle 404->409 405->401 406->407 412 403d94-403d97 407->412 413 403d8f-403d92 CloseHandle 407->413 410 403e17-403e1a CloseHandle 408->410 411 403e1c-403e1f 408->411 409->408 410->411 414 403e21-403e24 CloseHandle 411->414 415 403e26-403e29 411->415 416 403d99-403d9c CloseHandle 412->416 417 403d9e-403da7 CloseHandle 412->417 413->412 414->415 418 403e30-403e33 415->418 419 403e2b-403e2e CloseHandle 415->419 416->417 420 403db4-403db7 417->420 421 403da9-403dae WaitForSingleObject 417->421 422 403e35-403e38 CloseHandle 418->422 423 403e3a-403e3d 418->423 419->418 424 403db9-403df9 RtlEnterCriticalSection call 407b97 RtlLeaveCriticalSection 420->424 425 403dfe-403e03 CloseHandle 420->425 421->420 422->423 426 403e44-403e48 423->426 427 403e3f-403e42 CloseHandle 423->427 435 403f18-403f1b 424->435 429 403f26 425->429 430 403f2d-403f47 HeapFree 426->430 431 403e4e-403e51 426->431 427->426 429->430 433 403e53-403e60 strlen 431->433 434 403e87-403ecb memset ShellExecuteEx 431->434 433->434 437 403e62-403e65 433->437 434->430 436 403ecd-403ed1 434->436 435->430 438 403ed3-403ed8 WaitForSingleObject 436->438 439 403ede-403ee1 436->439 440 403e67-403e6a 437->440 441 403e6c-403e6e 437->441 438->439 442 403ee3-403f15 RtlEnterCriticalSection call 407b97 RtlLeaveCriticalSection 439->442 443 403f1d-403f20 CloseHandle 439->443 440->437 440->441 441->434 444 403e70-403e84 _mbscpy 441->444 442->435 443->429 444->434
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • memset.MSVCRT ref: 00403B7F
                                                                                                                                                                                                      • CreatePipe.KERNEL32(?,?,?,00000000,?,?,00000000,?,?,?,?,?,?,00403F61,00000007,00000007), ref: 00403BE4
                                                                                                                                                                                                      • CreatePipe.KERNEL32(?,?,?,00000000,?,?,00000000,?,?,?,?,?,?,00403F61,00000007,00000007), ref: 00403C28
                                                                                                                                                                                                      • CreatePipe.KERNELBASE(?,?,?,00000000,?,?,00000000,?,?,?,?,?,?,00403F61,00000007,00000007), ref: 00403C61
                                                                                                                                                                                                      • GetStdHandle.KERNEL32(000000F6,?,?,00000000,?,?,?,?,?,?,00403F61,00000007,00000007,00000007,00000007,00000000), ref: 00403C99
                                                                                                                                                                                                      • GetStdHandle.KERNEL32(000000F5,?,?,00000000,?,?,?,?,?,?,00403F61,00000007,00000007,00000007,00000007,00000000), ref: 00403CA5
                                                                                                                                                                                                      • GetStdHandle.KERNEL32(000000F4,?,?,00000000,?,?,?,?,?,?,00403F61,00000007,00000007,00000007,00000007,00000000), ref: 00403CB1
                                                                                                                                                                                                      • strlen.MSVCRT ref: 00403CCF
                                                                                                                                                                                                      • strlen.MSVCRT ref: 00403CD9
                                                                                                                                                                                                      • RtlAllocateHeap.NTDLL(00000000,00000004), ref: 00403CEC
                                                                                                                                                                                                      • _mbscpy.MSVCRT(00000000,0040A040,?,?,00000000,?,?,?,?,?,?,00403F61,00000007,00000007,00000007,00000007), ref: 00403D01
                                                                                                                                                                                                      • _mbscat.MSVCRT ref: 00403D0A
                                                                                                                                                                                                      • _mbscat.MSVCRT ref: 00403D13
                                                                                                                                                                                                      • _mbscpy.MSVCRT(00000000,?,?,?,00000000,?,?,?,?,?,?,00403F61,00000007,00000007,00000007,00000007), ref: 00403D1F
                                                                                                                                                                                                      • _mbscat.MSVCRT ref: 00403D35
                                                                                                                                                                                                      • _mbscat.MSVCRT ref: 00403D3E
                                                                                                                                                                                                      • CreateProcessA.KERNELBASE(00000000,00001000,00000000,00000000,?,?,00000000,00000000,?,?,?,?,00000000), ref: 00403D6C
                                                                                                                                                                                                      • CloseHandle.KERNEL32(?,?,?,00000000,?,?,?,?,?,?,00403F61,00000007,00000007,00000007,00000007,00000000), ref: 00403D88
                                                                                                                                                                                                      • CloseHandle.KERNEL32(?,?,?,00000000,?,?,?,?,?,?,00403F61,00000007,00000007,00000007,00000007,00000000), ref: 00403D92
                                                                                                                                                                                                      • CloseHandle.KERNEL32(?,?,?,00000000,?,?,?,?,?,?,00403F61,00000007,00000007,00000007,00000007,00000000), ref: 00403D9C
                                                                                                                                                                                                      • CloseHandle.KERNEL32(?,?,?,00000000,?,?,?,?,?,?,00403F61,00000007,00000007,00000007,00000007,00000000), ref: 00403DA1
                                                                                                                                                                                                      • WaitForSingleObject.KERNEL32(?,000000FF,?,?,00000000,?,?,?,?,?,?,00403F61,00000007,00000007,00000007,00000007), ref: 00403DAE
                                                                                                                                                                                                      • RtlEnterCriticalSection.NTDLL(0040C6AC), ref: 00403DBF
                                                                                                                                                                                                      • RtlLeaveCriticalSection.NTDLL(0040C6AC), ref: 00403DD6
                                                                                                                                                                                                      • CloseHandle.KERNEL32(?,?,?,00000000,?,?,?,?,?,?,00403F61,00000007,00000007,00000007,00000007,00000000), ref: 00403E01
                                                                                                                                                                                                      • CloseHandle.KERNEL32(?,?,?,00000000,?,?,?,?,?,?,00403F61,00000007,00000007,00000007,00000007,00000000), ref: 00403E10
                                                                                                                                                                                                      • CloseHandle.KERNEL32(?,?,?,00000000,?,?,?,?,?,?,00403F61,00000007,00000007,00000007,00000007,00000000), ref: 00403E1A
                                                                                                                                                                                                      • CloseHandle.KERNEL32(?,?,?,00000000,?,?,?,?,?,?,00403F61,00000007,00000007,00000007,00000007,00000000), ref: 00403E24
                                                                                                                                                                                                      • CloseHandle.KERNEL32(?,?,?,00000000,?,?,?,?,?,?,00403F61,00000007,00000007,00000007,00000007,00000000), ref: 00403E2E
                                                                                                                                                                                                      • CloseHandle.KERNEL32(?,?,?,00000000,?,?,?,?,?,?,00403F61,00000007,00000007,00000007,00000007,00000000), ref: 00403E38
                                                                                                                                                                                                      • CloseHandle.KERNEL32(?,?,?,00000000,?,?,?,?,?,?,00403F61,00000007,00000007,00000007,00000007,00000000), ref: 00403E42
                                                                                                                                                                                                      • strlen.MSVCRT ref: 00403E54
                                                                                                                                                                                                      • _mbscpy.MSVCRT(00001000,?,?,?,00000000,?,?,?,?,?,?,00403F61,00000007,00000007,00000007,00000007), ref: 00403E74
                                                                                                                                                                                                      • memset.MSVCRT ref: 00403E90
                                                                                                                                                                                                      • ShellExecuteEx.SHELL32(?), ref: 00403EC3
                                                                                                                                                                                                      • WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,?,?,00000000,?,?,?,?,?,?,00403F61,00000007), ref: 00403ED8
                                                                                                                                                                                                      • RtlEnterCriticalSection.NTDLL(0040C6AC), ref: 00403EE9
                                                                                                                                                                                                      • RtlLeaveCriticalSection.NTDLL(0040C6AC), ref: 00403F00
                                                                                                                                                                                                      • CloseHandle.KERNEL32(?,?,?,?,?,?,00000000,?,?,?,?,?,?,00403F61,00000007,00000007), ref: 00403F20
                                                                                                                                                                                                        • Part of subcall function 00403B00: GetCurrentProcess.KERNEL32(?,00000000,00000000,00000002), ref: 00403B15
                                                                                                                                                                                                        • Part of subcall function 00403B00: GetCurrentProcess.KERNEL32(?,00000000), ref: 00403B1A
                                                                                                                                                                                                        • Part of subcall function 00403B00: DuplicateHandle.KERNELBASE(00000000,?,00000000), ref: 00403B1D
                                                                                                                                                                                                        • Part of subcall function 00403B00: CloseHandle.KERNELBASE(?,00000000), ref: 00403B2A
                                                                                                                                                                                                      • HeapFree.KERNEL32(00000000,00001000,?,?,00000000,?,?,?,?,?,?,00403F61,00000007,00000007,00000007,00000007), ref: 00403F37
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000008.00000002.2668306735.0000000000401000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000008.00000002.2668275549.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000008.00000002.2668343196.000000000040F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_8_2_400000_iDentalSoft-Bridge.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Handle$Close$CreateCriticalSection_mbscat$PipeProcess_mbscpystrlen$CurrentEnterHeapLeaveObjectSingleWaitmemset$AllocateDuplicateExecuteFreeShell
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 1814849317-0
                                                                                                                                                                                                      • Opcode ID: 6eef23b198fe4b29cd50e9f20cef373c26040aa67d80c30226190d8aa8e37777
                                                                                                                                                                                                      • Instruction ID: 3cb939683a3c1dec64f85f7962a3f2c881eb06cd3b6f96b860353bc8432f6771
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 6eef23b198fe4b29cd50e9f20cef373c26040aa67d80c30226190d8aa8e37777
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 2AE129728002889BDF21DF65C984ADE7FE8FF04355F24423BF964A22A1D7799944CF98
                                                                                                                                                                                                      Function 004066C3 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 66libraryloaderCOMMON
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                      control_flow_graph 447 4066c3-4066ee LoadLibraryA 448 4066f0-4066fd GetProcAddress 447->448 449 406738-406743 LoadLibraryA 447->449 452 406731-406732 FreeLibrary 448->452 453 4066ff-40671f memset 448->453 450 406774-40677b 449->450 451 406745-40674f GetProcAddress 449->451 454 406751-406755 451->454 455 40676d-40676e FreeLibrary 451->455 452->449 453->452 457 406721-40672e 453->457 459 406757-40675e 454->459 460 406769 454->460 455->450 457->452 459->460 461 406760-406767 459->461 460->455 461->455
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • LoadLibraryA.KERNEL32(COMCTL32.DLL,00000000,?,?,?,?,?,?,?,?), ref: 004066E2
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,DllGetVersion), ref: 004066F6
                                                                                                                                                                                                      • memset.MSVCRT ref: 00406707
                                                                                                                                                                                                      • FreeLibrary.KERNEL32(00000000,?,?,?,?,?,?,?,?), ref: 00406732
                                                                                                                                                                                                      • LoadLibraryA.KERNELBASE(uxtheme.dll,?,?,?,?,?,?,?,?), ref: 0040673D
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,IsAppThemed), ref: 0040674B
                                                                                                                                                                                                      • FreeLibrary.KERNELBASE(00000000,?,?,?,?,?,?,?,?), ref: 0040676E
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000008.00000002.2668306735.0000000000401000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000008.00000002.2668275549.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000008.00000002.2668343196.000000000040F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_8_2_400000_iDentalSoft-Bridge.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Library$AddressFreeLoadProc$memset
                                                                                                                                                                                                      • String ID: COMCTL32.DLL$DllGetVersion$IsAppThemed$uxtheme.dll
                                                                                                                                                                                                      • API String ID: 4277437538-2634860346
                                                                                                                                                                                                      • Opcode ID: 8fa42dfb82e97e1ded038ee5468e8bcb8ef58e48209b3964ba94ad0f1c96beeb
                                                                                                                                                                                                      • Instruction ID: 29adffb0537a8095f767590556b6627b4980c7c1b81a34347c362a4edfd75fdb
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 8fa42dfb82e97e1ded038ee5468e8bcb8ef58e48209b3964ba94ad0f1c96beeb
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 89118471E40319AADB109BA98D45BAE77F8EF44709F11403AE901F32C0D7B8D55487A9
                                                                                                                                                                                                      Function 00407093 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 39libraryloaderCOMMON
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      APIs
                                                                                                                                                                                                        • Part of subcall function 00408C90: RtlReAllocateHeap.NTDLL(02060000,00000000,020605D0,00004009), ref: 00408CD7
                                                                                                                                                                                                      • GetTempPathA.KERNEL32(00000104,00000000,00000104,00000007,?,?,?,00000000,00401C2A,00000000,00000000,00000400,00000000,00000000,00000000,00000000), ref: 004070AA
                                                                                                                                                                                                      • LoadLibraryA.KERNEL32(Kernel32.DLL,?,?,?,00000000,00401C2A,00000000,00000000,00000400,00000000,00000000,00000000,00000000,004013FC,OPS,00000000), ref: 004070B7
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,GetLongPathNameA), ref: 004070C9
                                                                                                                                                                                                      • GetLongPathNameA.KERNELBASE(00000000,00000000,00000104,?,?,?,00000000,00401C2A,00000000,00000000,00000400,00000000,00000000,00000000,00000000,004013FC), ref: 004070D6
                                                                                                                                                                                                      • FreeLibrary.KERNEL32(00000000,?,?,?,00000000,00401C2A,00000000,00000000,00000400,00000000,00000000,00000000,00000000,004013FC,OPS,00000000), ref: 004070DB
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000008.00000002.2668306735.0000000000401000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000008.00000002.2668275549.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000008.00000002.2668343196.000000000040F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_8_2_400000_iDentalSoft-Bridge.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: LibraryPath$AddressAllocateFreeHeapLoadLongNameProcTemp
                                                                                                                                                                                                      • String ID: GetLongPathNameA$Kernel32.DLL
                                                                                                                                                                                                      • API String ID: 752937943-822094646
                                                                                                                                                                                                      • Opcode ID: 5a44cc33fecf3925614352c9564a700b8f932fa77932e9f5333570b931ed1fbc
                                                                                                                                                                                                      • Instruction ID: 72a88410bef8bc3b5d791aaac90dbdebdb1f41cb3adf485473dd3328d19af203
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 5a44cc33fecf3925614352c9564a700b8f932fa77932e9f5333570b931ed1fbc
                                                                                                                                                                                                      • Instruction Fuzzy Hash: B2F05E322456186BD2212BB59D4CEAB7AACDFD6752B00413AF941B6281DB784C0082FE
                                                                                                                                                                                                      Function 00409BE8 Relevance: 9.1, APIs: 6, Instructions: 65libraryloaderCOMMON
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                      control_flow_graph 471 409be8-409bef GetModuleHandleA 472 409bf1-409c00 call 409c05 471->472 473 409c2f 471->473 482 409c02-409c0d GetProcAddress 472->482 483 409c67 472->483 475 409c31-409c35 473->475 477 409c74 call 409c79 475->477 478 409c37-409c3f GetModuleHandleA 475->478 481 409c41-409c49 478->481 481->481 484 409c4b-409c4e 481->484 482->473 486 409c0f-409c1c VirtualProtect 482->486 485 409c68-409c70 483->485 484->475 487 409c50-409c52 484->487 495 409c72 485->495 489 409c2e 486->489 490 409c1e-409c2c VirtualProtect 486->490 491 409c54-409c56 487->491 492 409c58-409c60 487->492 489->473 490->489 493 409c61-409c62 GetProcAddress 491->493 492->493 493->483 495->484
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetModuleHandleA.KERNEL32(00409BDF), ref: 00409BE8
                                                                                                                                                                                                      • GetModuleHandleA.KERNEL32(?,00409BDF), ref: 00409C3A
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,00000000), ref: 00409C62
                                                                                                                                                                                                        • Part of subcall function 00409C05: GetProcAddress.KERNEL32(00000000,00409BF6), ref: 00409C06
                                                                                                                                                                                                        • Part of subcall function 00409C05: VirtualProtect.KERNELBASE(?,00000078,00000004,?,00000000,00000000,00409BF6,00409BDF), ref: 00409C18
                                                                                                                                                                                                        • Part of subcall function 00409C05: VirtualProtect.KERNELBASE(?,00000078,?,?,?,00000000,00000000,00409BF6,00409BDF), ref: 00409C2C
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000008.00000002.2668306735.0000000000401000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000008.00000002.2668275549.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000008.00000002.2668343196.000000000040F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_8_2_400000_iDentalSoft-Bridge.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: AddressHandleModuleProcProtectVirtual
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 2099061454-0
                                                                                                                                                                                                      • Opcode ID: 18a205e926d3f8c1bd8ceb8f3c836a0ea39c7540959748e6d39d93322aab4e9f
                                                                                                                                                                                                      • Instruction ID: b3f14d8c643a817529a91d0531feaf9382b6a89f953afb1ccabdf31e52a8dbee
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 18a205e926d3f8c1bd8ceb8f3c836a0ea39c7540959748e6d39d93322aab4e9f
                                                                                                                                                                                                      • Instruction Fuzzy Hash: F7012610D4D24038FB2466750C4AABB9BD88A23324B181B7FB050B72D3D97C8D0693AE
                                                                                                                                                                                                      Function 0040677C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 41libraryloaderCOMMON
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                      control_flow_graph 496 40677c-40679c LoadLibraryA 497 40679e-4067aa GetProcAddress 496->497 498 4067af-4067cc GetVersionExA 496->498 497->498 499 4067ed-4067f3 498->499 500 4067ce-4067d2 498->500 503 406804-406809 499->503 504 4067f5 call 4066c3 499->504 501 4067d4-4067d8 500->501 502 4067fe 500->502 501->499 505 4067da-4067de 501->505 502->503 508 4067fa-4067fc 504->508 505->502 507 4067e0 505->507 507->499 509 4067e2-4067e5 507->509 508->502 508->503 509->499 510 4067e7 509->510 510->499
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • LoadLibraryA.KERNELBASE(msimg32.dll), ref: 0040678D
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,AlphaBlend), ref: 004067A4
                                                                                                                                                                                                      • GetVersionExA.KERNEL32(?), ref: 004067C4
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000008.00000002.2668306735.0000000000401000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000008.00000002.2668275549.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000008.00000002.2668343196.000000000040F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_8_2_400000_iDentalSoft-Bridge.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: AddressLibraryLoadProcVersion
                                                                                                                                                                                                      • String ID: AlphaBlend$msimg32.dll
                                                                                                                                                                                                      • API String ID: 2685220120-3639726679
                                                                                                                                                                                                      • Opcode ID: e27ce6381d850d576a666ab22aae412f6d83e954b13b6e56988abc3c65b3c9ac
                                                                                                                                                                                                      • Instruction ID: 31bf2c38b89a9ed1b7ba04b71be81f3e953177c1a5aa8cde6b3f111561f6038e
                                                                                                                                                                                                      • Opcode Fuzzy Hash: e27ce6381d850d576a666ab22aae412f6d83e954b13b6e56988abc3c65b3c9ac
                                                                                                                                                                                                      • Instruction Fuzzy Hash: B6015A30980205CADB319F719E48A6AB6F4EB85709F114A3BC002B22A0D73D8569CF6D
                                                                                                                                                                                                      Function 00407240 Relevance: 7.6, APIs: 5, Instructions: 112filememoryCOMMON
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                      control_flow_graph 511 407240-40725f call 40757d 514 407261-40727b CreateFileA 511->514 515 40727d-407280 511->515 516 4072e0-4072e3 514->516 517 407282-40729d CreateFileA 515->517 518 40729f-4072a2 515->518 521 4072e5-4072e9 516->521 522 407336-40733b 516->522 517->516 519 4072a4-4072c4 CreateFileA 518->519 520 4072dc 518->520 519->521 525 4072c6-4072da CreateFileA 519->525 520->516 521->522 526 4072eb-4072f2 521->526 523 40734a-407351 522->523 524 40733d-407345 call 40760c 522->524 524->523 525->516 528 4072f4-407306 RtlAllocateHeap 526->528 529 407308 526->529 530 40730b-407324 528->530 529->530 531 407326-40732d 530->531 532 40732e-407335 530->532
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • CreateFileA.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000,021705B8,0040B380,?,?,?,00000000,00000000,00407373,00000000), ref: 00407273
                                                                                                                                                                                                      • CreateFileA.KERNEL32(00000000,C0000000,00000001,00000000,00000004,00000080,00000000,021705B8,0040B380,?,?,?,00000000,00000000,00407373,00000000), ref: 00407295
                                                                                                                                                                                                      • RtlAllocateHeap.NTDLL(02170000,00000000,00001000), ref: 004072FD
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000008.00000002.2668306735.0000000000401000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000008.00000002.2668275549.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000008.00000002.2668343196.000000000040F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_8_2_400000_iDentalSoft-Bridge.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CreateFile$AllocateHeap
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 2813278966-0
                                                                                                                                                                                                      • Opcode ID: 384ea8a5cff3f469b9d3f410a385aebeeb774d6f6639ff6e6890c95d2ad9d6e8
                                                                                                                                                                                                      • Instruction ID: 9055807b1aff6c5b63cc3a592aa44b1e9d876b892c4390e008c72d3c7d18f0ef
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 384ea8a5cff3f469b9d3f410a385aebeeb774d6f6639ff6e6890c95d2ad9d6e8
                                                                                                                                                                                                      • Instruction Fuzzy Hash: B431BF72B48311BBE2305B28AD81F66B398E744774F20473AFA52B72C0C7B4BC41969D
                                                                                                                                                                                                      Function 00409BA9 Relevance: 7.6, APIs: 5, Instructions: 100libraryloaderCOMMON
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                      control_flow_graph 533 409ba9-409bbe 534 409bc0-409bc8 533->534 535 409c2f 533->535 534->535 537 409bca-409bf8 call 409be8 534->537 536 409c31-409c35 535->536 538 409c74 call 409c79 536->538 539 409c37-409c3f GetModuleHandleA 536->539 545 409bfa 537->545 546 409c6e-409c70 537->546 542 409c41-409c49 539->542 542->542 544 409c4b-409c4e 542->544 544->536 551 409c50-409c52 544->551 547 409bfc-409c00 545->547 548 409c5d-409c60 545->548 549 409c72 546->549 550 409c68-409c6d 546->550 556 409c67 547->556 557 409c02-409c0d GetProcAddress 547->557 553 409c61-409c62 GetProcAddress 548->553 549->544 550->546 554 409c54-409c56 551->554 555 409c58-409c5c 551->555 553->556 554->553 555->548 556->550 557->535 558 409c0f-409c1c VirtualProtect 557->558 559 409c2e 558->559 560 409c1e-409c2c VirtualProtect 558->560 559->535 560->559
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetModuleHandleA.KERNEL32(?,00409BDF), ref: 00409C3A
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,00000000), ref: 00409C62
                                                                                                                                                                                                        • Part of subcall function 00409BE8: GetModuleHandleA.KERNEL32(00409BDF), ref: 00409BE8
                                                                                                                                                                                                        • Part of subcall function 00409BE8: GetProcAddress.KERNEL32(00000000,00409BF6), ref: 00409C06
                                                                                                                                                                                                        • Part of subcall function 00409BE8: VirtualProtect.KERNELBASE(?,00000078,00000004,?,00000000,00000000,00409BF6,00409BDF), ref: 00409C18
                                                                                                                                                                                                        • Part of subcall function 00409BE8: VirtualProtect.KERNELBASE(?,00000078,?,?,?,00000000,00000000,00409BF6,00409BDF), ref: 00409C2C
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000008.00000002.2668306735.0000000000401000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000008.00000002.2668275549.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000008.00000002.2668343196.000000000040F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_8_2_400000_iDentalSoft-Bridge.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: AddressHandleModuleProcProtectVirtual
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 2099061454-0
                                                                                                                                                                                                      • Opcode ID: 731a18adefd9f684ec9123585341c8004b06a9316977ab842e52f252e525921e
                                                                                                                                                                                                      • Instruction ID: 2b1aae80adb7c037415a3cef0287785e0433969e50536ff1109ccd4607fff3c5
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 731a18adefd9f684ec9123585341c8004b06a9316977ab842e52f252e525921e
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 6621242184C2812FFB219B744C457A67BD89B13324F190ABBD040EB2C3D17D8C4693AE
                                                                                                                                                                                                      Function 00409C05 Relevance: 7.6, APIs: 5, Instructions: 54librarymemoryloaderCOMMON
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                      control_flow_graph 561 409c05-409c0d GetProcAddress 562 409c2f 561->562 563 409c0f-409c1c VirtualProtect 561->563 566 409c31-409c35 562->566 564 409c2e 563->564 565 409c1e-409c2c VirtualProtect 563->565 564->562 565->564 567 409c74 call 409c79 566->567 568 409c37-409c3f GetModuleHandleA 566->568 570 409c41-409c49 568->570 570->570 571 409c4b-409c4e 570->571 571->566 572 409c50-409c52 571->572 573 409c54-409c56 572->573 574 409c58-409c60 572->574 575 409c61-409c67 GetProcAddress 573->575 574->575 578 409c68-409c70 575->578 580 409c72 578->580 580->571
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,00409BF6), ref: 00409C06
                                                                                                                                                                                                      • VirtualProtect.KERNELBASE(?,00000078,00000004,?,00000000,00000000,00409BF6,00409BDF), ref: 00409C18
                                                                                                                                                                                                      • VirtualProtect.KERNELBASE(?,00000078,?,?,?,00000000,00000000,00409BF6,00409BDF), ref: 00409C2C
                                                                                                                                                                                                      • GetModuleHandleA.KERNEL32(?,00409BDF), ref: 00409C3A
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,00000000), ref: 00409C62
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000008.00000002.2668306735.0000000000401000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000008.00000002.2668275549.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000008.00000002.2668343196.000000000040F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_8_2_400000_iDentalSoft-Bridge.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: AddressProcProtectVirtual$HandleModule
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 2152742572-0
                                                                                                                                                                                                      • Opcode ID: f81dfe0726a7f77e278230a0c4648d339da411b55a21776b762b5ef698216b3c
                                                                                                                                                                                                      • Instruction ID: 012f06d227ef081f7d54349b2c409d90998df5c2979c9094267f9abbe5a95287
                                                                                                                                                                                                      • Opcode Fuzzy Hash: f81dfe0726a7f77e278230a0c4648d339da411b55a21776b762b5ef698216b3c
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 5DF0AF41E8D6403CFA2156740C45ABB9BCC8A67320B281A2BA150E72C3C4BD8D0693BE
                                                                                                                                                                                                      Function 00407480 Relevance: 6.1, APIs: 4, Instructions: 105COMMON
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                      control_flow_graph 581 407480-407493 582 4074b5-4074be 581->582 583 407495-4074b2 SetFilePointer 581->583 584 4074c0-4074cd 582->584 585 40752e-40752f call 407170 582->585 583->582 586 40751b-40752b 584->586 587 4074cf-4074d2 584->587 591 407534-407539 585->591 589 4074d4-4074d7 587->589 590 407506-407518 587->590 592 4074f3-407503 589->592 593 4074d9-4074f0 memcpy 589->593 594 40755b-40757a memcpy 591->594 595 40753b-407558 WriteFile 591->595
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • SetFilePointer.KERNELBASE(-00000001,?,00000000,00000001,00000001,00000000,-00000001,004073E8,00000000,00000000,-00000001,?,021705B8,00001000), ref: 004074A2
                                                                                                                                                                                                      • memcpy.MSVCRT(?,00000007,0040B380,00000001,00000000,-00000001,004073E8,00000000,00000000,-00000001,?,021705B8,00001000,?,?,00401A90), ref: 004074E0
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000008.00000002.2668306735.0000000000401000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000008.00000002.2668275549.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000008.00000002.2668343196.000000000040F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_8_2_400000_iDentalSoft-Bridge.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: FilePointermemcpy
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 1104741977-0
                                                                                                                                                                                                      • Opcode ID: 13441793e79940afef9dffdfc499ee02cc0f525eeae225fb6be82ca598f5f356
                                                                                                                                                                                                      • Instruction ID: 8ca4f13d98cfc65918fea69c88921ebcb7a57d942de438e3a8586f158f6ec4b8
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 13441793e79940afef9dffdfc499ee02cc0f525eeae225fb6be82ca598f5f356
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 3D318C767006019FC224DF2AE848D5BF7E5EFD4321B14C82EE69693B90C634E844CB66
                                                                                                                                                                                                      Function 00401621 Relevance: 6.0, APIs: 4, Instructions: 25memoryCOMMON
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                      control_flow_graph 596 401621 597 4016b2-4016b3 call 405706 596->597 601 401626-40162e 597->601 602 40160c-40161c RemoveDirectoryA 597->602 604 401630-40163e call 40570e 601->604 605 40166d-401675 601->605 603 401bcd-401bdd ExitProcess HeapDestroy ExitProcess 602->603 610 401640-401668 call 404c42 call 408a10 call 404fa3 604->610 611 40166a-40166b 604->611 605->597 607 401677-401685 call 40571d 605->607 614 4016b1 607->614 615 401687-4016af call 404c42 call 408a10 call 404fa3 607->615 627 4016b8-40170d call 403210 call 407c10 call 404360 call 408a90 610->627 611->597 614->597 615->627 636 40173a-40174c call 4020bb 627->636 637 40170f-401735 call 40368b RemoveDirectoryA 627->637 642 401758-4017e9 call 401d66 call 404360 call 408a10 call 404360 call 408a10 call 4020bb 636->642 643 40174e-401753 636->643 637->603 656 401a3c-401a7e call 408ac0 * 3 call 408a10 call 407360 642->656 657 4017ef-401837 call 403a44 call 404360 call 408a90 642->657 643->642 681 401a80-401ae4 call 4073a0 call 4071b0 call 408a90 656->681 682 401a9c-401ad2 call 407081 call 40202f call 40368b RemoveDirectoryA 656->682 670 401839-401842 657->670 671 40184b 657->671 670->671 674 401844-401849 670->674 675 40184d-40184f 671->675 674->675 675->656 677 401855-40189a call 406fb6 call 4036e1 call 408a10 call 408a90 675->677 702 4018a0-4018c8 call 408ac0 call 408a10 call 408a90 677->702 703 4019ec-401a37 call 403aa5 call 406ff6 call 407071 RemoveDirectoryA 677->703 704 401af1-401bc6 call 408ac0 * 2 call 403f4a call 403f84 call 403f92 call 403fb0 call 40202f call 407081 call 403aa5 call 406ff6 call 407071 RemoveDirectoryA 681->704 705 401ae6-401aec call 402122 681->705 682->603 725 4018d5-4018e7 call 407380 702->725 726 4018ca-4018d0 call 402122 702->726 703->603 704->603 705->704 732 4018ed-40196c call 4071b0 call 408ac0 * 5 call 40368b 725->732 733 4019be-4019d0 call 407360 725->733 726->725 732->733 768 40196e-4019b9 call 403aa5 call 406ff6 call 407071 RemoveDirectoryA 732->768 733->703 743 4019d2-4019e7 call 4073a0 call 4071b0 733->743 743->703 768->603
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • RemoveDirectoryA.KERNEL32(00000000,00000002,INOPS,BDFINOPS,00000000,NOPS,OPS,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000008), ref: 00401612
                                                                                                                                                                                                      • RemoveDirectoryA.KERNEL32(00000010,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0040172B
                                                                                                                                                                                                      • ExitProcess.KERNEL32(00000001,00000010,OPS,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000008,00000400,00000008,00000401,00000007), ref: 00401BCD
                                                                                                                                                                                                      • HeapDestroy.KERNEL32(00000001,00000010,OPS,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000008,00000400,00000008,00000401,00000007), ref: 00401BD8
                                                                                                                                                                                                      • ExitProcess.KERNEL32(00000001,00000010,OPS,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000008,00000400,00000008,00000401,00000007), ref: 00401BDD
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000008.00000002.2668306735.0000000000401000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000008.00000002.2668275549.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000008.00000002.2668343196.000000000040F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_8_2_400000_iDentalSoft-Bridge.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: DirectoryExitProcessRemove$DestroyHeap
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 3087781131-0
                                                                                                                                                                                                      • Opcode ID: ccada4885949330225bca93c9cd36014dfbff83b31cc86568b5723ee7269d148
                                                                                                                                                                                                      • Instruction ID: a7fecadcb8f71ae5a653cbbad86e024187f16c396c6ed3384154a95251333d42
                                                                                                                                                                                                      • Opcode Fuzzy Hash: ccada4885949330225bca93c9cd36014dfbff83b31cc86568b5723ee7269d148
                                                                                                                                                                                                      • Instruction Fuzzy Hash: C9E0EE68215204AAC5643BF39983A1D6564AF8034CF50483FBA42750E7893D2492697F
                                                                                                                                                                                                      Function 00403B00 Relevance: 6.0, APIs: 4, Instructions: 25COMMON
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                      control_flow_graph 775 403b00-403b26 GetCurrentProcess * 2 DuplicateHandle 776 403b35-403b36 775->776 777 403b28-403b33 CloseHandle 775->777 777->776
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetCurrentProcess.KERNEL32(?,00000000,00000000,00000002), ref: 00403B15
                                                                                                                                                                                                      • GetCurrentProcess.KERNEL32(?,00000000), ref: 00403B1A
                                                                                                                                                                                                      • DuplicateHandle.KERNELBASE(00000000,?,00000000), ref: 00403B1D
                                                                                                                                                                                                      • CloseHandle.KERNELBASE(?,00000000), ref: 00403B2A
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000008.00000002.2668306735.0000000000401000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000008.00000002.2668275549.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000008.00000002.2668343196.000000000040F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_8_2_400000_iDentalSoft-Bridge.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CurrentHandleProcess$CloseDuplicate
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 1410216518-0
                                                                                                                                                                                                      • Opcode ID: eac585ab1afbbf74acce16f2361893e95ba4b3130cf779a90ba43245fa2cecf1
                                                                                                                                                                                                      • Instruction ID: 150f4003f54e6b87e5a01611ca859cb65212b59b0425e3bd3d442c2791e9e493
                                                                                                                                                                                                      • Opcode Fuzzy Hash: eac585ab1afbbf74acce16f2361893e95ba4b3130cf779a90ba43245fa2cecf1
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 6EE01A75600219BFEB119BA1DD09F9A7FACEB44710F100021F500E3290DBB5AD108B98
                                                                                                                                                                                                      Function 00401C0B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 91COMMON
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      APIs
                                                                                                                                                                                                        • Part of subcall function 00404340: RtlAllocateHeap.NTDLL(02350000,00000008,00000000), ref: 00404351
                                                                                                                                                                                                        • Part of subcall function 00407093: GetTempPathA.KERNEL32(00000104,00000000,00000104,00000007,?,?,?,00000000,00401C2A,00000000,00000000,00000400,00000000,00000000,00000000,00000000), ref: 004070AA
                                                                                                                                                                                                        • Part of subcall function 00407093: LoadLibraryA.KERNEL32(Kernel32.DLL,?,?,?,00000000,00401C2A,00000000,00000000,00000400,00000000,00000000,00000000,00000000,004013FC,OPS,00000000), ref: 004070B7
                                                                                                                                                                                                        • Part of subcall function 00407093: GetProcAddress.KERNEL32(00000000,GetLongPathNameA), ref: 004070C9
                                                                                                                                                                                                        • Part of subcall function 00407093: GetLongPathNameA.KERNELBASE(00000000,00000000,00000104,?,?,?,00000000,00401C2A,00000000,00000000,00000400,00000000,00000000,00000000,00000000,004013FC), ref: 004070D6
                                                                                                                                                                                                        • Part of subcall function 00407093: FreeLibrary.KERNEL32(00000000,?,?,?,00000000,00401C2A,00000000,00000000,00000400,00000000,00000000,00000000,00000000,004013FC,OPS,00000000), ref: 004070DB
                                                                                                                                                                                                        • Part of subcall function 00408A10: RtlAllocateHeap.NTDLL(02060000,00000000,?), ref: 00408A36
                                                                                                                                                                                                      • GetTempFileNameA.KERNEL32(00000000,0040B00D,00000000,?,00000000,00000400,00000000,00000000,00000000,00000000,004013FC,OPS,00000000,00000000,00000000,00000000), ref: 00401C45
                                                                                                                                                                                                        • Part of subcall function 004043D0: memcpy.MSVCRT(00000000,00000000,00000000,00000000,00000007,?,?,00000000,00401C5A,00000000,00000000,00000000,00000000,0040B00D,00000000), ref: 00404403
                                                                                                                                                                                                        • Part of subcall function 00408A10: RtlReAllocateHeap.NTDLL(02060000,00000000,?,?), ref: 00408A59
                                                                                                                                                                                                        • Part of subcall function 004043B0: HeapFree.KERNEL32(02350000,00000000,00000000,00401149,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000008,00000400,00000008,00000401,00000007), ref: 004043BE
                                                                                                                                                                                                        • Part of subcall function 004070F4: strncpy.MSVCRT ref: 00407112
                                                                                                                                                                                                        • Part of subcall function 004070F4: strlen.MSVCRT ref: 00407122
                                                                                                                                                                                                        • Part of subcall function 004070F4: CreateDirectoryA.KERNELBASE(?,00000000), ref: 0040715F
                                                                                                                                                                                                        • Part of subcall function 00406FB6: GetCurrentDirectoryA.KERNEL32(00000104,00000000,00000104,00000000,?,?,00000000,00401C8E,00000000,00000000,?,00000000,00000000,00000000,0040B00D,00000000), ref: 00406FCC
                                                                                                                                                                                                      • PathQuoteSpacesA.SHLWAPI(00000000,00000000,?,00000000,00000000,00000000,0040B00D,00000000,?,00000000,00000400,00000000,00000000,00000000,00000000,004013FC), ref: 00401CC2
                                                                                                                                                                                                        • Part of subcall function 00408AC0: strlen.MSVCRT ref: 00408AD3
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000008.00000002.2668306735.0000000000401000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000008.00000002.2668275549.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000008.00000002.2668343196.000000000040F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_8_2_400000_iDentalSoft-Bridge.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Heap$AllocatePath$DirectoryFreeLibraryNameTempstrlen$AddressCreateCurrentFileLoadLongProcQuoteSpacesmemcpystrncpy
                                                                                                                                                                                                      • String ID: "*
                                                                                                                                                                                                      • API String ID: 1352337101-3137671172
                                                                                                                                                                                                      • Opcode ID: 80356786d3e259c3a9dd09b0fb16fb247a13e8bdc416a0e28e455fd682a15492
                                                                                                                                                                                                      • Instruction ID: efbfc2a8cabe16701036968d4699bbf98d51b6d74f8a6505cad3177f6fb2350e
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 80356786d3e259c3a9dd09b0fb16fb247a13e8bdc416a0e28e455fd682a15492
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 0D314270614300EFC710FF75EDC2A1A76A4AB84308F00593FF981B65E2C63DA8548B5E
                                                                                                                                                                                                      Function 004070F4 Relevance: 4.5, APIs: 3, Instructions: 38stringCOMMON
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                      control_flow_graph 825 4070f4-407101 826 407103-407131 strncpy strlen 825->826 827 407167 825->827 828 407149-407151 826->828 829 407169-40716a 827->829 830 407133-40713b 828->830 831 407153-407165 CreateDirectoryA 828->831 832 407147 830->832 833 40713d-407140 830->833 831->829 832->828 833->832 834 407142-407145 833->834 834->831 834->832
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000008.00000002.2668306735.0000000000401000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000008.00000002.2668275549.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000008.00000002.2668343196.000000000040F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_8_2_400000_iDentalSoft-Bridge.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CreateDirectorystrlenstrncpy
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 2535372781-0
                                                                                                                                                                                                      • Opcode ID: 49530ba3654961a593c764a15b7bf2216fa9ee68c493e7432672a19b3a82b6ee
                                                                                                                                                                                                      • Instruction ID: ff39c0eefe1a6465749d8ebc075b7c52c3f8efb766a05d9f33cb931501f6f224
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 49530ba3654961a593c764a15b7bf2216fa9ee68c493e7432672a19b3a82b6ee
                                                                                                                                                                                                      • Instruction Fuzzy Hash: FB01D67180C1089AEB24DA24CC89BDA776D5B10304F4040B690C4FA3C1DBBCAEC8CB5B
                                                                                                                                                                                                      Function 00408817 Relevance: 3.1, APIs: 2, Instructions: 56memoryCOMMON
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                      control_flow_graph 835 408817-408844 call 4088c7 RtlAllocateHeap 838 408846-408885 memset call 409354 835->838 839 40889f-4088a5 835->839 838->839 842 408887-40888c 838->842 842->839 843 40888e 842->843 844 408890-40889d call 40939f 843->844 844->839
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                        • Part of subcall function 004088C7: HeapFree.KERNEL32(00000000,-00000018,?,00408827,0040B380,?,?,?,?,004010CE,00000008,00000401,00000007,0040B378,0040C414,00000008), ref: 00408908
                                                                                                                                                                                                      • RtlAllocateHeap.NTDLL(00000000,00000FE8,0040B380), ref: 0040883A
                                                                                                                                                                                                      • memset.MSVCRT ref: 00408871
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000008.00000002.2668306735.0000000000401000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000008.00000002.2668275549.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000008.00000002.2668343196.000000000040F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_8_2_400000_iDentalSoft-Bridge.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Heap$AllocateFreememset
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 2774703448-0
                                                                                                                                                                                                      • Opcode ID: a9345ad10709ae3f73e3662bca564f26d2c11d6b766769fbdc9b5a4865c3f1b9
                                                                                                                                                                                                      • Instruction ID: b4cf919086a2ba4daa663e02e5ff3c442562578a631064c373d84b4a780bfb63
                                                                                                                                                                                                      • Opcode Fuzzy Hash: a9345ad10709ae3f73e3662bca564f26d2c11d6b766769fbdc9b5a4865c3f1b9
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 13119172500604ABCB20EF19DD80E4B7BE5FF54710F04812EFD48AB392D734E8108BA8
                                                                                                                                                                                                      Function 00407642 Relevance: 3.0, APIs: 2, Instructions: 26memoryCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • RtlAllocateHeap.NTDLL(00000008,00000020), ref: 00407654
                                                                                                                                                                                                      • RtlAllocateHeap.NTDLL(00000008,00001000), ref: 0040767F
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000008.00000002.2668306735.0000000000401000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000008.00000002.2668275549.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000008.00000002.2668343196.000000000040F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_8_2_400000_iDentalSoft-Bridge.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: AllocateHeap
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 1279760036-0
                                                                                                                                                                                                      • Opcode ID: 006de325926ba9b776d03c2a1d76b087c51114f9fbe5b920b0168f2300a0a89c
                                                                                                                                                                                                      • Instruction ID: 7d287a0e38eaa6b29913c92f4e90fea094001a5c4448f88d95476b5ccb2f4a14
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 006de325926ba9b776d03c2a1d76b087c51114f9fbe5b920b0168f2300a0a89c
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 54F0F8712447009FD324DF19DD46B16FBE8EB94710F00892EE495977A0C7B0A8048F94
                                                                                                                                                                                                      Function 004089C0 Relevance: 3.0, APIs: 2, Instructions: 18memoryCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • HeapCreate.KERNELBASE(00000000,00001000,00000000), ref: 004089CC
                                                                                                                                                                                                      • RtlAllocateHeap.NTDLL(02060000,00000000,0000400E), ref: 004089FA
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000008.00000002.2668306735.0000000000401000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000008.00000002.2668275549.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000008.00000002.2668343196.000000000040F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_8_2_400000_iDentalSoft-Bridge.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Heap$AllocateCreate
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 2875408731-0
                                                                                                                                                                                                      • Opcode ID: 0460397e272d789a4286bbdeec23928c6b5d2262ecfcd3204b026d6b85f6215a
                                                                                                                                                                                                      • Instruction ID: 92618b35f23e0a077ec281cebfd1d678963bd7c76535e03d68dd9f55b220fb03
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 0460397e272d789a4286bbdeec23928c6b5d2262ecfcd3204b026d6b85f6215a
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 62E0EC71144305EFE3118F60EE95B123BA8F344B01F10423DFA05AB2E0C7B654008F9C
                                                                                                                                                                                                      Function 004030C0 Relevance: 1.5, APIs: 1, Instructions: 42COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                        • Part of subcall function 00408C90: RtlReAllocateHeap.NTDLL(02060000,00000000,020605D0,00004009), ref: 00408CD7
                                                                                                                                                                                                      • CharLowerA.USER32(00000000,00000000,00000007,00001000,?,?,?,00401126,00000008,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0040310D
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000008.00000002.2668306735.0000000000401000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000008.00000002.2668275549.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000008.00000002.2668343196.000000000040F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_8_2_400000_iDentalSoft-Bridge.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: AllocateCharHeapLower
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 3771757506-0
                                                                                                                                                                                                      • Opcode ID: 2610a82d01faad8bd562a4e21d9c19c3477e938c3403413eb3437c7db3f4c668
                                                                                                                                                                                                      • Instruction ID: 0e42a24b36d34633b8293e0276d0e60b3ab970adceed7f2aa10bd17cf4e10567
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 2610a82d01faad8bd562a4e21d9c19c3477e938c3403413eb3437c7db3f4c668
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 4BF090336026205BC6116A695D85B9B6BDC9FDA315F18847BF980EB346CA789C0483B9
                                                                                                                                                                                                      Function 00408C90 Relevance: 1.5, APIs: 1, Instructions: 33memoryCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • RtlReAllocateHeap.NTDLL(02060000,00000000,020605D0,00004009), ref: 00408CD7
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000008.00000002.2668306735.0000000000401000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000008.00000002.2668275549.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000008.00000002.2668343196.000000000040F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_8_2_400000_iDentalSoft-Bridge.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: AllocateHeap
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 1279760036-0
                                                                                                                                                                                                      • Opcode ID: e370f2d00e8407b4bc25fd2cec3bc0f64c68de425838fa330c707f6fa4bb7f5d
                                                                                                                                                                                                      • Instruction ID: c2dce9ae5a51631cd30a8f1b3b5a2a237bd63c84fd4f988d4f4f1d5efcacd964
                                                                                                                                                                                                      • Opcode Fuzzy Hash: e370f2d00e8407b4bc25fd2cec3bc0f64c68de425838fa330c707f6fa4bb7f5d
                                                                                                                                                                                                      • Instruction Fuzzy Hash: AE01B275900209EFC704DF58EAD1A597BB4FB48704F50826EE949A7350D730A950CF9D
                                                                                                                                                                                                      Function 00407170 Relevance: 1.5, APIs: 1, Instructions: 24fileCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • WriteFile.KERNELBASE(00000000,?,?,00000000,00000000,00001000,?,00407534,00001000,00000001,00000000,-00000001,004073E8,00000000,00000000,-00000001), ref: 00407195
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000008.00000002.2668306735.0000000000401000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000008.00000002.2668275549.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000008.00000002.2668343196.000000000040F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_8_2_400000_iDentalSoft-Bridge.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: FileWrite
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 3934441357-0
                                                                                                                                                                                                      • Opcode ID: a81e2f44391c9a269d7984e63fbda591ec8b1a9a7f20cf79f77764f262a4e34c
                                                                                                                                                                                                      • Instruction ID: 1a09e024b85fc8d36d57fcab1c84b46f86fbcba6a84a2829266daece83452dbd
                                                                                                                                                                                                      • Opcode Fuzzy Hash: a81e2f44391c9a269d7984e63fbda591ec8b1a9a7f20cf79f77764f262a4e34c
                                                                                                                                                                                                      • Instruction Fuzzy Hash: A5E0AEB6518701AFD324CF68C948C67B7E8EB88710B00C92EE49A93740E630F840CBA5
                                                                                                                                                                                                      Function 00403F92 Relevance: 1.5, APIs: 1, Instructions: 12COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetExitCodeProcess.KERNELBASE(?,00000000), ref: 00403FA3
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000008.00000002.2668306735.0000000000401000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000008.00000002.2668275549.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000008.00000002.2668343196.000000000040F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_8_2_400000_iDentalSoft-Bridge.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CodeExitProcess
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 3861947596-0
                                                                                                                                                                                                      • Opcode ID: d07a4108ead07357e90e00c2126670032d414a894ea98827945bffd78f1319a5
                                                                                                                                                                                                      • Instruction ID: 0a65479a21e45348e978c894f371be88cb633bc30707475917e63a0ba1ad0295
                                                                                                                                                                                                      • Opcode Fuzzy Hash: d07a4108ead07357e90e00c2126670032d414a894ea98827945bffd78f1319a5
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 78D0927551010CEBCB00CB84D945A8DB7B8EB05349F104068E504E3150C774AA049BA9
                                                                                                                                                                                                      Function 00404310 Relevance: 1.5, APIs: 1, Instructions: 6memoryCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • HeapCreate.KERNELBASE(00000000,00001000,00000000,00401080,00000000,00001000,00000000,00000000), ref: 00404319
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000008.00000002.2668306735.0000000000401000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000008.00000002.2668275549.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000008.00000002.2668343196.000000000040F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_8_2_400000_iDentalSoft-Bridge.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CreateHeap
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 10892065-0
                                                                                                                                                                                                      • Opcode ID: 0cc3d4e8dc555790d6f4f22ab2e10a4d1e5d914665079a18ca1bb0e6cb5e43ab
                                                                                                                                                                                                      • Instruction ID: 15ac0076a0c7f05aeee8a38a0fb90f3f99816b24b2138835f24b555861bc2c95
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 0cc3d4e8dc555790d6f4f22ab2e10a4d1e5d914665079a18ca1bb0e6cb5e43ab
                                                                                                                                                                                                      • Instruction Fuzzy Hash: D5B0127028230096E2210B205E06F003510D344B43F100021B600791D4CBF01000550C
                                                                                                                                                                                                      Function 0040680A Relevance: 1.5, APIs: 1, Instructions: 3COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • FreeLibrary.KERNELBASE(00401C05,00401BD2,00000001,00000010,OPS,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000008,00000400,00000008), ref: 00406810
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000008.00000002.2668306735.0000000000401000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000008.00000002.2668275549.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000008.00000002.2668343196.000000000040F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_8_2_400000_iDentalSoft-Bridge.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: FreeLibrary
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 3664257935-0
                                                                                                                                                                                                      • Opcode ID: 9b0f40cd61892fc70ce0158db1758b139bd3cfe43f58afc2b522d06080b75a6b
                                                                                                                                                                                                      • Instruction ID: 9fb862f7f9d09240fa3aa61bfe96f5871aa645b070acb05cc42e7a8c9316e7f0
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 9b0f40cd61892fc70ce0158db1758b139bd3cfe43f58afc2b522d06080b75a6b
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 13900270580001CBCE125B21EF4D9143A21E7913013001B719446611308B720410DE4C
                                                                                                                                                                                                      Function 0040367D Relevance: 1.3, APIs: 1, Instructions: 4COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • CoInitialize.OLE32(00000000), ref: 00403684
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000008.00000002.2668306735.0000000000401000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000008.00000002.2668275549.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000008.00000002.2668343196.000000000040F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_8_2_400000_iDentalSoft-Bridge.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Initialize
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 2538663250-0
                                                                                                                                                                                                      • Opcode ID: b943fbd95a0712220f921872ece2dfd8b45050e44baeefac14e4eed9e93175bd
                                                                                                                                                                                                      • Instruction ID: da55ce976a165c3c3c5e71cb006638cf1e78af0a8afda7f31b812d9358d8a7a0
                                                                                                                                                                                                      • Opcode Fuzzy Hash: b943fbd95a0712220f921872ece2dfd8b45050e44baeefac14e4eed9e93175bd
                                                                                                                                                                                                      • Instruction Fuzzy Hash: BFA0026159920656DD407B619A6A7083B10AB41706F109475B249751E64F741400965D

                                                                                                                                                                                                      Non-executed Functions

                                                                                                                                                                                                      Function 00404D5A Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 61nativeCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetWindowLongA.USER32(?,000000F4), ref: 00404D65
                                                                                                                                                                                                      • CallWindowProcA.USER32(?,?,?,?,?), ref: 00404D8E
                                                                                                                                                                                                      • RemovePropA.USER32(?,PB_ID), ref: 00404DB9
                                                                                                                                                                                                      • RemovePropA.USER32(?,PB_DropAccept), ref: 00404DC1
                                                                                                                                                                                                      • RevokeDragDrop.OLE32(?), ref: 00404DC8
                                                                                                                                                                                                      • SetWindowLongA.USER32(?,000000F4,000000FF), ref: 00404DD3
                                                                                                                                                                                                      • NtdllDefWindowProc_A.NTDLL(?,?,?,?), ref: 00404DF5
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000008.00000002.2668306735.0000000000401000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000008.00000002.2668275549.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000008.00000002.2668343196.000000000040F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_8_2_400000_iDentalSoft-Bridge.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Window$LongPropRemove$CallDragDropNtdllProcProc_Revoke
                                                                                                                                                                                                      • String ID: PB_DropAccept$PB_ID
                                                                                                                                                                                                      • API String ID: 1182866496-3688647018
                                                                                                                                                                                                      • Opcode ID: ebdee6ff6217ff9f95dbc63fa9a7d29ca941c0d69d06b50d55670692e88358c9
                                                                                                                                                                                                      • Instruction ID: ead1c39f7aec5a8eab3416255a9681b162ab2c33edc82fc5966ac8f142170f86
                                                                                                                                                                                                      • Opcode Fuzzy Hash: ebdee6ff6217ff9f95dbc63fa9a7d29ca941c0d69d06b50d55670692e88358c9
                                                                                                                                                                                                      • Instruction Fuzzy Hash: E7118F72004119BFCB116F65DD84CAF3BA9EF85774714822AF920722F0CB3598219BA9
                                                                                                                                                                                                      Function 00409901 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 71memorynativeCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • sprintf.MSVCRT ref: 00409918
                                                                                                                                                                                                      • GetPropA.USER32(?,?), ref: 00409927
                                                                                                                                                                                                      • HeapFree.KERNEL32(00000000,?), ref: 0040997C
                                                                                                                                                                                                      • HeapFree.KERNEL32(00000000,00000000), ref: 00409986
                                                                                                                                                                                                      • RemovePropA.USER32(?,?), ref: 0040998F
                                                                                                                                                                                                      • CallWindowProcA.USER32(?,?,00000082,?,?), ref: 004099AA
                                                                                                                                                                                                      • NtdllDefWindowProc_A.NTDLL(?,?,?,?), ref: 004099BE
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000008.00000002.2668306735.0000000000401000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000008.00000002.2668275549.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000008.00000002.2668343196.000000000040F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_8_2_400000_iDentalSoft-Bridge.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: FreeHeapPropWindow$CallNtdllProcProc_Removesprintf
                                                                                                                                                                                                      • String ID: PB_GadgetStack_%i
                                                                                                                                                                                                      • API String ID: 1062891511-1190326050
                                                                                                                                                                                                      • Opcode ID: f2464fe74b81994a3a6e002010a29036db3a6ebe3e4be76ae4ae1fc75656dea4
                                                                                                                                                                                                      • Instruction ID: 2b9bafe76e6dfb249967f0d40c0f5119a13052d5ce23757034872ee5a1def677
                                                                                                                                                                                                      • Opcode Fuzzy Hash: f2464fe74b81994a3a6e002010a29036db3a6ebe3e4be76ae4ae1fc75656dea4
                                                                                                                                                                                                      • Instruction Fuzzy Hash: E521F8B2500109FFCF01AF95DE84CAA7BBAFB44344B04803AF905A62B1D7359E60DF99
                                                                                                                                                                                                      Function 004061E3 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 60nativeCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                        • Part of subcall function 00405D45: GetPropA.USER32(?,PB_WindowID), ref: 00405D8C
                                                                                                                                                                                                        • Part of subcall function 00405D45: GetParent.USER32(?), ref: 00405D9C
                                                                                                                                                                                                      • GetPropA.USER32(?,PB_MDI_Gadget), ref: 0040620B
                                                                                                                                                                                                      • DefFrameProcA.USER32(?,00000000,?,?,?), ref: 0040624C
                                                                                                                                                                                                      • SetLastError.KERNEL32(00000000), ref: 00406256
                                                                                                                                                                                                      • NtdllDefWindowProc_A.NTDLL(?,?,?,?), ref: 0040626C
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000008.00000002.2668306735.0000000000401000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000008.00000002.2668275549.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000008.00000002.2668343196.000000000040F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_8_2_400000_iDentalSoft-Bridge.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Prop$ErrorFrameLastNtdllParentProcProc_Window
                                                                                                                                                                                                      • String ID: PB_MDI_Gadget
                                                                                                                                                                                                      • API String ID: 1329112550-983833826
                                                                                                                                                                                                      • Opcode ID: 91c25a52c11928e1dcdf50c8c5d271561ed9788aed12df4cb1439d951fe1a2d6
                                                                                                                                                                                                      • Instruction ID: c737b7e5933cd28dd2024ac4518dbba7f21d079bed6f8e5a442c43898661f0f3
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 91c25a52c11928e1dcdf50c8c5d271561ed9788aed12df4cb1439d951fe1a2d6
                                                                                                                                                                                                      • Instruction Fuzzy Hash: BE117C32500209ABDF20BF159C84EAB7B7DEB45350F02407BFA16722D0C7789C619ABA
                                                                                                                                                                                                      Function 00407D10 Relevance: 7.6, APIs: 5, Instructions: 128memoryfileCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000080,00000000,00000000,?,00000000,00000000), ref: 00407D37
                                                                                                                                                                                                      • RtlAllocateHeap.NTDLL(02170000,00000000,00001000), ref: 00407D5A
                                                                                                                                                                                                      • ReadFile.KERNEL32(00000000,00000000,00001000,?,00000000,?,?,00000000,00000000), ref: 00407D7E
                                                                                                                                                                                                      • HeapFree.KERNEL32(02170000,00000000,00000000,?,?,00000000,00000000), ref: 00407EB5
                                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000,?,00000000,00000000), ref: 00407EBD
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000008.00000002.2668306735.0000000000401000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000008.00000002.2668275549.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000008.00000002.2668343196.000000000040F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_8_2_400000_iDentalSoft-Bridge.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: FileHeap$AllocateCloseCreateFreeHandleRead
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 873069550-0
                                                                                                                                                                                                      • Opcode ID: 6d205ce068d6c535940a59b4b089977383b30e73a4805d81d733eebd5c680858
                                                                                                                                                                                                      • Instruction ID: cc7b44d57a08c2d960152028b81c8b335b130a74bf2bd38abe560e07406d3760
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 6d205ce068d6c535940a59b4b089977383b30e73a4805d81d733eebd5c680858
                                                                                                                                                                                                      • Instruction Fuzzy Hash: C3413B325943914BD314DFB4EDDAB333754EB49302F180239EF526A2E1DABDA610D658
                                                                                                                                                                                                      Function 004040C0 Relevance: 3.0, APIs: 2, Instructions: 20COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • SetUnhandledExceptionFilter.KERNEL32(00404080,00401338,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000008,00000400,00000008,00000401,00000007,0040B378,0040C414), ref: 004040FC
                                                                                                                                                                                                      • SetUnhandledExceptionFilter.KERNEL32(00000000,00401338,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000008,00000400,00000008,00000401,00000007,0040B378,0040C414), ref: 00404110
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000008.00000002.2668306735.0000000000401000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000008.00000002.2668275549.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000008.00000002.2668343196.000000000040F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_8_2_400000_iDentalSoft-Bridge.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: ExceptionFilterUnhandled
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 3192549508-0
                                                                                                                                                                                                      • Opcode ID: a050111ed141b15c7c6f545312ef9440b91e95154258df8bbf61ed899aeead71
                                                                                                                                                                                                      • Instruction ID: c804a82757ec42fab6c8c45d57e9e7661d7cf550b25e5e2adc6e67130f168578
                                                                                                                                                                                                      • Opcode Fuzzy Hash: a050111ed141b15c7c6f545312ef9440b91e95154258df8bbf61ed899aeead71
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 72F0AEB4504300DBC710CF28EA9862676E8FB94B09F10863EE645B32A0C3788854DB5E
                                                                                                                                                                                                      Function 00404210 Relevance: 1.5, APIs: 1, Instructions: 5COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • SetUnhandledExceptionFilter.KERNEL32(00000000,00401BEC,00401BD2,00000001,00000010,OPS,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000008,00000400), ref: 00404216
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000008.00000002.2668306735.0000000000401000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000008.00000002.2668275549.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000008.00000002.2668343196.000000000040F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_8_2_400000_iDentalSoft-Bridge.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: ExceptionFilterUnhandled
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 3192549508-0
                                                                                                                                                                                                      • Opcode ID: 08a47eabae3e52037b7ffba098a3bfc88cb7c4a2676be4b2bb77a317b3c3db50
                                                                                                                                                                                                      • Instruction ID: 4c332641a134c66d3d7db844ebd6456d20c2d455203c7c36df3e6d6bd2731268
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 08a47eabae3e52037b7ffba098a3bfc88cb7c4a2676be4b2bb77a317b3c3db50
                                                                                                                                                                                                      • Instruction Fuzzy Hash: ECB00275510200DBD7119F58EE9C77537B4F74471DF94166CE601A3160C7785454CB5E
                                                                                                                                                                                                      Function 004058E9 Relevance: 46.8, APIs: 31, Instructions: 333windowkeyboardCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • SystemParametersInfoA.USER32(00000026,00000000,?,00000000), ref: 0040593A
                                                                                                                                                                                                      • GetWindowRect.USER32(?,00000010), ref: 00405962
                                                                                                                                                                                                      • GetWindowRect.USER32(?,00000020), ref: 0040596B
                                                                                                                                                                                                      • GetSystemMetrics.USER32(0000003D), ref: 0040597B
                                                                                                                                                                                                      • GetSystemMetrics.USER32(0000003E), ref: 00405982
                                                                                                                                                                                                      • GetWindowLongA.USER32(?,000000F0), ref: 0040598C
                                                                                                                                                                                                      • GetSystemMetrics.USER32(00000005), ref: 0040599B
                                                                                                                                                                                                      • GetWindowLongA.USER32(?,000000EC), ref: 004059A6
                                                                                                                                                                                                      • GetSystemMetrics.USER32(0000002D), ref: 004059B4
                                                                                                                                                                                                      • GetSystemMetrics.USER32(0000002E), ref: 004059BB
                                                                                                                                                                                                      • GetSystemMetrics.USER32(00000022), ref: 004059CA
                                                                                                                                                                                                      • GetSystemMetrics.USER32(00000023), ref: 004059D1
                                                                                                                                                                                                      • GetSystemMetrics.USER32(0000003B), ref: 004059D8
                                                                                                                                                                                                      • GetSystemMetrics.USER32(0000003C), ref: 004059DF
                                                                                                                                                                                                      • SendMessageA.USER32(?,00000024,00000000,00000034), ref: 004059F4
                                                                                                                                                                                                      • GetKeyState.USER32(00000001), ref: 004059F8
                                                                                                                                                                                                      • SendMessageA.USER32(?,00000201,00000001,00000000), ref: 00405A0E
                                                                                                                                                                                                      • SetCapture.USER32(?), ref: 00405A13
                                                                                                                                                                                                      • PostMessageA.USER32(?,00000231,00000000,00000000), ref: 00405A23
                                                                                                                                                                                                      • GetCursorPos.USER32(-00000008), ref: 00405A39
                                                                                                                                                                                                      • LoadImageA.USER32(00000000,00007F86,00000002,00000000,00000000,00008040), ref: 00405A4E
                                                                                                                                                                                                      • SetCursor.USER32(00000000), ref: 00405A55
                                                                                                                                                                                                      • MapWindowPoints.USER32(?,00000000,?,00000001), ref: 00405A91
                                                                                                                                                                                                      • SendMessageA.USER32(?,00000214,?,00000010), ref: 00405AB4
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000008.00000002.2668306735.0000000000401000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000008.00000002.2668275549.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000008.00000002.2668343196.000000000040F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_8_2_400000_iDentalSoft-Bridge.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: System$Metrics$Window$Message$Send$CursorLongRect$CaptureImageInfoLoadParametersPointsPostState
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 985555588-0
                                                                                                                                                                                                      • Opcode ID: 43d19bfc42a08d5e319146f5de0831ec4d0d6382b6af9837542f74fc97943ee5
                                                                                                                                                                                                      • Instruction ID: 9204528e61b29606d8030a8d955de1d1bdd4116575f6c66ade13bddfa8c02890
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 43d19bfc42a08d5e319146f5de0831ec4d0d6382b6af9837542f74fc97943ee5
                                                                                                                                                                                                      • Instruction Fuzzy Hash: BAC18371A04A0ABFEB14AF64CD88A7B7B78FB04340F04453BF505A66D0D779A860DF99
                                                                                                                                                                                                      Function 00405181 Relevance: 28.2, APIs: 14, Strings: 2, Instructions: 245memoryregistryCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • sprintf.MSVCRT ref: 004051C9
                                                                                                                                                                                                      • memset.MSVCRT ref: 004051E4
                                                                                                                                                                                                      • RegisterClassA.USER32(?), ref: 00405229
                                                                                                                                                                                                      • AdjustWindowRectEx.USER32(?,?,00000000,?), ref: 0040529A
                                                                                                                                                                                                      • GetSystemMetrics.USER32(00000000), ref: 004052D7
                                                                                                                                                                                                      • GetSystemMetrics.USER32(00000001), ref: 004052F1
                                                                                                                                                                                                      • GetActiveWindow.USER32 ref: 00405318
                                                                                                                                                                                                      • GetWindowRect.USER32(00000010,?), ref: 00405327
                                                                                                                                                                                                      • CreateWindowExA.USER32(?,?,?,?,?,?,?,00000001,00000010,00000000,00000000), ref: 0040538A
                                                                                                                                                                                                      • SetPropA.USER32(00000000,PB_WindowID,00000100), ref: 004053A7
                                                                                                                                                                                                      • ShowWindow.USER32(00000000,00000001), ref: 004053CE
                                                                                                                                                                                                      • RtlAllocateHeap.NTDLL(00000000,0000000C), ref: 004053F3
                                                                                                                                                                                                      • CreateAcceleratorTableA.USER32(?,?), ref: 00405430
                                                                                                                                                                                                      • UnregisterClassA.USER32(?), ref: 00405464
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000008.00000002.2668306735.0000000000401000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000008.00000002.2668275549.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000008.00000002.2668343196.000000000040F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_8_2_400000_iDentalSoft-Bridge.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Window$ClassCreateMetricsRectSystem$AcceleratorActiveAdjustAllocateHeapPropRegisterShowTableUnregistermemsetsprintf
                                                                                                                                                                                                      • String ID: PB_WindowID$WindowClass_%d
                                                                                                                                                                                                      • API String ID: 4050063160-2937193648
                                                                                                                                                                                                      • Opcode ID: e34179347004f210c39161e471e15f4af751cc139a30d7a61c16a2a46cc46a58
                                                                                                                                                                                                      • Instruction ID: 7badc2ad98ff307d963244a9e766fdb72eecfe9b56e375fc5f2dddb13d72ccbe
                                                                                                                                                                                                      • Opcode Fuzzy Hash: e34179347004f210c39161e471e15f4af751cc139a30d7a61c16a2a46cc46a58
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 2BA15A7190060ADFDB11CF69D989B9FBBF5FF04344F18822AF854A62A0D3789950CF98
                                                                                                                                                                                                      Function 00405D45 Relevance: 26.6, APIs: 12, Strings: 3, Instructions: 372windowCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                        • Part of subcall function 004058E9: SystemParametersInfoA.USER32(00000026,00000000,?,00000000), ref: 0040593A
                                                                                                                                                                                                        • Part of subcall function 004058E9: GetWindowRect.USER32(?,00000010), ref: 00405962
                                                                                                                                                                                                        • Part of subcall function 004058E9: GetWindowRect.USER32(?,00000020), ref: 0040596B
                                                                                                                                                                                                        • Part of subcall function 004058E9: GetSystemMetrics.USER32(0000003D), ref: 0040597B
                                                                                                                                                                                                        • Part of subcall function 004058E9: GetSystemMetrics.USER32(0000003E), ref: 00405982
                                                                                                                                                                                                        • Part of subcall function 004058E9: GetWindowLongA.USER32(?,000000F0), ref: 0040598C
                                                                                                                                                                                                        • Part of subcall function 004058E9: GetSystemMetrics.USER32(00000005), ref: 0040599B
                                                                                                                                                                                                        • Part of subcall function 004058E9: GetSystemMetrics.USER32(0000002E), ref: 004059BB
                                                                                                                                                                                                        • Part of subcall function 004058E9: GetSystemMetrics.USER32(00000022), ref: 004059CA
                                                                                                                                                                                                        • Part of subcall function 004058E9: GetSystemMetrics.USER32(00000023), ref: 004059D1
                                                                                                                                                                                                        • Part of subcall function 004058E9: GetSystemMetrics.USER32(0000003B), ref: 004059D8
                                                                                                                                                                                                        • Part of subcall function 004058E9: GetSystemMetrics.USER32(0000003C), ref: 004059DF
                                                                                                                                                                                                        • Part of subcall function 004058E9: SendMessageA.USER32(?,00000024,00000000,00000034), ref: 004059F4
                                                                                                                                                                                                        • Part of subcall function 004058E9: GetKeyState.USER32(00000001), ref: 004059F8
                                                                                                                                                                                                        • Part of subcall function 004058E9: SendMessageA.USER32(?,00000201,00000001,00000000), ref: 00405A0E
                                                                                                                                                                                                        • Part of subcall function 004058E9: SetCapture.USER32(?), ref: 00405A13
                                                                                                                                                                                                        • Part of subcall function 004058E9: PostMessageA.USER32(?,00000231,00000000,00000000), ref: 00405A23
                                                                                                                                                                                                      • GetPropA.USER32(?,PB_WindowID), ref: 00405D8C
                                                                                                                                                                                                      • GetParent.USER32(?), ref: 00405D9C
                                                                                                                                                                                                      • GetPropA.USER32(?,PB_Focus), ref: 00405E60
                                                                                                                                                                                                      • SetFocus.USER32(00000000), ref: 00405E6B
                                                                                                                                                                                                      • GetFocus.USER32 ref: 00405E87
                                                                                                                                                                                                      • SetPropA.USER32(?,PB_Focus,00000000), ref: 00405E96
                                                                                                                                                                                                      • GetClientRect.USER32(?,00000000), ref: 00405F52
                                                                                                                                                                                                      • FillRect.USER32(?,00000000,?), ref: 00405F62
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000008.00000002.2668306735.0000000000401000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000008.00000002.2668275549.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000008.00000002.2668343196.000000000040F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_8_2_400000_iDentalSoft-Bridge.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: System$Metrics$Rect$MessagePropWindow$FocusSend$CaptureClientFillInfoLongParametersParentPostState
                                                                                                                                                                                                      • String ID: PB_Focus$PB_WindowID$pjs
                                                                                                                                                                                                      • API String ID: 2223452505-546556249
                                                                                                                                                                                                      • Opcode ID: 5f93c5ac3baf62600fc6f20899f15161e83931246ebd61a23e65ee019f3aedc1
                                                                                                                                                                                                      • Instruction ID: 0aa55657593e068e08d38b55b3737dbe32669ecd8be45d4008b7a7f6034ab70d
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 5f93c5ac3baf62600fc6f20899f15161e83931246ebd61a23e65ee019f3aedc1
                                                                                                                                                                                                      • Instruction Fuzzy Hash: F8D1CE3150060AABDF219F65CD44BBB3AA5EF04300F11853BF90ABA2D1D73D8A61DF99
                                                                                                                                                                                                      Function 004036E1 Relevance: 24.6, APIs: 10, Strings: 4, Instructions: 107librarystringloaderCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • CoInitialize.OLE32(00000000), ref: 00403701
                                                                                                                                                                                                      • memset.MSVCRT ref: 0040370E
                                                                                                                                                                                                      • LoadLibraryA.KERNEL32(SHELL32.DLL), ref: 0040371E
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,SHBrowseForFolder), ref: 00403741
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(?,SHGetPathFromIDList), ref: 0040374E
                                                                                                                                                                                                      • strncpy.MSVCRT ref: 0040376E
                                                                                                                                                                                                      • strlen.MSVCRT ref: 0040377D
                                                                                                                                                                                                      • CoTaskMemFree.COMBASE(?), ref: 004037F0
                                                                                                                                                                                                      • strlen.MSVCRT ref: 004037F7
                                                                                                                                                                                                      • FreeLibrary.KERNEL32(?,00000000), ref: 00403814
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000008.00000002.2668306735.0000000000401000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000008.00000002.2668275549.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000008.00000002.2668343196.000000000040F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_8_2_400000_iDentalSoft-Bridge.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: AddressFreeLibraryProcstrlen$InitializeLoadTaskmemsetstrncpy
                                                                                                                                                                                                      • String ID: P$SHBrowseForFolder$SHELL32.DLL$SHGetPathFromIDList
                                                                                                                                                                                                      • API String ID: 1137656791-2123664527
                                                                                                                                                                                                      • Opcode ID: 0773661372b48e9867ba838d603df849a0a29b60f4f4b4b37e686c0949b1931a
                                                                                                                                                                                                      • Instruction ID: 6e1c6d6b591f889d2cc9c5ce9642ef36b848b61dc952bcbeeab94fe00f65b082
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 0773661372b48e9867ba838d603df849a0a29b60f4f4b4b37e686c0949b1931a
                                                                                                                                                                                                      • Instruction Fuzzy Hash: AC417BB2841208EFDB01AFA4DD499AEBFB8FF05315F0480BAF544B6291C7784A44CB58
                                                                                                                                                                                                      Function 00404FA3 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 73memorywindowCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetWindow.USER32(00000000,00000004), ref: 00404FC9
                                                                                                                                                                                                      • SetActiveWindow.USER32(00000000), ref: 00404FDA
                                                                                                                                                                                                      • RemovePropA.USER32(00000000,PB_WindowID), ref: 00404FEE
                                                                                                                                                                                                      • RemovePropA.USER32(00000000,PB_DropAccept), ref: 00404FF7
                                                                                                                                                                                                      • RevokeDragDrop.OLE32(00000000), ref: 00405000
                                                                                                                                                                                                      • SendMessageA.USER32(?,00000221,00000000,00000000), ref: 00405017
                                                                                                                                                                                                      • sprintf.MSVCRT ref: 00405036
                                                                                                                                                                                                      • UnregisterClassA.USER32(?), ref: 0040504B
                                                                                                                                                                                                      • HeapFree.KERNEL32(00000000,?), ref: 00405061
                                                                                                                                                                                                      • DestroyAcceleratorTable.USER32(?), ref: 0040506A
                                                                                                                                                                                                      • DeleteObject.GDI32(?), ref: 00405078
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000008.00000002.2668306735.0000000000401000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000008.00000002.2668275549.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000008.00000002.2668343196.000000000040F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_8_2_400000_iDentalSoft-Bridge.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: PropRemoveWindow$AcceleratorActiveClassDeleteDestroyDragDropFreeHeapMessageObjectRevokeSendTableUnregistersprintf
                                                                                                                                                                                                      • String ID: PB_DropAccept$PB_WindowID$WindowClass_%d
                                                                                                                                                                                                      • API String ID: 192457453-976223216
                                                                                                                                                                                                      • Opcode ID: e73429baeb8cbe7fbb6a5c39c446bd262c05798bcb54975c6bac03a0ad0b0873
                                                                                                                                                                                                      • Instruction ID: da087b73b9a427e6a7bb992922107392b1518c5d0c348582a3a372e048ca819f
                                                                                                                                                                                                      • Opcode Fuzzy Hash: e73429baeb8cbe7fbb6a5c39c446bd262c05798bcb54975c6bac03a0ad0b0873
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 23212532500609EBDB326F61ED09F5A7BA9EB44744F14453AFA81B22B0C77AD8509F9C
                                                                                                                                                                                                      Function 004099CA Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 102memoryCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • sprintf.MSVCRT ref: 00409A0C
                                                                                                                                                                                                      • GetPropA.USER32(00000000,?), ref: 00409A27
                                                                                                                                                                                                      • GetPropA.USER32(LT@,?), ref: 00409A49
                                                                                                                                                                                                      • HeapFree.KERNEL32(00000000,?,?,00000000,?), ref: 00409A62
                                                                                                                                                                                                      • RtlAllocateHeap.NTDLL(00000008,00000028), ref: 00409A9A
                                                                                                                                                                                                      • RtlAllocateHeap.NTDLL(00000008,00000018), ref: 00409ABB
                                                                                                                                                                                                      • SetPropA.USER32(LT@,?,00000000), ref: 00409AC7
                                                                                                                                                                                                      • SetWindowLongA.USER32(LT@,000000FC,00409901), ref: 00409AD5
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000008.00000002.2668306735.0000000000401000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000008.00000002.2668275549.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000008.00000002.2668343196.000000000040F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_8_2_400000_iDentalSoft-Bridge.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: HeapProp$Allocate$FreeLongWindowsprintf
                                                                                                                                                                                                      • String ID: LT@$PB_GadgetStack_%i
                                                                                                                                                                                                      • API String ID: 765838127-2378627164
                                                                                                                                                                                                      • Opcode ID: 7a18e459dbdde7bb40f299bd4dfa162d6b5ffc81da0ee776f777cf865dd91786
                                                                                                                                                                                                      • Instruction ID: d9d10c7a5fc0f1a91f6ab3d999dd3f4b2593380f334bd06032ece792980dbebb
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 7a18e459dbdde7bb40f299bd4dfa162d6b5ffc81da0ee776f777cf865dd91786
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 81414A71600704EFD724DF28D985E56B7F8FB44310F108A2EE856A37A1D778A944CF98
                                                                                                                                                                                                      Function 004055BF Relevance: 15.1, APIs: 10, Instructions: 125windowmemoryCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • HeapFree.KERNEL32(00000000,?), ref: 004055F3
                                                                                                                                                                                                      • HeapFree.KERNEL32(00000000,?), ref: 004055FF
                                                                                                                                                                                                      • PeekMessageA.USER32(?,00000000,00000000,00000000,00000003), ref: 0040563C
                                                                                                                                                                                                      • MsgWaitForMultipleObjects.USER32(00000000,00000000,00000000,000000FF,000001FF), ref: 0040565D
                                                                                                                                                                                                      • PeekMessageA.USER32(?,00000000,00000000,00000000,00000003), ref: 00405673
                                                                                                                                                                                                      • GetMessageA.USER32(?,00000000,00000000,00000000), ref: 00405683
                                                                                                                                                                                                      • GetActiveWindow.USER32 ref: 00405689
                                                                                                                                                                                                      • TranslateAccelerator.USER32(000000FF,00000000,?), ref: 004056A4
                                                                                                                                                                                                      • TranslateMessage.USER32(?), ref: 004056B2
                                                                                                                                                                                                      • DispatchMessageA.USER32(?), ref: 004056BC
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000008.00000002.2668306735.0000000000401000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000008.00000002.2668275549.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000008.00000002.2668343196.000000000040F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_8_2_400000_iDentalSoft-Bridge.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Message$FreeHeapPeekTranslate$AcceleratorActiveDispatchMultipleObjectsWaitWindow
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 3316118695-0
                                                                                                                                                                                                      • Opcode ID: 94edfb61f939bfba4145225a411cb7ba51db40b4f203b6c509d51d14f9f90ed1
                                                                                                                                                                                                      • Instruction ID: 461d6b77a72c145cbdecc1f6c9a02584800ce0c98f9d467f74051a0a056d23d8
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 94edfb61f939bfba4145225a411cb7ba51db40b4f203b6c509d51d14f9f90ed1
                                                                                                                                                                                                      • Instruction Fuzzy Hash: F3412E71900A04AFD730DF65DD88C6BBBF9EB84740750893EE45AE26A0D739A941CF68
                                                                                                                                                                                                      Function 00403FB0 Relevance: 12.0, APIs: 8, Instructions: 49memoryCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000,?,?,00401B6A,00000001,00000001,00000001,00000000,00000000,0040B0C7,FINOPS,INOPS,BDFINOPS,00000000,NOPS,OPS), ref: 00403FBE
                                                                                                                                                                                                      • CloseHandle.KERNEL32(?,?,?,00401B6A,00000001,00000001,00000001,00000000,00000000,0040B0C7,FINOPS,INOPS,BDFINOPS,00000000,NOPS,OPS), ref: 00403FC8
                                                                                                                                                                                                      • CloseHandle.KERNEL32(?,?,?,00401B6A,00000001,00000001,00000001,00000000,00000000,0040B0C7,FINOPS,INOPS,BDFINOPS,00000000,NOPS,OPS), ref: 00403FD2
                                                                                                                                                                                                      • CloseHandle.KERNEL32(?,?,?,00401B6A,00000001,00000001,00000001,00000000,00000000,0040B0C7,FINOPS,INOPS,BDFINOPS,00000000,NOPS,OPS), ref: 00403FDC
                                                                                                                                                                                                      • HeapFree.KERNEL32(00000000,?,?,?,00401B6A,00000001,00000001,00000001,00000000,00000000,0040B0C7,FINOPS,INOPS,BDFINOPS,00000000,NOPS), ref: 00403FF4
                                                                                                                                                                                                      • HeapFree.KERNEL32(00000000,?,?,?,00401B6A,00000001,00000001,00000001,00000000,00000000,0040B0C7,FINOPS,INOPS,BDFINOPS,00000000,NOPS), ref: 00404006
                                                                                                                                                                                                      • RtlEnterCriticalSection.NTDLL(0040C6AC), ref: 0040400E
                                                                                                                                                                                                      • RtlLeaveCriticalSection.NTDLL(0040C6AC), ref: 00404022
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000008.00000002.2668306735.0000000000401000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000008.00000002.2668275549.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000008.00000002.2668343196.000000000040F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_8_2_400000_iDentalSoft-Bridge.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CloseHandle$CriticalFreeHeapSection$EnterLeave
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 417791885-0
                                                                                                                                                                                                      • Opcode ID: 23c0109f6b7771b4e87d013250ef8a2675169308071b449e9acd57bcbd8b2137
                                                                                                                                                                                                      • Instruction ID: 092cdc02ed6b305ee465c83b1176ca4c941f7052c9489cd8b8b51aff9e8b15ec
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 23c0109f6b7771b4e87d013250ef8a2675169308071b449e9acd57bcbd8b2137
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 10011A31604205ABD620AF3ADD45F27BBEDEF90711B16443AF500F32A0CB78F8408AA8
                                                                                                                                                                                                      Function 0040383A Relevance: 10.5, APIs: 7, Instructions: 41threadwindowCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetWindowThreadProcessId.USER32(?,00000000), ref: 00403844
                                                                                                                                                                                                      • GetCurrentThreadId.KERNEL32 ref: 00403852
                                                                                                                                                                                                      • IsWindowVisible.USER32(?), ref: 00403859
                                                                                                                                                                                                      • IsWindowEnabled.USER32(?), ref: 00403864
                                                                                                                                                                                                      • GetForegroundWindow.USER32 ref: 0040386E
                                                                                                                                                                                                      • EnableWindow.USER32(?,00000000), ref: 0040387B
                                                                                                                                                                                                        • Part of subcall function 00407B97: RtlAllocateHeap.NTDLL(00000008,00000000,0040759A), ref: 00407BA3
                                                                                                                                                                                                      • GetCurrentThreadId.KERNEL32 ref: 00403894
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000008.00000002.2668306735.0000000000401000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000008.00000002.2668275549.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000008.00000002.2668343196.000000000040F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_8_2_400000_iDentalSoft-Bridge.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Window$Thread$Current$AllocateEnableEnabledForegroundHeapProcessVisible
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 2983394722-0
                                                                                                                                                                                                      • Opcode ID: 556a66c20d67e1239125f6163375bc2024d8dbc3a9ed726d8271cf600ebf704e
                                                                                                                                                                                                      • Instruction ID: 11b1b3f9a296b7b1255b8e6293abd813bd67342a26518953ec5c56a587210ffb
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 556a66c20d67e1239125f6163375bc2024d8dbc3a9ed726d8271cf600ebf704e
                                                                                                                                                                                                      • Instruction Fuzzy Hash: F2F068331442016BD3207F746D88B3E7AECEB95765F14847BF545F22D0DB34980185AD
                                                                                                                                                                                                      Function 00404928 Relevance: 9.0, APIs: 6, Instructions: 45COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • IsWindowEnabled.USER32(00000133), ref: 00404949
                                                                                                                                                                                                      • SetTextColor.GDI32(?,?), ref: 00404969
                                                                                                                                                                                                      • GetSysColor.USER32(00000014), ref: 00404977
                                                                                                                                                                                                      • SetBkColor.GDI32(?,00000000), ref: 0040497F
                                                                                                                                                                                                      • GetSysColorBrush.USER32(00000014), ref: 00404983
                                                                                                                                                                                                      • SetBkColor.GDI32(?,?), ref: 00404995
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000008.00000002.2668306735.0000000000401000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000008.00000002.2668275549.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000008.00000002.2668343196.000000000040F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_8_2_400000_iDentalSoft-Bridge.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Color$BrushEnabledTextWindow
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 3110319690-0
                                                                                                                                                                                                      • Opcode ID: 857cb4358b2f3c7998b8f957420e8f76bf32a8e0d3ba170e894bace2808e5a86
                                                                                                                                                                                                      • Instruction ID: 812fa71498fe2e491e8e5830c5aba004714ff981458a92e3d3ab1021e9171644
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 857cb4358b2f3c7998b8f957420e8f76bf32a8e0d3ba170e894bace2808e5a86
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 02015AB1100304AFD220AB799C44967B7ECEB84731F044A3AFA65E23E1C774AC048AA9
                                                                                                                                                                                                      Function 00404E01 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 47windowCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • SetWindowLongA.USER32(000000FF,000000FC,00404D5A), ref: 00404E3B
                                                                                                                                                                                                      • SetWindowLongA.USER32(000000FF,000000F4,000000FF), ref: 00404E46
                                                                                                                                                                                                      • SetPropA.USER32(000000FF,PB_ID,000000FF), ref: 00404E51
                                                                                                                                                                                                      • SendMessageA.USER32(000000FF,00000030,000000FF,00000001), ref: 00404E62
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000008.00000002.2668306735.0000000000401000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000008.00000002.2668275549.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000008.00000002.2668343196.000000000040F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_8_2_400000_iDentalSoft-Bridge.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: LongWindow$MessagePropSend
                                                                                                                                                                                                      • String ID: PB_ID
                                                                                                                                                                                                      • API String ID: 499798845-4173770792
                                                                                                                                                                                                      • Opcode ID: 3dc559839924adfd6fe4530b96669bcb05091ebcef3358791b74baef049a972e
                                                                                                                                                                                                      • Instruction ID: ba510335567b328f8b67968b663754bb88d3f09fb6c137ec869a22b0081ff9b0
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 3dc559839924adfd6fe4530b96669bcb05091ebcef3358791b74baef049a972e
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 6D0180B1100318BBCB20AF59DD84D8A7BA8FB44760F108626F925672E0C374A950CB94
                                                                                                                                                                                                      Function 00406279 Relevance: 7.5, APIs: 5, Instructions: 41windowCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000008.00000002.2668306735.0000000000401000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000008.00000002.2668275549.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000008.00000002.2668343196.000000000040F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_8_2_400000_iDentalSoft-Bridge.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Window$Focus$EnabledLongVisible
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 1625685152-0
                                                                                                                                                                                                      • Opcode ID: f0dded36a20f1835672d66e9ee60695e649ae7760138b07e788f1845e23de131
                                                                                                                                                                                                      • Instruction ID: aac52913343517734083c87243a19031f23b1203d64fe0c8a7711b270d6c77e6
                                                                                                                                                                                                      • Opcode Fuzzy Hash: f0dded36a20f1835672d66e9ee60695e649ae7760138b07e788f1845e23de131
                                                                                                                                                                                                      • Instruction Fuzzy Hash: BDF0AF312042119FD3117F659D88A7BB2ECEF85761B16817EF182F12E0D3788851CA69
                                                                                                                                                                                                      Function 004047B5 Relevance: 7.5, APIs: 5, Instructions: 39COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • SetTextColor.GDI32(?,?), ref: 004047E0
                                                                                                                                                                                                      • GetSysColor.USER32(0000000F), ref: 004047EE
                                                                                                                                                                                                      • SetBkColor.GDI32(?,00000000), ref: 004047F6
                                                                                                                                                                                                      • GetSysColorBrush.USER32(0000000F), ref: 004047FA
                                                                                                                                                                                                      • SetBkColor.GDI32(?,?), ref: 0040480C
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000008.00000002.2668306735.0000000000401000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000008.00000002.2668275549.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000008.00000002.2668343196.000000000040F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_8_2_400000_iDentalSoft-Bridge.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Color$BrushText
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 3324192670-0
                                                                                                                                                                                                      • Opcode ID: 63f09c755ac47e30bb2a942b8b40c9b896f0b0e833f5f93fc40ef3618b73a38b
                                                                                                                                                                                                      • Instruction ID: 2a448ffdb0581654bfa59fcc2ab7960fe6a0fcd86bbe37dd376965d9ce0b577e
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 63f09c755ac47e30bb2a942b8b40c9b896f0b0e833f5f93fc40ef3618b73a38b
                                                                                                                                                                                                      • Instruction Fuzzy Hash: D9F036721003445BC120AB299C44967B3ECEB94731F508F36F765E27E1C774AC459A75
                                                                                                                                                                                                      Function 004049E2 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 72COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • memset.MSVCRT ref: 00404A0C
                                                                                                                                                                                                      • CreateWindowExA.USER32(?,Edit,00000000,?,?,?,?,?,00000000,000000FF,00000000), ref: 00404A9A
                                                                                                                                                                                                      • SetWindowLongA.USER32(00000000,000000FC,Function_000049A3), ref: 00404ABE
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000008.00000002.2668306735.0000000000401000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000008.00000002.2668275549.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000008.00000002.2668343196.000000000040F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_8_2_400000_iDentalSoft-Bridge.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Window$CreateLongmemset
                                                                                                                                                                                                      • String ID: Edit
                                                                                                                                                                                                      • API String ID: 2917088559-554135844
                                                                                                                                                                                                      • Opcode ID: 846d8bebb3b1a45a74acdc277a8eea7f63bf69dba88b36aadfc6bffef1bf54a3
                                                                                                                                                                                                      • Instruction ID: a02e935bc210801b84b70c087f0889610a29cfc18c74a32f640b64f0a7b60d2c
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 846d8bebb3b1a45a74acdc277a8eea7f63bf69dba88b36aadfc6bffef1bf54a3
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 59218DB1500205EBDB209F25EE89F563AA5FB81324F10433AF924B62E1C77994159B9C
                                                                                                                                                                                                      Function 00403AA5 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 36stringCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                        • Part of subcall function 00408C90: RtlReAllocateHeap.NTDLL(02060000,00000000,020605D0,00004009), ref: 00408CD7
                                                                                                                                                                                                      • GetModuleFileNameA.KERNEL32(00000000,00000104,00000104,00000000,?,?,00000000,00401B93,00000000,00000000,00000000,00000000,00000001,00000001,00000001,00000000), ref: 00403AC1
                                                                                                                                                                                                      • strcmp.MSVCRT ref: 00403ACF
                                                                                                                                                                                                      • memmove.MSVCRT(00000000,00000004,-00000004,?,?,00000000,00401B93,00000000,00000000,00000000,00000000,00000001,00000001,00000001,00000000,00000000), ref: 00403AE3
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000008.00000002.2668306735.0000000000401000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000008.00000002.2668275549.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000008.00000002.2668343196.000000000040F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_8_2_400000_iDentalSoft-Bridge.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: AllocateFileHeapModuleNamememmovestrcmp
                                                                                                                                                                                                      • String ID: \\?\
                                                                                                                                                                                                      • API String ID: 1538048364-4282027825
                                                                                                                                                                                                      • Opcode ID: 5a3eca324e268fce00985b39e275642a0ac3722e42daf0ed5b826be5d69cac20
                                                                                                                                                                                                      • Instruction ID: daa61be434262164ba7175281c5703bba39df4112f55f4592d423a79375f36e5
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 5a3eca324e268fce00985b39e275642a0ac3722e42daf0ed5b826be5d69cac20
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 5EF020B32017006AE610AA769E88D9B6B9CDF91324B04413BF644E2282EB39891482B8
                                                                                                                                                                                                      Function 004094BA Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 215COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • memcpy.MSVCRT(?,?,?,?,?), ref: 004096CC
                                                                                                                                                                                                        • Part of subcall function 00408B20: HeapFree.KERNEL32(02060000,00000000,00000000,00000004,?,?,0040952A,00000000), ref: 00408B38
                                                                                                                                                                                                      • memcpy.MSVCRT(?,?,?,?), ref: 00409708
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000008.00000002.2668306735.0000000000401000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000008.00000002.2668275549.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000008.00000002.2668343196.000000000040F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_8_2_400000_iDentalSoft-Bridge.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: memcpy$FreeHeap
                                                                                                                                                                                                      • String ID: QF@$pD@
                                                                                                                                                                                                      • API String ID: 4250714341-5511149
                                                                                                                                                                                                      • Opcode ID: ccee0c175682c5e90c82c093f83d89edeb5c947ae644bcb170afa3f34717488e
                                                                                                                                                                                                      • Instruction ID: 80eabf92a5081a908b26d229fcb471517efd98a3f3f19bdd92bd7afa032a1a9c
                                                                                                                                                                                                      • Opcode Fuzzy Hash: ccee0c175682c5e90c82c093f83d89edeb5c947ae644bcb170afa3f34717488e
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 4E818D71600605EFCB15CF18CC84AAA7BB5FF48314B148A3AF956AB3A1D735ED50CB98
                                                                                                                                                                                                      Function 00403460 Relevance: 6.2, APIs: 4, Instructions: 172memorystringCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • RtlAllocateHeap.NTDLL(02170000,00000000,?), ref: 0040352A
                                                                                                                                                                                                      • strncpy.MSVCRT ref: 00403578
                                                                                                                                                                                                      • strncpy.MSVCRT ref: 004035D0
                                                                                                                                                                                                      • HeapFree.KERNEL32(02170000,00000000,?), ref: 004035F5
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000008.00000002.2668306735.0000000000401000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000008.00000002.2668275549.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000008.00000002.2668343196.000000000040F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_8_2_400000_iDentalSoft-Bridge.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Heapstrncpy$AllocateFree
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 1596599021-0
                                                                                                                                                                                                      • Opcode ID: 0d0d8e411a31d013f52e945e205ba7b06f82ea96a2a4ca6d0c6f5cb1145e669a
                                                                                                                                                                                                      • Instruction ID: 702d970abfc7cc546c9ee7b67894370c7c444074a925e166b24b86391f1a0cae
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 0d0d8e411a31d013f52e945e205ba7b06f82ea96a2a4ca6d0c6f5cb1145e669a
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 9851B671508341AFC3119F29C84475BBFE8AFC9308F184A2DF884A7391D779DA09CB96
                                                                                                                                                                                                      Function 004054A4 Relevance: 6.1, APIs: 4, Instructions: 87memoryCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • RtlAllocateHeap.NTDLL(00000000,00000006), ref: 00405534
                                                                                                                                                                                                      • DestroyAcceleratorTable.USER32(?), ref: 004055A2
                                                                                                                                                                                                      • CreateAcceleratorTableA.USER32(?,?,?), ref: 004055AE
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000008.00000002.2668306735.0000000000401000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000008.00000002.2668275549.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000008.00000002.2668343196.000000000040F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_8_2_400000_iDentalSoft-Bridge.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: AcceleratorTable$AllocateCreateDestroyHeap
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 1846328917-0
                                                                                                                                                                                                      • Opcode ID: d70939f173c8941e025f0c7c22cd52893172117ea1bad3714052c918d68a5891
                                                                                                                                                                                                      • Instruction ID: fc5ea2f5d7bf1f52a958ab49b28ec623a8a2191be404e4f5d401fec64402c582
                                                                                                                                                                                                      • Opcode Fuzzy Hash: d70939f173c8941e025f0c7c22cd52893172117ea1bad3714052c918d68a5891
                                                                                                                                                                                                      • Instruction Fuzzy Hash: F7315C30100B05EBC725DF24CA45AABBBB2FF54704F14C42DE856AB6A0E379EA40DF08
                                                                                                                                                                                                      Function 00408BA0 Relevance: 6.1, APIs: 4, Instructions: 62memorystringCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • strlen.MSVCRT ref: 00408BB5
                                                                                                                                                                                                      • RtlAllocateHeap.NTDLL(02060000,00000000,-00000005), ref: 00408BD7
                                                                                                                                                                                                      • RtlReAllocateHeap.NTDLL(02060000,00000000,?,-00000005), ref: 00408BFA
                                                                                                                                                                                                      • HeapFree.KERNEL32(02060000,00000000), ref: 00408C30
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000008.00000002.2668306735.0000000000401000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000008.00000002.2668275549.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000008.00000002.2668343196.000000000040F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_8_2_400000_iDentalSoft-Bridge.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Heap$Allocate$Freestrlen
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 3543670626-0
                                                                                                                                                                                                      • Opcode ID: eb01aeb428a767cd2ca9601ee8510c71ed6630485d8f5ca831bb2ea6d525aebc
                                                                                                                                                                                                      • Instruction ID: 4cf8452fb65e10c833a1e70d3d0bc4c1d9f653aac184dd5a823cd216f86a9259
                                                                                                                                                                                                      • Opcode Fuzzy Hash: eb01aeb428a767cd2ca9601ee8510c71ed6630485d8f5ca831bb2ea6d525aebc
                                                                                                                                                                                                      • Instruction Fuzzy Hash: F921C4B4601208EFDB04DF64C994F6A37B5EB89354F10C169F845AB390DB35AE41DB98
                                                                                                                                                                                                      Function 004062DE Relevance: 6.0, APIs: 4, Instructions: 35windowCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • IsWindowEnabled.USER32(?), ref: 004062E8
                                                                                                                                                                                                      • IsWindowVisible.USER32(?), ref: 004062F3
                                                                                                                                                                                                      • GetWindowLongA.USER32(?,000000F0), ref: 00406300
                                                                                                                                                                                                      • SetFocus.USER32(?), ref: 0040631E
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000008.00000002.2668306735.0000000000401000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000008.00000002.2668275549.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000008.00000002.2668343196.000000000040F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_8_2_400000_iDentalSoft-Bridge.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Window$EnabledFocusLongVisible
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 599048109-0
                                                                                                                                                                                                      • Opcode ID: 7599649f8cfd41453b05791bed5bcd21c6ba60d43c43c5922ab0804c7be31b64
                                                                                                                                                                                                      • Instruction ID: 3eade912c05f3c414a1e5b1859b491ddc0253fbc47b39bf0e4ee924676aa653f
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 7599649f8cfd41453b05791bed5bcd21c6ba60d43c43c5922ab0804c7be31b64
                                                                                                                                                                                                      • Instruction Fuzzy Hash: C9F0D0B22002029BD7206F279D48E57BBDCEF88711745853EF956E22A4C734D850CAA8
                                                                                                                                                                                                      Function 0040584D Relevance: 6.0, APIs: 4, Instructions: 28COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetWindowLongA.USER32(?,000000F0), ref: 00405855
                                                                                                                                                                                                      • GetParent.USER32(?), ref: 0040586B
                                                                                                                                                                                                      • MapWindowPoints.USER32(00000000,00000000), ref: 00405874
                                                                                                                                                                                                      • MoveWindow.USER32(?,?,?,?,?,00000001), ref: 00405893
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000008.00000002.2668306735.0000000000401000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000008.00000002.2668275549.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000008.00000002.2668343196.000000000040F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_8_2_400000_iDentalSoft-Bridge.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Window$LongMoveParentPoints
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 473562985-0
                                                                                                                                                                                                      • Opcode ID: 41d27e03094e1b84ba55452e6d28d4b83b020307366ac658c79b0cbbd478e5d6
                                                                                                                                                                                                      • Instruction ID: 02e38d8d1afe2547002f5cef118f7cec60d3ca0a9e5ad98c662e8d4446e9560b
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 41d27e03094e1b84ba55452e6d28d4b83b020307366ac658c79b0cbbd478e5d6
                                                                                                                                                                                                      • Instruction Fuzzy Hash: FBF0627214010DBFDF01AFA9DD49FAA3BA9FB04751F00C125FA19A91B0C771D9609F98
                                                                                                                                                                                                      Function 0040481A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • memset.MSVCRT ref: 00404844
                                                                                                                                                                                                      • CreateWindowExA.USER32(?,Static,00000000,?,?,?,?,?,00000000,000000FF,00000000), ref: 004048D0
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000008.00000002.2668306735.0000000000401000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000008.00000002.2668275549.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000008.00000002.2668343196.000000000040F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_8_2_400000_iDentalSoft-Bridge.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CreateWindowmemset
                                                                                                                                                                                                      • String ID: Static
                                                                                                                                                                                                      • API String ID: 1730425660-2272013587
                                                                                                                                                                                                      • Opcode ID: 65ce5f4a13fbbd0d4c0b51e30980ff7558ae59e7c9637208fe7760b75f49f20f
                                                                                                                                                                                                      • Instruction ID: 686fd2e9ffde87c4131614d7e113de552fd42844faa636c349eb47e59aaef9d5
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 65ce5f4a13fbbd0d4c0b51e30980ff7558ae59e7c9637208fe7760b75f49f20f
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 792192B2500205EFDB215F04EE89F663F69FB41368F00433AFA147A2F1C37998109B99
                                                                                                                                                                                                      Function 00404B24 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • memset.MSVCRT ref: 00404B50
                                                                                                                                                                                                      • CreateWindowExA.USER32(00000000,Button,?,?,?,?,?,?,?,000000FF,00000000), ref: 00404BB7
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000008.00000002.2668306735.0000000000401000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000008.00000002.2668275549.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000008.00000002.2668343196.000000000040F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_8_2_400000_iDentalSoft-Bridge.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CreateWindowmemset
                                                                                                                                                                                                      • String ID: Button
                                                                                                                                                                                                      • API String ID: 1730425660-1034594571
                                                                                                                                                                                                      • Opcode ID: f50027d0e328c1d215813ac41a3bc36177a385e64b34a067c3a581f55d6a7136
                                                                                                                                                                                                      • Instruction ID: 4b154beb3b966c885c7c87ab3af64f59df271f31284d72ce5383ccd189f0c0ae
                                                                                                                                                                                                      • Opcode Fuzzy Hash: f50027d0e328c1d215813ac41a3bc36177a385e64b34a067c3a581f55d6a7136
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 371196B1500118FFCB119F95DD85D9B3FB9FB48364B00423AFA15B62A0D3799D50DB98
                                                                                                                                                                                                      Function 00405CCF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetPropA.USER32(00000000,PB_ID), ref: 00405CE7
                                                                                                                                                                                                      • GetWindowLongA.USER32(00000000,000000F4), ref: 00405CF4
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000008.00000002.2668306735.0000000000401000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000008.00000002.2668275549.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000008.00000002.2668343196.000000000040F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_8_2_400000_iDentalSoft-Bridge.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: LongPropWindow
                                                                                                                                                                                                      • String ID: PB_ID
                                                                                                                                                                                                      • API String ID: 2492497586-4173770792
                                                                                                                                                                                                      • Opcode ID: c44a31b7487edbfb28875df70306ad8b518945ddae799e55387484fd4a8c073b
                                                                                                                                                                                                      • Instruction ID: 2c3825028c8a7958d7bb00c106dafe4c6206565892cfaf5c7b128f51845b8fa5
                                                                                                                                                                                                      • Opcode Fuzzy Hash: c44a31b7487edbfb28875df70306ad8b518945ddae799e55387484fd4a8c073b
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 8DF04F36200609ABDF145F95ED58D5B3BA9EF54355B14803AF909A22A0C735CC619B98
                                                                                                                                                                                                      Function 00404E7C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 23COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000008.00000002.2668306735.0000000000401000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000008.00000002.2668275549.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000008.00000002.2668343196.000000000040F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_8_2_400000_iDentalSoft-Bridge.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: ParentProp
                                                                                                                                                                                                      • String ID: PB_WindowID
                                                                                                                                                                                                      • API String ID: 919147419-1508741625
                                                                                                                                                                                                      • Opcode ID: ed4a3188e739c92b504167d20393d73c0f826d57a76fb4bbf7fc76623d97d243
                                                                                                                                                                                                      • Instruction ID: 91c150d2afb654395ecff5f08fea5ce230bd404d6847d9192ddde9b45e3aea67
                                                                                                                                                                                                      • Opcode Fuzzy Hash: ed4a3188e739c92b504167d20393d73c0f826d57a76fb4bbf7fc76623d97d243
                                                                                                                                                                                                      • Instruction Fuzzy Hash: E4D0ECA3601225678221666A9C84D4BA69CABD56653118137E704F32A0C278D81186E9
                                                                                                                                                                                                      Function 00404EAF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                        • Part of subcall function 00404E7C: GetParent.USER32(?), ref: 00404E9F
                                                                                                                                                                                                      • GetPropA.USER32(00000000,00000008), ref: 00404EC2
                                                                                                                                                                                                      • GetWindowLongA.USER32(?,000000F4), ref: 00404ED0
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000008.00000002.2668306735.0000000000401000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000008.00000002.2668275549.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000008.00000002.2668343196.000000000040F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_8_2_400000_iDentalSoft-Bridge.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: LongParentPropWindow
                                                                                                                                                                                                      • String ID: PB_WindowID
                                                                                                                                                                                                      • API String ID: 1999142876-1508741625
                                                                                                                                                                                                      • Opcode ID: ffd65332fc6498254f92e590a49251ef9e334b1f5cb739afa84a003489ef0936
                                                                                                                                                                                                      • Instruction ID: bfc9078e4eb016f525392476ec2f4426810bff408e9c619d73cbd7cab09f0695
                                                                                                                                                                                                      • Opcode Fuzzy Hash: ffd65332fc6498254f92e590a49251ef9e334b1f5cb739afa84a003489ef0936
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 89D05E72408304BFDA013BB0CC06C2F7A5CFB50314B108A29F664A00F1CB35C4248B5A

                                                                                                                                                                                                      Execution Graph

                                                                                                                                                                                                      Execution Coverage:1.2%
                                                                                                                                                                                                      Dynamic/Decrypted Code Coverage:0.3%
                                                                                                                                                                                                      Signature Coverage:5.9%
                                                                                                                                                                                                      Total number of Nodes:659
                                                                                                                                                                                                      Total number of Limit Nodes:28
                                                                                                                                                                                                      execution_graph 53999 1047957 54015 1047be0 53999->54015 54001 1047963 GetStartupInfoW 54002 1047978 __set_app_type __p__fmode __p__commode 54001->54002 54004 1047a17 54002->54004 54005 1047a20 __setusermatherr 54004->54005 54006 1047a2c 54004->54006 54005->54006 54016 1047c56 _controlfp 54006->54016 54008 1047a31 _initterm __wgetmainargs _initterm 54009 1047a84 54008->54009 54010 1047a91 54008->54010 54017 101c824 _setmode _wsetlocale 54010->54017 54013 1047b02 _cexit 54013->54009 54014 1047afb exit 54014->54013 54015->54001 54016->54008 54042 104ea1a GetStdHandle 54017->54042 54021 101c86a 54072 105ecdb #211 54021->54072 54024 101c8e0 CreateWindowExW 54025 101c8d6 GetLastError 54024->54025 54027 101c905 UpdateWindow PostMessageW 54024->54027 54026 101c945 54025->54026 54029 101c957 LocalFree 54026->54029 54030 101c95a 54026->54030 54028 101c938 GetMessageW 54027->54028 54028->54026 54031 101c924 TranslateMessage DispatchMessageW 54028->54031 54029->54030 54032 101c963 LocalFree 54030->54032 54033 101c966 54030->54033 54031->54028 54032->54033 54034 101c972 54033->54034 54035 101c96f LocalFree 54033->54035 54086 101b4ca 54034->54086 54035->54034 54043 101c857 54042->54043 54044 104ea2a GetFileType 54042->54044 54049 105eee0 54043->54049 54044->54043 54045 104ea3b 54044->54045 54046 104ea44 GetModuleHandleW 54045->54046 54047 104ea68 SetThreadUILanguage 54045->54047 54046->54043 54048 104ea53 GetProcAddress 54046->54048 54047->54043 54048->54043 54048->54047 54050 105eeef 54049->54050 54051 105ef47 54050->54051 54052 105ef16 InitializeCriticalSection 54050->54052 54053 105ef54 EnterCriticalSection 54051->54053 54054 105ef69 GetWindowsDirectoryA 54051->54054 54052->54051 54053->54054 54056 105f066 54054->54056 54064 105ef96 54054->54064 54057 105f093 LeaveCriticalSection 54056->54057 54058 105f09e 54056->54058 54057->54058 54059 105f0cf 54058->54059 54106 105ed70 GetSystemTime SystemTimeToFileTime 54058->54106 54118 10478b9 54059->54118 54062 105f0d7 54062->54021 54064->54056 54065 105eff6 fopen 54064->54065 54067 105f017 fseek 54064->54067 54065->54064 54066 105f057 54065->54066 54125 104eec8 7 API calls 54066->54125 54069 105f068 fwrite 54067->54069 54070 105f028 ftell 54067->54070 54069->54056 54070->54069 54071 105f03c fclose 54070->54071 54071->54064 54073 105ed07 54072->54073 54074 105ecfb 54072->54074 54076 105eb2a 40 API calls 54073->54076 54189 104eef2 54074->54189 54077 105ed20 54076->54077 54186 1067567 GetACP 54077->54186 54080 105ed44 54082 105eb2a 40 API calls 54080->54082 54083 105ed5b 54082->54083 54084 105ed63 LocalFree 54083->54084 54085 101c884 LoadIconW LoadCursorW GetStockObject RegisterClassW 54083->54085 54084->54085 54085->54024 54085->54025 54087 101b4cd 54086->54087 54088 101b4e0 LocalFree 54087->54088 54089 101b4ef 54087->54089 54088->54087 54090 104e55a 54089->54090 54091 104e565 54090->54091 54092 101c981 #213 54090->54092 54093 104e577 LocalFree 54091->54093 54094 104e59c LocalFree 54091->54094 54095 105ee58 54092->54095 54093->54093 54093->54094 54094->54092 54096 105ee85 54095->54096 54097 105ee71 54095->54097 54099 105ee92 EnterCriticalSection 54096->54099 54100 105ee9c 54096->54100 54098 105ed70 55 API calls 54097->54098 54098->54096 54099->54100 54101 105eea5 fclose 54100->54101 54102 105eeb3 54100->54102 54101->54102 54103 101c98b 54102->54103 54104 105eeca LeaveCriticalSection 54102->54104 54103->54013 54103->54014 54104->54103 54105 105eed5 DeleteCriticalSection 54104->54105 54105->54103 54107 105eda5 54106->54107 54108 105ed98 54106->54108 54167 1051272 20 API calls 54107->54167 54166 1066c28 GetLastError 54108->54166 54111 105ed9d 54112 105edc3 54111->54112 54168 104eec8 7 API calls 54111->54168 54126 105eb2a 54112->54126 54116 105ede6 #242 54116->54059 54117 105eddd LocalFree 54117->54116 54119 10478c1 54118->54119 54120 10478c2 54118->54120 54119->54062 54121 10478f4 SetUnhandledExceptionFilter 54120->54121 54122 1047932 GetCurrentProcess TerminateProcess 54120->54122 54124 1047931 54121->54124 54123 104794f 54122->54123 54123->54062 54124->54122 54125->54056 54127 105eb85 54126->54127 54128 105eb4f 54126->54128 54129 105eb8d EnterCriticalSection 54127->54129 54130 105eb9f 54127->54130 54131 105eb58 54128->54131 54132 105eb6a 54128->54132 54129->54130 54133 105ebac fprintf 54130->54133 54134 105ec9a 54130->54134 54169 104e3f1 16 API calls 54131->54169 54170 104e4f5 54132->54170 54137 105ebe4 54133->54137 54138 105ebcd fprintf 54133->54138 54139 105ec9f LeaveCriticalSection 54134->54139 54140 105ecaa 54134->54140 54144 105ec03 54137->54144 54145 105ebea fprintf 54137->54145 54180 105eae9 9 API calls 54138->54180 54139->54140 54146 105ecb5 LocalFree 54140->54146 54147 105ecba 54140->54147 54141 105eb63 54142 105eb6f 54141->54142 54142->54127 54178 1066c28 GetLastError 54142->54178 54150 105ec22 54144->54150 54151 105ec09 fprintf 54144->54151 54181 105eae9 9 API calls 54145->54181 54146->54147 54149 105eccc 54147->54149 54156 105ecc7 LocalFree 54147->54156 54152 10478b9 3 API calls 54149->54152 54154 105ec3d 54150->54154 54155 105ec29 fprintf 54150->54155 54182 105eae9 9 API calls 54151->54182 54158 105ecd7 54152->54158 54160 105ec43 #207 54154->54160 54161 105ec7c fprintf fflush 54154->54161 54155->54154 54156->54149 54158->54116 54158->54117 54159 105eb7a 54179 104eec8 7 API calls 54159->54179 54163 105ec54 #208 54160->54163 54164 105ec63 fprintf 54160->54164 54161->54134 54163->54164 54183 105eae9 9 API calls 54164->54183 54166->54111 54167->54111 54168->54112 54169->54141 54171 104e51a 54170->54171 54172 104e50a 54170->54172 54184 104e3f1 16 API calls 54171->54184 54172->54171 54175 104e54c 54172->54175 54174 104e530 54174->54175 54185 104e399 LocalAlloc LocalReAlloc 54174->54185 54175->54142 54177 104e53b 54177->54175 54178->54159 54179->54127 54180->54137 54181->54144 54182->54150 54183->54161 54184->54174 54185->54177 54193 10674c2 54186->54193 54207 104ee51 #205 54189->54207 54192 104eec8 7 API calls 54192->54080 54194 1067502 MultiByteToWideChar 54193->54194 54195 10674e0 54194->54195 54196 106750d 54194->54196 54197 105ed30 54195->54197 54198 10674e6 LocalAlloc 54195->54198 54206 1066c28 GetLastError 54196->54206 54197->54080 54197->54192 54200 1067530 54198->54200 54201 10674f8 54198->54201 54203 1067535 54200->54203 54201->54194 54202 1067512 54202->54203 54204 106751a LocalFree 54202->54204 54203->54197 54205 1067539 SetLastError 54203->54205 54204->54203 54205->54197 54206->54202 54208 104eebc 54207->54208 54209 104ee6a 54207->54209 54211 10478b9 3 API calls 54208->54211 54215 104ee28 #215 54209->54215 54212 104eec4 54211->54212 54212->54073 54214 104ee90 #206 #203 54214->54208 54216 104ee39 54215->54216 54216->54208 54216->54214 54217 101c7d7 54218 101c7e3 54217->54218 54219 101c81d 54217->54219 54218->54219 54220 101c813 PostQuitMessage 54218->54220 54222 101c7f2 DefWindowProcW 54218->54222 54223 101c808 54218->54223 54220->54219 54222->54219 54225 101c4d5 wcslen LocalAlloc 54223->54225 54235 101c503 54225->54235 54253 101c513 54225->54253 54227 101c5e7 LocalAlloc 54227->54235 54243 101c676 54227->54243 54228 101c5be wcslen wcschr 54228->54253 54229 101c60c 54331 101b4f1 39 API calls 54229->54331 54231 101c5e5 54231->54227 54232 101c790 54234 105eb2a 40 API calls 54232->54234 54233 101c61d 54237 101c628 LocalFree 54233->54237 54238 101c62d 54233->54238 54239 101c7ac 54234->54239 54330 104eec8 7 API calls 54235->54330 54236 101c699 wcschr 54240 101c6bb wcscat 54236->54240 54236->54243 54237->54238 54244 101c632 LocalFree 54238->54244 54245 101c637 54238->54245 54256 101bf0b 54239->54256 54240->54243 54241 101c760 wcscat 54241->54243 54247 101c771 wcscat 54241->54247 54242 101c754 wcscat 54242->54241 54243->54232 54243->54236 54243->54241 54243->54242 54254 101c72c wcscat wcschr 54243->54254 54332 1051224 54243->54332 54244->54245 54249 105eb2a 40 API calls 54245->54249 54247->54243 54251 101c659 54249->54251 54250 101c7bb 54250->54233 54336 104eedc 7 API calls 54250->54336 54251->54220 54253->54227 54253->54228 54253->54231 54253->54235 54254->54243 54255 101c740 wcscat 54254->54255 54255->54243 54337 1047be0 54256->54337 54258 101bf1a InitializeCriticalSection 54270 101bf94 54258->54270 54259 101c0f6 54261 101c111 54259->54261 54262 101c1a4 54259->54262 54264 104e4f5 18 API calls 54261->54264 54263 101c1ab 54262->54263 54279 101c1d7 54262->54279 54266 104e4f5 18 API calls 54263->54266 54267 101c11d 54264->54267 54265 101bff8 lstrcmpW 54265->54270 54271 101c13d 54265->54271 54272 101c1b7 54266->54272 54273 1056431 26 API calls 54267->54273 54268 101c4a0 54274 101c4a9 CoUninitialize 54268->54274 54275 101c4af 54268->54275 54269 101c150 54269->54268 54475 101b5c5 28 API calls 54269->54475 54270->54259 54270->54265 54301 1051224 10 API calls 54270->54301 54305 101c12d 54270->54305 54308 101bf9f 54270->54308 54470 101b8d3 87 API calls 54271->54470 54280 1056431 26 API calls 54272->54280 54281 101c123 54273->54281 54274->54275 54276 101c4c3 54275->54276 54277 101c4b8 DeleteCriticalSection 54275->54277 54283 10478b9 3 API calls 54276->54283 54277->54276 54285 101c235 54279->54285 54471 104efde 11 API calls 54279->54471 54286 101c1bd 54280->54286 54287 1056431 26 API calls 54281->54287 54288 101c4cd 54283->54288 54284 101c46f 54289 101c490 54284->54289 54293 104e4f5 18 API calls 54284->54293 54285->54308 54338 104fd2f LocalAlloc 54285->54338 54291 1056431 26 API calls 54286->54291 54287->54305 54288->54250 54289->54268 54476 104ef08 wcslen 54289->54476 54291->54305 54295 101c47e 54293->54295 54300 1056431 26 API calls 54295->54300 54298 101c28e 54302 101c2df 54298->54302 54298->54305 54298->54308 54472 101be7a 93 API calls 54298->54472 54299 101c27e CoInitialize 54299->54298 54303 101c484 54300->54303 54301->54270 54302->54305 54309 101c34d 54302->54309 54304 1056431 26 API calls 54303->54304 54304->54289 54474 101b8d3 87 API calls 54305->54474 54307 101c2c6 54307->54302 54307->54308 54473 104eec8 7 API calls 54308->54473 54351 1037328 54309->54351 54311 101c3d8 #206 54313 104e4f5 18 API calls 54311->54313 54312 101c40a 54312->54269 54314 104e4f5 18 API calls 54312->54314 54315 101c3f5 54313->54315 54316 101c425 54314->54316 54317 1056431 26 API calls 54315->54317 54415 1056431 54316->54415 54319 101c3fb 54317->54319 54321 1056431 26 API calls 54319->54321 54320 101c42b 54322 1056431 26 API calls 54320->54322 54321->54269 54323 101c435 54322->54323 54323->54269 54324 104e4f5 18 API calls 54323->54324 54325 101c44d 54324->54325 54326 1056431 26 API calls 54325->54326 54327 101c453 54326->54327 54328 1056431 26 API calls 54327->54328 54328->54269 54330->54229 54331->54233 54333 10511f7 54332->54333 54638 1050d7e 54333->54638 54336->54233 54337->54258 54339 104fd57 54338->54339 54340 104fd6b GetComputerNameW 54338->54340 54489 104eec8 7 API calls 54339->54489 54342 104fd8e 54340->54342 54343 104fd7a 54340->54343 54477 1067bca 54342->54477 54490 1066c28 GetLastError 54343->54490 54344 101c267 54344->54298 54344->54299 54344->54308 54347 104fd7f 54348 104fd8c 54347->54348 54491 104eec8 7 API calls 54347->54491 54348->54344 54350 104fdaa LocalFree 54348->54350 54350->54344 54352 1037360 54351->54352 54353 103734c wcscmp 54351->54353 54494 1035bd7 54352->54494 54353->54352 54356 1037386 54360 104eef2 7 API calls 54356->54360 54357 10373b7 54358 10373fa 54357->54358 54359 10373bc #246 54357->54359 54522 10367ec 54358->54522 54362 10373d2 54359->54362 54363 10373de 54359->54363 54368 1037394 54360->54368 54361 10373a4 54361->54356 54361->54358 54582 104eedc 7 API calls 54362->54582 54583 10550c7 15 API calls 54363->54583 54369 1037655 54368->54369 54370 103764c SysFreeString 54368->54370 54374 1037660 LocalFree 54369->54374 54375 1037665 54369->54375 54370->54369 54371 10373ea 54371->54358 54584 104eedc 7 API calls 54371->54584 54372 1037428 54377 1037439 CertEnumCertificatesInStore 54372->54377 54401 1037451 54372->54401 54373 1037418 54585 104eec8 7 API calls 54373->54585 54374->54375 54378 103766a LocalFree 54375->54378 54379 103766f 54375->54379 54393 103746f 54377->54393 54377->54401 54378->54379 54381 1037674 LocalFree 54379->54381 54382 1037679 54379->54382 54381->54382 54386 1037688 54382->54386 54387 103767f CertFreeCTLContext 54382->54387 54383 10375e1 54383->54368 54591 1036f1b 71 API calls 54383->54591 54384 10375d1 CertEnumCRLsInStore 54384->54383 54384->54401 54385 1037504 CertEnumCertificatesInStore 54385->54393 54385->54401 54389 1037696 54386->54389 54390 103768d CertFreeCTLContext 54386->54390 54387->54386 54394 101c3aa 54389->54394 54395 103769b CertCloseStore 54389->54395 54390->54389 54391 104e4f5 18 API calls 54397 10374b2 54391->54397 54393->54385 54396 103751d 54393->54396 54393->54397 54572 10553fb 54393->54572 54394->54311 54394->54312 54395->54394 54396->54368 54587 104eec8 7 API calls 54396->54587 54397->54391 54400 1056431 26 API calls 54397->54400 54586 10372d1 8 API calls 54397->54586 54399 104e4f5 18 API calls 54405 103757f 54399->54405 54400->54397 54401->54383 54401->54384 54401->54396 54401->54405 54589 1055648 14 API calls 54401->54589 54403 1056431 26 API calls 54403->54405 54405->54383 54405->54399 54405->54401 54405->54403 54590 10372d1 8 API calls 54405->54590 54406 10374e9 CertDuplicateCertificateContext CertDeleteCertificateFromStore 54407 10374fb 54406->54407 54408 103752f 54406->54408 54407->54385 54407->54401 54588 1066c28 GetLastError 54408->54588 54411 1037534 54411->54396 54412 10375b6 CertDuplicateCRLContext CertDeleteCertificateFromStore 54412->54405 54413 1037633 54412->54413 54592 1066c28 GetLastError 54413->54592 54416 1056440 54415->54416 54417 105647b 54416->54417 54418 10564d1 GetStdHandle 54416->54418 54419 105648e GetModuleHandleW 54416->54419 54420 105682d 54417->54420 54423 1056821 LocalFree 54417->54423 54440 10564e8 54418->54440 54421 10564b0 54419->54421 54422 105649f GetProcAddress 54419->54422 54424 1056850 54420->54424 54426 1056844 LocalFree 54420->54426 54421->54418 54425 10564b9 GetModuleHandleW GetProcAddress 54421->54425 54422->54421 54423->54420 54427 10478b9 3 API calls 54424->54427 54425->54418 54426->54424 54428 105685e 54427->54428 54428->54320 54429 10567bd vfwprintf 54429->54417 54430 105665c 54432 105667c LocalAlloc 54430->54432 54433 105666e 54430->54433 54431 105661f WriteConsoleW 54434 1056647 54431->54434 54454 1056657 54431->54454 54432->54433 54436 105668f 54432->54436 54433->54429 54442 10566b2 GetACP WideCharToMultiByte 54433->54442 54631 1066c28 GetLastError 54434->54631 54435 10565bc GetFileType 54438 10565e2 54435->54438 54451 10565d2 54435->54451 54633 104eec8 7 API calls 54436->54633 54630 104eedc 7 API calls 54438->54630 54439 1056593 54629 104eec8 7 API calls 54439->54629 54440->54439 54444 105654b LocalFree 54440->54444 54450 105655f LocalAlloc 54440->54450 54440->54451 54453 10565ae 54440->54453 54456 105655d 54440->54456 54447 10566df 54442->54447 54468 1056702 54442->54468 54443 105664c 54632 104eec8 7 API calls 54443->54632 54444->54440 54445 105669e 54445->54433 54634 1066c28 GetLastError 54447->54634 54450->54456 54457 105659f 54450->54457 54451->54429 54451->54430 54451->54431 54453->54435 54453->54451 54454->54417 54454->54429 54455 105676b WriteFile 54455->54454 54460 105678b 54455->54460 54456->54440 54456->54450 54465 1056591 54456->54465 54457->54439 54458 10566e4 54635 104eec8 7 API calls 54458->54635 54459 1056736 memmove 54459->54468 54636 1066c28 GetLastError 54460->54636 54463 10566ef GetACP 54466 104eef2 7 API calls 54463->54466 54464 1056790 54637 104eec8 7 API calls 54464->54637 54465->54453 54466->54468 54468->54429 54468->54455 54468->54459 54469 105679d 54469->54454 54470->54269 54471->54285 54472->54307 54473->54269 54474->54269 54475->54284 54476->54268 54478 1067c0b GetComputerNameExW 54477->54478 54486 1067bee 54478->54486 54487 1067c14 54478->54487 54480 1067c17 LocalAlloc 54481 1067c3c GetComputerNameExW 54480->54481 54488 1067c2a 54480->54488 54482 1067c4a 54481->54482 54481->54488 54493 1066c28 GetLastError 54482->54493 54484 1067c62 LocalFree 54485 1067c69 54484->54485 54485->54347 54486->54478 54486->54485 54486->54487 54492 1066c28 GetLastError 54486->54492 54487->54480 54487->54485 54488->54484 54488->54485 54489->54344 54490->54347 54491->54348 54492->54486 54493->54488 54495 1035c06 lstrcmpW 54494->54495 54497 1035d40 54494->54497 54496 1035c1a 54495->54496 54495->54497 54593 1066e30 wcslen LocalAlloc 54496->54593 54498 1035d67 54497->54498 54500 1056431 26 API calls 54497->54500 54501 1035d72 LocalFree 54498->54501 54502 1035d7b 54498->54502 54500->54498 54501->54502 54502->54356 54502->54357 54502->54359 54502->54361 54504 1035c3a 54505 1035c50 iswdigit 54504->54505 54506 1035c40 54504->54506 54507 1035c67 54505->54507 54594 104eec8 7 API calls 54506->54594 54508 1035c7a wcschr 54507->54508 54520 1035d01 54507->54520 54510 1035cda 54508->54510 54511 1035c8d wcschr 54508->54511 54510->54520 54597 104efde 11 API calls 54510->54597 54514 1035cb4 54511->54514 54515 1035c9e 54511->54515 54513 1035c4b 54513->54498 54514->54510 54514->54520 54596 104efde 11 API calls 54514->54596 54515->54514 54595 104efde 11 API calls 54515->54595 54516 1035d20 54516->54506 54517 1035d31 54516->54517 54517->54497 54520->54497 54598 104f691 12 API calls 54520->54598 54523 1036816 54522->54523 54524 1036842 wcsncpy 54523->54524 54525 1036825 wcscmp 54523->54525 54529 1051224 10 API calls 54524->54529 54525->54524 54526 1036839 54525->54526 54528 1051224 10 API calls 54526->54528 54528->54524 54530 1036870 54529->54530 54531 1036912 54530->54531 54532 1051224 10 API calls 54530->54532 54534 1036945 54531->54534 54535 103691f 54531->54535 54533 103688f 54532->54533 54533->54531 54536 1036897 wcslen 54533->54536 54537 1036969 54534->54537 54544 103692b 54534->54544 54600 10365ef 24 API calls 54535->54600 54539 10368b9 LocalAlloc 54536->54539 54540 10368af wcslen 54536->54540 54542 1036957 54537->54542 54546 10369c3 54537->54546 54543 10368cf 54539->54543 54547 10368e7 swprintf wcscat 54539->54547 54540->54539 54542->54537 54542->54543 54549 1056431 26 API calls 54542->54549 54599 104eec8 7 API calls 54543->54599 54544->54534 54544->54543 54601 1066e30 wcslen LocalAlloc 54544->54601 54551 10369d0 CertOpenStore 54546->54551 54555 10368e2 54546->54555 54547->54531 54552 1036985 54549->54552 54551->54555 54556 1036a17 54551->54556 54602 105346c 12 API calls 54552->54602 54553 1036a50 LocalFree 54554 1036a55 54553->54554 54558 1036a5a LocalFree 54554->54558 54559 1036a5f 54554->54559 54555->54553 54555->54554 54604 1066c28 GetLastError 54556->54604 54558->54559 54562 1036a64 LocalFree 54559->54562 54563 1036a69 54559->54563 54561 1036991 54561->54546 54603 1066c28 GetLastError 54561->54603 54562->54563 54566 10478b9 3 API calls 54563->54566 54564 1036a1c 54567 104eef2 7 API calls 54564->54567 54569 1036a77 54566->54569 54567->54555 54568 103699c 54570 104eef2 7 API calls 54568->54570 54569->54372 54569->54373 54571 10369ad 54570->54571 54571->54543 54571->54546 54573 105541f 54572->54573 54574 105540f 54572->54574 54578 105544f 54573->54578 54579 1055425 54573->54579 54580 1055430 54573->54580 54619 10552ce 14 API calls 54573->54619 54617 105532d 10 API calls 54574->54617 54578->54579 54578->54580 54605 10551db 54578->54605 54579->54580 54618 104eec8 7 API calls 54579->54618 54580->54393 54582->54363 54583->54371 54584->54358 54585->54368 54586->54406 54587->54368 54588->54411 54589->54401 54590->54412 54591->54396 54592->54411 54593->54504 54594->54513 54595->54514 54596->54510 54597->54520 54598->54516 54599->54555 54600->54544 54601->54542 54602->54561 54603->54568 54604->54564 54620 1051bfb 54605->54620 54608 1055221 54611 105521f 54608->54611 54628 10511f7 10 API calls 54608->54628 54609 105520d 54626 1066c28 GetLastError 54609->54626 54614 10552a2 LocalFree 54611->54614 54615 10552ab 54611->54615 54612 1055212 54627 104eec8 7 API calls 54612->54627 54614->54615 54615->54579 54617->54573 54618->54580 54619->54578 54621 106765a 54620->54621 54622 106767b CryptDecodeObjectEx 54621->54622 54623 1055209 54622->54623 54624 10676a4 54622->54624 54623->54608 54623->54609 54624->54623 54625 10676a9 SetLastError 54624->54625 54625->54623 54626->54612 54627->54611 54628->54608 54629->54453 54630->54451 54631->54443 54632->54454 54633->54445 54634->54458 54635->54463 54636->54464 54637->54469 54639 1050da0 GetVersionExW 54638->54639 54640 1050df8 54638->54640 54642 1050dc4 54639->54642 54643 1050dbf 54639->54643 54641 10478b9 3 API calls 54640->54641 54644 1050e08 CompareStringW 54641->54644 54646 1050dcf 54642->54646 54649 104eec8 7 API calls 54642->54649 54648 1066c28 GetLastError 54643->54648 54644->54243 54646->54640 54648->54642 54649->54646 54650 77b992a1 54651 77b992b7 54650->54651 54655 77b992c2 54650->54655 54657 77b99162 14 API calls ctype 54651->54657 54653 77b992d6 lstrcmpiW 54654 77b992ef 54653->54654 54653->54655 54655->54653 54655->54654 54656 77b992bc 54656->54654 54656->54655 54657->54656 54658 77ba2483 54661 77ba222a 54658->54661 54662 77ba2258 54661->54662 54663 77ba2269 54661->54663 54704 77badb87 15 API calls ctype 54662->54704 54664 77ba226f wcslen 54663->54664 54701 77ba21db 54664->54701 54667 77ba2262 54667->54663 54667->54664 54668 77ba228a 54669 77ba235f 54668->54669 54671 77ba22ba 54668->54671 54675 77ba21db ctype FormatMessageW 54668->54675 54670 77ba2374 54669->54670 54707 77ba214d _snwprintf ctype 54669->54707 54673 77ba2378 54670->54673 54674 77ba2396 wcslen 54670->54674 54671->54669 54676 77ba22e5 LoadLibraryW 54671->54676 54705 77ba2183 16 API calls ctype 54671->54705 54708 77badb87 15 API calls ctype 54673->54708 54678 77ba23a9 54674->54678 54679 77ba23be wcslen LocalAlloc 54674->54679 54675->54671 54681 77ba22f7 54676->54681 54693 77ba234e 54676->54693 54678->54679 54688 77ba23bc 54678->54688 54684 77ba23de 54679->54684 54694 77ba2440 54679->54694 54685 77ba21db ctype FormatMessageW 54681->54685 54682 77ba2382 54682->54674 54683 77ba22d9 54683->54669 54683->54676 54689 77ba2419 54684->54689 54690 77ba240c wcscat wcscat 54684->54690 54699 77ba230d ctype 54685->54699 54686 77ba244c FreeLibrary 54687 77ba2455 54686->54687 54709 77b9f7cd SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 54687->54709 54688->54679 54691 77ba241f wcscat wcscat 54689->54691 54695 77ba242d 54689->54695 54690->54689 54691->54695 54693->54669 54694->54686 54694->54687 54695->54694 54697 77ba2439 LocalFree 54695->54697 54696 77ba2460 54697->54694 54699->54693 54700 77ba21db ctype FormatMessageW 54699->54700 54706 77bb373b GetLastError ctype 54699->54706 54700->54699 54702 77ba21f8 FormatMessageW 54701->54702 54702->54668 54704->54667 54705->54683 54706->54699 54707->54670 54708->54682 54709->54696 54710 77ba13f1 54713 77ba1307 54710->54713 54712 77ba13fd 54714 77ba1313 ctype 54713->54714 54715 77ba13ac ctype 54714->54715 54716 77ba1321 InitializeCriticalSection getenv 54714->54716 54715->54712 54717 77ba135d 54716->54717 54718 77ba1355 54716->54718 54725 77bb0c5f 54717->54725 54730 77ba0f76 isxdigit isdigit isupper isxdigit 54718->54730 54721 77ba135b 54721->54715 54722 77ba1387 getenv 54721->54722 54731 77ba10dc 40 API calls ctype 54722->54731 54724 77ba1395 54724->54715 54732 77bb0bbc 54725->54732 54728 77bb0cae LocalFree 54729 77bb0cb5 54728->54729 54729->54721 54730->54721 54731->54724 54735 77bb0a39 54732->54735 54734 77bb0be0 54734->54728 54734->54729 54736 77bb0a61 54735->54736 54754 77bb07af 54736->54754 54739 77bb0b92 54743 77bb0ba0 54739->54743 54744 77bb0b97 LocalFree 54739->54744 54740 77bb0aad 54745 77bb0ab4 RegOpenKeyExW 54740->54745 54741 77bb0a90 RegConnectRegistryW 54741->54745 54750 77bb0aa8 54741->54750 54742 77bb0b8d RegCloseKey 54742->54739 54746 77bb0baa ctype 54743->54746 54747 77bb0ba5 RegCloseKey 54743->54747 54744->54743 54749 77bb0ad4 54745->54749 54745->54750 54746->54734 54747->54746 54748 77bb0b22 RegQueryValueExW 54748->54749 54748->54750 54749->54748 54749->54750 54751 77bb0b09 LocalAlloc 54749->54751 54752 77bb0b02 54749->54752 54750->54739 54750->54742 54751->54752 54753 77bb0b74 54751->54753 54752->54748 54752->54751 54753->54750 54755 77bb07cf 54754->54755 54756 77bb07c4 wcslen 54754->54756 54757 77bb07e3 54755->54757 54758 77bb07da wcslen 54755->54758 54756->54755 54759 77bb07f5 LocalAlloc 54757->54759 54760 77bb07ee wcslen 54757->54760 54758->54757 54761 77bb0822 wcscpy 54759->54761 54763 77bb081b 54759->54763 54760->54759 54761->54763 54764 77bb0842 wcscat wcscat 54761->54764 54763->54740 54763->54741 54763->54750 54764->54763 54765 77bb0860 wcscat wcscat 54764->54765 54765->54763 54766 77bb0873 wcscat wcscat 54765->54766 54766->54763 54767 77ba14e7 54790 77b9199f 54767->54790 54769 77ba1512 GetLastError #205 54770 77ba154c _vsnprintf 54769->54770 54786 77ba168a 54769->54786 54773 77ba1583 54770->54773 54771 77ba16a2 54774 77ba16bc SetLastError 54771->54774 54777 77ba16b4 54771->54777 54772 77ba1697 LeaveCriticalSection 54772->54771 54775 77ba15fe EnterCriticalSection IsDebuggerPresent 54773->54775 54776 77ba15b3 _snprintf 54773->54776 54798 77b9f7cd SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 54774->54798 54780 77ba164f 54775->54780 54781 77ba161c GetStdHandle 54775->54781 54779 77ba15dd 54776->54779 54777->54774 54779->54775 54784 77ba166e OutputDebugStringA 54780->54784 54785 77ba146d 3 API calls 54780->54785 54781->54780 54783 77ba162f 54781->54783 54782 77ba16dc 54792 77ba146d 54783->54792 54784->54786 54788 77ba1661 fflush 54785->54788 54786->54771 54786->54772 54788->54784 54791 77b919a6 54790->54791 54791->54769 54791->54791 54793 77ba14c6 fflush 54792->54793 54797 77ba147b 54792->54797 54793->54780 54794 77ba147c strcspn 54794->54797 54795 77ba14a8 fprintf 54795->54797 54796 77ba1498 fwprintf 54796->54797 54797->54793 54797->54794 54797->54795 54797->54796 54798->54782 54799 105edea 54800 105edf5 54799->54800 54801 105ee32 54799->54801 54802 105ee03 EnterCriticalSection 54800->54802 54803 105ee0b 54800->54803 54802->54803 54807 105ea53 54803->54807 54806 105ee2b LeaveCriticalSection 54806->54801 54810 105ea5d 54807->54810 54811 105ea93 fflush 54807->54811 54808 105ea5e strcspn 54809 105ea72 fprintf 54808->54809 54808->54810 54809->54810 54810->54808 54810->54811 54811->54801 54811->54806

                                                                                                                                                                                                      Executed Functions

                                                                                                                                                                                                      Function 0101C824 Relevance: 42.1, APIs: 17, Strings: 7, Instructions: 123windowregistryCOMMON
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • _setmode.MSVCRT ref: 0101C83A
                                                                                                                                                                                                      • _wsetlocale.MSVCRT ref: 0101C848
                                                                                                                                                                                                        • Part of subcall function 0104EA1A: GetStdHandle.KERNEL32(000000F5,00000000,0101C857,00000000), ref: 0104EA1F
                                                                                                                                                                                                        • Part of subcall function 0104EA1A: GetFileType.KERNEL32(00000000), ref: 0104EA2B
                                                                                                                                                                                                        • Part of subcall function 0104EA1A: GetModuleHandleW.KERNEL32(kernel32.dll), ref: 0104EA49
                                                                                                                                                                                                        • Part of subcall function 0104EA1A: GetProcAddress.KERNEL32(00000000,SetThreadUILanguage), ref: 0104EA59
                                                                                                                                                                                                        • Part of subcall function 0104EA1A: SetThreadUILanguage.KERNEL32(?), ref: 0104EA6C
                                                                                                                                                                                                        • Part of subcall function 0105EEE0: InitializeCriticalSection.KERNEL32(01075074,010118D0,00000120,0101C86A,+certutil.log,00000000), ref: 0105EF1B
                                                                                                                                                                                                        • Part of subcall function 0105EEE0: EnterCriticalSection.KERNEL32(01075074,010118D0,00000120,0101C86A,+certutil.log,00000000), ref: 0105EF59
                                                                                                                                                                                                        • Part of subcall function 0105EEE0: GetWindowsDirectoryA.KERNEL32(?,00000104,010118D0,00000120,0101C86A,+certutil.log,00000000), ref: 0105EF88
                                                                                                                                                                                                        • Part of subcall function 0105EEE0: fopen.MSVCRT ref: 0105EFFE
                                                                                                                                                                                                        • Part of subcall function 0105EEE0: fseek.MSVCRT ref: 0105F01B
                                                                                                                                                                                                        • Part of subcall function 0105EEE0: ftell.MSVCRT ref: 0105F02E
                                                                                                                                                                                                        • Part of subcall function 0105EEE0: fclose.MSVCRT ref: 0105F042
                                                                                                                                                                                                        • Part of subcall function 0105ECDB: #211.CERTCLI(..CertCli Version,?,?,00000000,?,?,?,0101C884,0000012D,00000C94,00000000,certutil.exe,5.2.3790.0 retail (srv03_rtm.030324-2048),+certutil.log), ref: 0105ECF0
                                                                                                                                                                                                        • Part of subcall function 0105ECDB: LocalFree.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,00000000,00000C94,000000FF,?,?,00000000,?,certcli.dll,?,00000000), ref: 0105ED66
                                                                                                                                                                                                      • LoadIconW.USER32(00000000,00007F00), ref: 0101C89E
                                                                                                                                                                                                      • LoadCursorW.USER32(00000000,00007F00), ref: 0101C8A9
                                                                                                                                                                                                      • GetStockObject.GDI32(00000000), ref: 0101C8B3
                                                                                                                                                                                                      • RegisterClassW.USER32(?), ref: 0101C8CB
                                                                                                                                                                                                      • GetLastError.KERNEL32 ref: 0101C8D6
                                                                                                                                                                                                      • CreateWindowExW.USER32(00000000,CertUtilApp,CertUtil Application,00CF0000,80000000,80000000,80000000,80000000,00000000,00000000,?,00000000), ref: 0101C8F9
                                                                                                                                                                                                      • UpdateWindow.USER32(00000000), ref: 0101C906
                                                                                                                                                                                                      • PostMessageW.USER32(00000000,00000400,00000000,?), ref: 0101C916
                                                                                                                                                                                                      • GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0101C93F
                                                                                                                                                                                                      • LocalFree.KERNEL32(0042D418), ref: 0101C958
                                                                                                                                                                                                      • LocalFree.KERNEL32(0042FC68), ref: 0101C964
                                                                                                                                                                                                      • LocalFree.KERNEL32(00000000), ref: 0101C970
                                                                                                                                                                                                      • #213.CERTCLI(certutil.exe), ref: 0101C981
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 0000000A.00000002.2668757884.0000000001001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 01000000, based on PE: true
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668728494.0000000001000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668837967.000000000106F000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668875659.0000000001072000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668905907.0000000001076000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_1000000_certutil.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: FreeLocal$CriticalHandleLoadMessageSectionWindow$#211#213AddressClassCreateCursorDirectoryEnterErrorFileIconInitializeLanguageLastModuleObjectPostProcRegisterStockThreadTypeUpdateWindows_setmode_wsetlocalefclosefopenfseekftell
                                                                                                                                                                                                      • String ID: +certutil.log$.OCP$5.2.3790.0 retail (srv03_rtm.030324-2048)$CertUtil Application$CertUtilApp$certutil.exe$certutil.exe
                                                                                                                                                                                                      • API String ID: 2093531061-740614955
                                                                                                                                                                                                      • Opcode ID: c8d97eec012e35ae58121bae3d8314b7f7897c3ce0fe3b846725e1c3250ff92d
                                                                                                                                                                                                      • Instruction ID: aebd98259196c2234609e25537062a783bbb808fc32038e89c638af373dd0f16
                                                                                                                                                                                                      • Opcode Fuzzy Hash: c8d97eec012e35ae58121bae3d8314b7f7897c3ce0fe3b846725e1c3250ff92d
                                                                                                                                                                                                      • Instruction Fuzzy Hash: C3415CB1941219ABE722AFA9DC88DAF7BBDFF49740F104015F5C5E7248CB79D4018BA4
                                                                                                                                                                                                      Function 77BA14E7 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 139COMMON
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetLastError.KERNEL32(?,?,?,?,?,?,77BB355A,77BA16F8,000000FF), ref: 77BA1530
                                                                                                                                                                                                      • #205.CERTCLI(?,?,?,?,?,?,?,77BB355A,77BA16F8,000000FF), ref: 77BA153F
                                                                                                                                                                                                      • _vsnprintf.MSVCRT ref: 77BA1568
                                                                                                                                                                                                      • _snprintf.MSVCRT ref: 77BA15C8
                                                                                                                                                                                                      • EnterCriticalSection.KERNEL32(77BB9C70,?), ref: 77BA1603
                                                                                                                                                                                                      • IsDebuggerPresent.KERNEL32 ref: 77BA1612
                                                                                                                                                                                                      • GetStdHandle.KERNEL32(000000F5), ref: 77BA161E
                                                                                                                                                                                                      • fflush.MSVCRT ref: 77BA1648
                                                                                                                                                                                                      • fflush.MSVCRT ref: 77BA1667
                                                                                                                                                                                                      • OutputDebugStringA.KERNEL32(?), ref: 77BA166F
                                                                                                                                                                                                      • LeaveCriticalSection.KERNEL32(77BB9C70), ref: 77BA169C
                                                                                                                                                                                                      • SetLastError.KERNEL32(?), ref: 77BA16C2
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 0000000A.00000002.2669135112.0000000077B91000.00000020.00000001.01000000.0000000D.sdmp, Offset: 77B90000, based on PE: true
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2669106858.0000000077B90000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2669169116.0000000077BB8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2669268771.0000000077BBA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_77b90000_certutil.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CriticalErrorLastSectionfflush$#205DebugDebuggerEnterHandleLeaveOutputPresentString_snprintf_vsnprintf
                                                                                                                                                                                                      • String ID: %hs: %hs$...
                                                                                                                                                                                                      • API String ID: 2898211850-1011862524
                                                                                                                                                                                                      • Opcode ID: d0efdc2da17193a076ab29f765c458fc227f2fc86a892aacf1947810766c0252
                                                                                                                                                                                                      • Instruction ID: e361c84a0f7db091560ba892a7db6cbfd77efb89fdbb5f132ad57ef4191638a6
                                                                                                                                                                                                      • Opcode Fuzzy Hash: d0efdc2da17193a076ab29f765c458fc227f2fc86a892aacf1947810766c0252
                                                                                                                                                                                                      • Instruction Fuzzy Hash: CD51E7B190426DEFEB20AF69CD487AE7BB8EB84350F104599F829E3251D7348D85CF50
                                                                                                                                                                                                      Function 0106765A Relevance: 3.0, APIs: 2, Instructions: 32encryptionCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • CryptDecodeObjectEx.CRYPT32(00000000,0000000C,010033D0,?,00008000,0000000C,?,?), ref: 0106769A
                                                                                                                                                                                                      • SetLastError.KERNEL32(8007000D), ref: 010676AE
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 0000000A.00000002.2668757884.0000000001001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 01000000, based on PE: true
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668728494.0000000001000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668837967.000000000106F000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668875659.0000000001072000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668905907.0000000001076000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_1000000_certutil.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CryptDecodeErrorLastObject
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 1484094689-0
                                                                                                                                                                                                      • Opcode ID: 443c15dfa7c514dc934cab886edffb00e25dcdba9a240d47401986757d36f544
                                                                                                                                                                                                      • Instruction ID: f05153d233e97857fe549557ae0254c6b9ad9ea808170a1fae181ef63b6c446e
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 443c15dfa7c514dc934cab886edffb00e25dcdba9a240d47401986757d36f544
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 48F0F4B1800209EBDF22AFA4DC04EDE7FB9FF18354F008155BD85A2150E775C560DBA0
                                                                                                                                                                                                      Function 01056431 Relevance: 38.8, APIs: 18, Strings: 4, Instructions: 263librarymemoryloaderCOMMON
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                      control_flow_graph 26 1056431-105646a call 1047be0 29 1056473-1056479 26->29 30 105646c 26->30 31 1056486-105648c 29->31 32 105647b-1056481 29->32 30->29 34 10564d1-10564e6 GetStdHandle 31->34 35 105648e-105649d GetModuleHandleW 31->35 33 105680a-1056811 32->33 36 1056813-105681f 33->36 37 105682d-1056834 33->37 40 10564f1-10564fa 34->40 41 10564e8-10564ef 34->41 38 10564b0-10564b7 35->38 39 105649f-10564ab GetProcAddress 35->39 36->37 42 1056821-1056827 LocalFree 36->42 43 1056836-1056842 37->43 44 1056850-1056863 call 10478b9 call 1047c1b 37->44 38->34 45 10564b9-10564cc GetModuleHandleW GetProcAddress 38->45 39->38 47 10564ff-105650c 40->47 41->40 46 10564fc 41->46 42->37 43->44 48 1056844-105684a LocalFree 43->48 45->34 46->47 50 1056603-1056611 47->50 51 1056512-105652e 47->51 48->44 53 1056617-105661d 50->53 54 10567bd-10567e3 vfwprintf 50->54 59 10565b4-10565ba 51->59 60 1056534 51->60 57 105665c-105666c 53->57 58 105661f-1056641 WriteConsoleW 53->58 54->33 61 105667c-105668d LocalAlloc 57->61 62 105666e-105667a 57->62 64 10567b5-10567bb 58->64 65 1056647-1056657 call 1066c28 call 104eec8 58->65 59->50 66 10565bc-10565d0 GetFileType 59->66 67 1056539-105653b 60->67 68 10566a4-10566ac 61->68 69 105668f-105669e call 104eec8 61->69 62->68 64->33 64->54 95 10567af 65->95 71 10565e2-10565f9 call 104eedc 66->71 72 10565d2-10565d4 66->72 73 1056593-105659d 67->73 74 105653d-1056549 67->74 68->54 76 10566b2-10566dd GetACP WideCharToMultiByte 68->76 69->68 71->50 72->50 78 10565d6-10565e0 72->78 85 10565a9-10565ae call 104eec8 73->85 79 1056557-105655b 74->79 80 105654b-1056551 LocalFree 74->80 83 10566df-1056702 call 1066c28 call 104eec8 GetACP call 104eef2 76->83 84 1056708-105670e 76->84 78->50 90 105655d 79->90 91 105655f-1056573 LocalAlloc 79->91 80->79 83->84 84->54 89 1056714-105672f 84->89 85->59 96 1056731-1056734 89->96 97 105676b-1056789 WriteFile 89->97 90->91 98 1056575-105658f 91->98 99 105659f-10565a4 91->99 95->64 101 1056736-1056759 memmove 96->101 102 105675c-1056769 96->102 97->64 103 105678b-10567a3 call 1066c28 call 104eec8 97->103 98->67 109 1056591 98->109 99->85 101->102 102->96 102->97 103->64 114 10567a5 103->114 109->59 114->95
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetModuleHandleW.KERNEL32(ntdll.dll,010105C8,00000830,01022610,%ws,00000000,?,?,?,00000000,00000000,?,00000000,00000000,?), ref: 01056499
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,_vsnwprintf), ref: 010564A5
                                                                                                                                                                                                      • GetModuleHandleW.KERNEL32(msvcrt.dll,?,00000000,00000000,?), ref: 010564BE
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,_vsnwprintf), ref: 010564C6
                                                                                                                                                                                                      • GetStdHandle.KERNEL32(000000F5,010105C8,00000830,01022610,%ws,00000000,?,?,?,00000000,00000000,?,00000000,00000000,?), ref: 010564D3
                                                                                                                                                                                                      • LocalFree.KERNEL32(?,?,?,?,?,00000000,00000000,?), ref: 01056551
                                                                                                                                                                                                      • LocalAlloc.KERNEL32(00000000,?,?,?,?,?,00000000,00000000,?), ref: 01056565
                                                                                                                                                                                                      • GetFileType.KERNEL32(?,?,?,?,?,00000000,00000000,?), ref: 010565C2
                                                                                                                                                                                                      • WriteConsoleW.KERNEL32(?,?,00000000,?,00000000), ref: 01056639
                                                                                                                                                                                                      • LocalAlloc.KERNEL32(00000000,?), ref: 0105667F
                                                                                                                                                                                                      • GetACP.KERNEL32(00000000,?,00000000,?,?,00000000,00000000), ref: 010566D0
                                                                                                                                                                                                      • WideCharToMultiByte.KERNEL32(00000000), ref: 010566D3
                                                                                                                                                                                                      • GetACP.KERNEL32(035F01A1,00000000), ref: 010566EF
                                                                                                                                                                                                      • memmove.MSVCRT(?,?,00000000), ref: 01056744
                                                                                                                                                                                                      • WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 01056781
                                                                                                                                                                                                      • vfwprintf.MSVCRT ref: 010567D1
                                                                                                                                                                                                      • LocalFree.KERNEL32(00000000), ref: 01056827
                                                                                                                                                                                                      • LocalFree.KERNEL32(?), ref: 0105684A
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 0000000A.00000002.2668757884.0000000001001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 01000000, based on PE: true
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668728494.0000000001000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668837967.000000000106F000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668875659.0000000001072000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668905907.0000000001076000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_1000000_certutil.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Local$FreeHandle$AddressAllocFileModuleProcWrite$ByteCharConsoleMultiTypeWidememmovevfwprintf
                                                                                                                                                                                                      • String ID: (null)$_vsnwprintf$msvcrt.dll$ntdll.dll
                                                                                                                                                                                                      • API String ID: 1494096431-2325514768
                                                                                                                                                                                                      • Opcode ID: e9cdb346dcea4d042a6d74f6be76789e4c0ba86e949d18edfab1f733b44efc5f
                                                                                                                                                                                                      • Instruction ID: 83b1571376c3452bbbb8d4d195e5a7a0ffb6aeb2671d552ff07482d200e23cbb
                                                                                                                                                                                                      • Opcode Fuzzy Hash: e9cdb346dcea4d042a6d74f6be76789e4c0ba86e949d18edfab1f733b44efc5f
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 8BB12E71900229DFEBB19F64CC44BAE7AF4FB08314F5481E9E9C9A2145DB769A80CFD4
                                                                                                                                                                                                      Function 0101C4D5 Relevance: 28.3, APIs: 15, Strings: 1, Instructions: 280memoryCOMMON
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                      control_flow_graph 115 101c4d5-101c501 wcslen LocalAlloc 116 101c513-101c525 115->116 117 101c503-101c50e 115->117 119 101c5ab-101c5ae 116->119 118 101c605 117->118 122 101c607-101c618 call 104eec8 call 101b4f1 118->122 120 101c5b4-101c5bc 119->120 121 101c52a-101c531 119->121 126 101c5e7-101c5f8 LocalAlloc 120->126 127 101c5be-101c5db wcslen wcschr 120->127 124 101c533-101c537 121->124 125 101c539-101c53b 121->125 139 101c61d-101c626 122->139 124->125 129 101c53d-101c543 124->129 125->121 132 101c676-101c67f 126->132 133 101c5fa-101c600 126->133 130 101c5dd-101c5de 127->130 131 101c5df-101c5e3 127->131 129->120 135 101c545-101c550 129->135 130->131 131->127 136 101c5e5 131->136 137 101c792-101c7b6 call 105eb2a call 101bf0b 132->137 138 101c685-101c694 132->138 133->118 141 101c662-101c674 135->141 142 101c556 135->142 136->126 164 101c7bb-101c7bf 137->164 143 101c699-101c6b5 wcschr 138->143 144 101c628-101c62b LocalFree 139->144 145 101c62d-101c630 139->145 141->122 147 101c558-101c55a 142->147 148 101c750-101c752 143->148 149 101c6bb-101c6d3 wcscat 143->149 144->145 154 101c632-101c635 LocalFree 145->154 155 101c637-101c654 call 105eb2a 145->155 157 101c567-101c56b 147->157 158 101c55c-101c55f 147->158 150 101c760-101c76f wcscat 148->150 151 101c754-101c75f wcscat 148->151 152 101c6f0-101c700 call 1051224 149->152 153 101c6d5-101c6d9 149->153 160 101c771-101c77c wcscat 150->160 161 101c77d-101c78a 150->161 151->150 152->148 180 101c702-101c705 152->180 153->152 159 101c6db-101c6e0 153->159 154->155 175 101c659-101c65f 155->175 167 101c56d-101c571 157->167 168 101c59f-101c5a7 157->168 165 101c561-101c565 158->165 166 101c590-101c594 158->166 159->152 169 101c6e2-101c6e7 159->169 160->161 171 101c790 161->171 172 101c696 161->172 164->139 176 101c7c5-101c7d2 call 104eedc 164->176 177 101c597-101c59d 165->177 170 101c595-101c596 166->170 167->168 178 101c573-101c577 167->178 168->120 173 101c5a9-101c5aa 168->173 169->152 179 101c6e9-101c6ee 169->179 170->177 171->137 172->143 173->119 176->139 177->147 177->168 182 101c579-101c57b 178->182 183 101c57d-101c582 178->183 179->148 179->152 185 101c708-101c713 180->185 182->170 183->166 184 101c584-101c58e 183->184 184->170 187 101c720-101c725 185->187 188 101c715-101c717 185->188 190 101c72c-101c73e wcscat wcschr 187->190 191 101c727 187->191 189 101c719-101c71e 188->189 188->190 189->190 190->161 192 101c740-101c74e wcscat 190->192 191->190 192->185
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • wcslen.MSVCRT ref: 0101C4E9
                                                                                                                                                                                                      • LocalAlloc.KERNEL32(00000000,?), ref: 0101C4F6
                                                                                                                                                                                                      • wcslen.MSVCRT ref: 0101C5C3
                                                                                                                                                                                                      • wcschr.MSVCRT ref: 0101C5D0
                                                                                                                                                                                                      • LocalAlloc.KERNEL32(00000000,00000002), ref: 0101C5ED
                                                                                                                                                                                                      • LocalFree.KERNEL32(?,?,01003468,?,0000012D,00000C34,00000000,000001D1,?,00000000,00000000), ref: 0101C62B
                                                                                                                                                                                                      • LocalFree.KERNEL32(?,?,01003468,?,0000012D,00000C34,00000000,000001D1,?,00000000,00000000), ref: 0101C635
                                                                                                                                                                                                      • wcschr.MSVCRT ref: 0101C6A5
                                                                                                                                                                                                      • wcscat.MSVCRT ref: 0101C6C3
                                                                                                                                                                                                      • wcscat.MSVCRT ref: 0101C730
                                                                                                                                                                                                      • wcschr.MSVCRT ref: 0101C735
                                                                                                                                                                                                      • wcscat.MSVCRT ref: 0101C74A
                                                                                                                                                                                                      • wcscat.MSVCRT ref: 0101C75C
                                                                                                                                                                                                      • wcscat.MSVCRT ref: 0101C769
                                                                                                                                                                                                      • wcscat.MSVCRT ref: 0101C779
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 0000000A.00000002.2668757884.0000000001001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 01000000, based on PE: true
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668728494.0000000001000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668837967.000000000106F000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668875659.0000000001072000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668905907.0000000001076000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_1000000_certutil.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: wcscat$Local$wcschr$AllocFreewcslen
                                                                                                                                                                                                      • String ID: CertUtil
                                                                                                                                                                                                      • API String ID: 4079168937-236343649
                                                                                                                                                                                                      • Opcode ID: ebd6ab926a736bb5f6bdce746d68555b660dba514ffb5c68c58d25b4f13c2758
                                                                                                                                                                                                      • Instruction ID: 25be44bae9b0e75998ac1ec84e42b3a60bef64b7060b2217ff91b51fab928f66
                                                                                                                                                                                                      • Opcode Fuzzy Hash: ebd6ab926a736bb5f6bdce746d68555b660dba514ffb5c68c58d25b4f13c2758
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 3091E971940209EFFB219F98CA44ABE7BF4FB04354F5044A9E686AB154D778DD80CB51
                                                                                                                                                                                                      Function 0105EB2A Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 140COMMON
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                      control_flow_graph 193 105eb2a-105eb4d 194 105eb85-105eb8b 193->194 195 105eb4f-105eb56 193->195 196 105eb8d-105eb98 EnterCriticalSection 194->196 197 105eb9f-105eba6 194->197 198 105eb58-105eb68 call 104e3f1 195->198 199 105eb6a-105eb6f call 104e4f5 195->199 196->197 200 105ebac-105ebcb fprintf 197->200 201 105ec9a-105ec9d 197->201 215 105eb71-105eb73 198->215 199->215 204 105ebe4-105ebe8 200->204 205 105ebcd-105ebdf fprintf call 105eae9 200->205 206 105ec9f-105eca4 LeaveCriticalSection 201->206 207 105ecaa-105ecb3 201->207 211 105ec03-105ec07 204->211 212 105ebea-105ebfe fprintf call 105eae9 204->212 205->204 206->207 213 105ecb5-105ecb8 LocalFree 207->213 214 105ecba-105ecbd 207->214 220 105ec22-105ec27 211->220 221 105ec09-105ec1d fprintf call 105eae9 211->221 212->211 213->214 218 105eccc-105ecd8 call 10478b9 214->218 219 105ecbf-105ecc5 214->219 215->194 216 105eb75-105eb80 call 1066c28 call 104eec8 215->216 216->194 219->218 226 105ecc7-105ecca LocalFree 219->226 224 105ec3d-105ec41 220->224 225 105ec29-105ec3a fprintf 220->225 221->220 230 105ec43-105ec52 #207 224->230 231 105ec7c-105ec98 fprintf fflush 224->231 225->224 226->218 233 105ec54-105ec60 #208 230->233 234 105ec63-105ec77 fprintf call 105eae9 230->234 231->201 233->234 234->231
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • EnterCriticalSection.KERNEL32(01075074,?,00000000,?), ref: 0105EB92
                                                                                                                                                                                                      • fprintf.MSVCRT ref: 0105EBBF
                                                                                                                                                                                                      • fprintf.MSVCRT ref: 0105EBD4
                                                                                                                                                                                                      • fprintf.MSVCRT ref: 0105EBF1
                                                                                                                                                                                                      • fprintf.MSVCRT ref: 0105EC10
                                                                                                                                                                                                      • fprintf.MSVCRT ref: 0105EC38
                                                                                                                                                                                                      • #207.CERTCLI(00000000,00000001), ref: 0105EC48
                                                                                                                                                                                                      • #208.CERTCLI(?,00000000,00000000,00000001), ref: 0105EC5B
                                                                                                                                                                                                      • fprintf.MSVCRT ref: 0105EC6A
                                                                                                                                                                                                      • fprintf.MSVCRT ref: 0105EC87
                                                                                                                                                                                                      • fflush.MSVCRT ref: 0105EC8F
                                                                                                                                                                                                      • LeaveCriticalSection.KERNEL32(01075074,?,00000000,?), ref: 0105ECA4
                                                                                                                                                                                                      • LocalFree.KERNEL32(?,?,00000000,?), ref: 0105ECB8
                                                                                                                                                                                                      • LocalFree.KERNEL32(?,?,00000000,?), ref: 0105ECCA
                                                                                                                                                                                                        • Part of subcall function 0104E3F1: LoadStringW.USER32(?,?,?,00000080), ref: 0104E46E
                                                                                                                                                                                                        • Part of subcall function 0104E3F1: LocalFree.KERNEL32(?,?,?), ref: 0104E4C7
                                                                                                                                                                                                        • Part of subcall function 0104E3F1: SetLastError.KERNEL32(00000000,?,?), ref: 0104E4D4
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 0000000A.00000002.2668757884.0000000001001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 01000000, based on PE: true
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668728494.0000000001000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668837967.000000000106F000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668875659.0000000001072000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668905907.0000000001076000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_1000000_certutil.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: fprintf$FreeLocal$CriticalSection$#207#208EnterErrorLastLeaveLoadStringfflush
                                                                                                                                                                                                      • String ID: %u.%u.%u$: 0x%x(%d)
                                                                                                                                                                                                      • API String ID: 1489230658-3676719036
                                                                                                                                                                                                      • Opcode ID: 2bfea6cf8b327cdc42b7bc0f70a3ef6c78ad0dec6bb110440e215e1db066b79a
                                                                                                                                                                                                      • Instruction ID: 9436d1751d37f9663c48115da383b12c2dc864252483ec7dfc281145fe22f152
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 2bfea6cf8b327cdc42b7bc0f70a3ef6c78ad0dec6bb110440e215e1db066b79a
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 18413E31D00209EFEB629FA9EC45DDFBFB9FB54301B10402AF9C4AA158D776A951CB90
                                                                                                                                                                                                      Function 010367EC Relevance: 26.5, APIs: 11, Strings: 4, Instructions: 215memoryencryptionCOMMON
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                      control_flow_graph 236 10367ec-1036814 237 1036816 236->237 238 1036818-1036823 236->238 237->238 239 1036846-1036849 238->239 240 1036825-1036837 wcscmp 238->240 242 103684c-1036877 wcsncpy call 1051224 239->242 240->239 241 1036839-1036844 call 1051224 240->241 241->239 241->242 247 1036912-1036914 242->247 248 103687d-1036891 call 1051224 242->248 250 103691b-103691d 247->250 248->250 254 1036897-10368ad wcslen 248->254 252 1036945-1036949 250->252 253 103691f-1036931 call 10365ef 250->253 255 103694b-103695c call 1066e30 252->255 256 1036969-1036970 252->256 253->252 264 1036933-1036935 253->264 259 10368b9-10368cd LocalAlloc 254->259 260 10368af-10368b7 wcslen 254->260 255->256 276 103695e-1036964 255->276 262 10369c3-10369c6 256->262 263 1036972-1036976 256->263 265 10368e7-10368ee 259->265 266 10368cf-10368d8 259->266 260->259 268 10369c8-1036a15 call 1035bb4 CertOpenStore 262->268 269 1036a2f-1036a34 262->269 263->262 270 1036978-1036995 call 1056431 call 105346c 263->270 273 1036937-103693d 264->273 274 103693f-1036942 264->274 278 10368f0 265->278 279 10368f5-103690f swprintf wcscat 265->279 275 10368dd-10368e2 call 104eec8 266->275 268->269 288 1036a17-1036a2d call 1066c28 call 104eef2 268->288 271 1036a36-1036a3d 269->271 272 1036a3f 269->272 270->262 294 1036997-10369b4 call 1066c28 call 104eef2 270->294 271->272 281 1036a43-1036a4e 272->281 273->275 274->252 275->281 276->275 278->279 279->247 285 1036a50-1036a53 LocalFree 281->285 286 1036a55-1036a58 281->286 285->286 290 1036a5a-1036a5d LocalFree 286->290 291 1036a5f-1036a62 286->291 288->281 290->291 295 1036a64-1036a67 LocalFree 291->295 296 1036a69-1036a78 call 10478b9 291->296 294->262 306 10369b6-10369be 294->306 295->296 306->275
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • wcscmp.MSVCRT ref: 0103682D
                                                                                                                                                                                                      • wcsncpy.MSVCRT ref: 01036855
                                                                                                                                                                                                      • wcslen.MSVCRT ref: 0103689A
                                                                                                                                                                                                      • wcslen.MSVCRT ref: 010368B0
                                                                                                                                                                                                      • LocalAlloc.KERNEL32(00000000,-00000009,?,?,?,?,?,?,?,00000001,00000001,01004648,?), ref: 010368C0
                                                                                                                                                                                                      • swprintf.MSVCRT(00000000,ldap://%ws/,00000000,?,?,?,?,?,?,?,00000001,00000001,01004648,?), ref: 010368FC
                                                                                                                                                                                                      • wcscat.MSVCRT ref: 01036906
                                                                                                                                                                                                      • CertOpenStore.CRYPT32(00000010,00000001,00000000,00000000,01004648), ref: 01036A0B
                                                                                                                                                                                                      • LocalFree.KERNEL32(?,?,ldap:/), ref: 01036A53
                                                                                                                                                                                                      • LocalFree.KERNEL32(?,?,ldap:/), ref: 01036A5D
                                                                                                                                                                                                      • LocalFree.KERNEL32(?,?,ldap:/), ref: 01036A67
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 0000000A.00000002.2668757884.0000000001001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 01000000, based on PE: true
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668728494.0000000001000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668837967.000000000106F000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668875659.0000000001072000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668905907.0000000001076000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_1000000_certutil.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Local$Free$wcslen$AllocCertOpenStoreswprintfwcscatwcscmpwcsncpy
                                                                                                                                                                                                      • String ID: %ws$CN=$ldap:/$ldap://%ws/
                                                                                                                                                                                                      • API String ID: 992892030-2167952276
                                                                                                                                                                                                      • Opcode ID: 71d3f9e07fc8734d61a4386f080c54c6b88ef58fc05a77857b6e51bb98f6b302
                                                                                                                                                                                                      • Instruction ID: 7e4b2b8716b88e447aa3b06a0774b8fdd49437ad470b26bae36a984d0bfc48bd
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 71d3f9e07fc8734d61a4386f080c54c6b88ef58fc05a77857b6e51bb98f6b302
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 1A714EB1900209BFEF529F69C885AEE7BFDEF48344F108069E985E6251D776C641CB50
                                                                                                                                                                                                      Function 77BA222A Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 205librarymemoryCOMMONLIBRARYCODE
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                      control_flow_graph 307 77ba222a-77ba2256 308 77ba2258-77ba2267 call 77badb87 307->308 309 77ba2269-77ba226c 307->309 308->309 310 77ba226f-77ba2285 wcslen call 77ba21db 308->310 309->310 314 77ba228a-77ba228e 310->314 315 77ba235f-77ba2366 314->315 316 77ba2294-77ba22a4 314->316 317 77ba2368-77ba236f call 77ba214d 315->317 318 77ba2374-77ba2376 315->318 319 77ba22a6-77ba22be call 77ba21db 316->319 320 77ba22c4-77ba22cb 316->320 317->318 322 77ba2378-77ba2387 call 77badb87 318->322 323 77ba2396-77ba23a7 wcslen 318->323 319->315 319->320 325 77ba22cd-77ba22e3 call 77ba2183 320->325 326 77ba22e5-77ba22f5 LoadLibraryW 320->326 340 77ba2389 322->340 341 77ba2390-77ba2393 322->341 329 77ba23a9-77ba23b2 323->329 330 77ba23be-77ba23dc wcslen LocalAlloc 323->330 325->315 325->326 332 77ba22f7-77ba2311 call 77ba21db 326->332 333 77ba2354-77ba235b 326->333 329->330 335 77ba23b4-77ba23ba 329->335 337 77ba23de-77ba240a 330->337 338 77ba2443-77ba244a 330->338 350 77ba235d 332->350 351 77ba2313-77ba2315 332->351 333->315 335->330 344 77ba23bc-77ba23bd 335->344 345 77ba2419-77ba241d 337->345 346 77ba240c-77ba2416 wcscat * 2 337->346 342 77ba244c-77ba244f FreeLibrary 338->342 343 77ba2455-77ba2461 call 77b9f7cd 338->343 340->341 341->323 342->343 344->330 348 77ba241f-77ba242a wcscat * 2 345->348 349 77ba242d-77ba2432 345->349 346->345 348->349 355 77ba2440 349->355 356 77ba2434-77ba2437 349->356 350->315 353 77ba234e-77ba2350 351->353 354 77ba2317-77ba231b 351->354 353->350 360 77ba2352 353->360 354->353 358 77ba231d-77ba2327 call 77bb373b 354->358 355->338 356->355 359 77ba2439-77ba243a LocalFree 356->359 358->353 363 77ba2329-77ba2334 call 77ba1f83 358->363 359->355 360->333 363->353 366 77ba2336-77ba234c call 77ba21db 363->366 366->351 366->353
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • wcslen.MSVCRT ref: 77BA2272
                                                                                                                                                                                                      • LoadLibraryW.KERNEL32(ntdsbmsg.dll,00000000,8000FFFF,?,00000001), ref: 77BA22EA
                                                                                                                                                                                                      • #217.CERTCLI(8000FFFF,00000000,8000FFFF,?,00000001), ref: 77BA232A
                                                                                                                                                                                                      • #206.CERTCLI(?,8000FFFF,00000000,8000FFFF,?,00000001), ref: 77BA236F
                                                                                                                                                                                                        • Part of subcall function 77BADB87: LoadStringW.USER32(8000FFFF,?,00000080,00000001), ref: 77BADC3A
                                                                                                                                                                                                        • Part of subcall function 77BADB87: LocalFree.KERNEL32(?,?,?), ref: 77BADCA9
                                                                                                                                                                                                        • Part of subcall function 77BADB87: SetLastError.KERNEL32(00000000,?,?), ref: 77BADCB9
                                                                                                                                                                                                      • wcslen.MSVCRT ref: 77BA239F
                                                                                                                                                                                                      • wcslen.MSVCRT ref: 77BA23C2
                                                                                                                                                                                                      • LocalAlloc.KERNEL32(00000000,?), ref: 77BA23D2
                                                                                                                                                                                                      • wcscat.MSVCRT ref: 77BA240E
                                                                                                                                                                                                      • wcscat.MSVCRT ref: 77BA2414
                                                                                                                                                                                                      • wcscat.MSVCRT ref: 77BA2421
                                                                                                                                                                                                      • wcscat.MSVCRT ref: 77BA2428
                                                                                                                                                                                                      • LocalFree.KERNEL32(?), ref: 77BA243A
                                                                                                                                                                                                      • FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,77BA2495,00000010,00000000,00000000), ref: 77BA244F
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 0000000A.00000002.2669135112.0000000077B91000.00000020.00000001.01000000.0000000D.sdmp, Offset: 77B90000, based on PE: true
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2669106858.0000000077B90000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2669169116.0000000077BB8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2669268771.0000000077BBA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_77b90000_certutil.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: wcscat$FreeLocalwcslen$LibraryLoad$#206#217AllocErrorLastString
                                                                                                                                                                                                      • String ID: ntdsbmsg.dll
                                                                                                                                                                                                      • API String ID: 3150004767-3105615850
                                                                                                                                                                                                      • Opcode ID: 48b2be47cffcd09d0f6eeb3b5a341347f7728f2b0a01cf843f0f87ff237fa83b
                                                                                                                                                                                                      • Instruction ID: 418277a33d4ef439892e7924e8c9e76fd07da10c6e88bb8fe3599ca82c0d68c8
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 48b2be47cffcd09d0f6eeb3b5a341347f7728f2b0a01cf843f0f87ff237fa83b
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 98715DB2D04219EFEB11EFE5CD80ADEBBB9EF85304F114429E916BB214E7349944CB90
                                                                                                                                                                                                      Function 01037328 Relevance: 24.3, APIs: 16, Instructions: 308encryptionCOMMON
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                      control_flow_graph 400 1037328-103734a 401 1037360 400->401 402 103734c-103735e wcscmp 400->402 403 1037367-1037384 call 1035bd7 401->403 402->401 402->403 406 1037386-1037387 403->406 407 1037399-103739d 403->407 408 103738c-1037394 call 104eef2 406->408 409 10373b7-10373ba 407->409 410 103739f-10373a2 407->410 423 1037647-103764a 408->423 411 10373fa-1037416 call 10367ec 409->411 412 10373bc-10373d0 #246 409->412 410->412 414 10373a4-10373a8 410->414 427 1037428-1037432 411->427 428 1037418-1037423 call 104eec8 411->428 415 10373d2-10373d9 call 104eedc 412->415 416 10373de-10373ec call 10550c7 412->416 414->411 419 10373aa-10373b5 414->419 415->416 416->411 431 10373ee-10373f5 call 104eedc 416->431 419->408 424 1037655-103765e 423->424 425 103764c-103764f SysFreeString 423->425 429 1037660-1037663 LocalFree 424->429 430 1037665-1037668 424->430 425->424 433 1037434-1037437 427->433 434 1037439-103744f CertEnumCertificatesInStore 427->434 428->423 429->430 438 103766a-103766d LocalFree 430->438 439 103766f-1037672 430->439 431->411 433->434 435 1037453-1037457 433->435 436 1037472-1037478 434->436 437 1037451 434->437 442 1037462-103746a 435->442 443 1037459-103745c 435->443 444 103747a-103747d 436->444 445 1037489-103748d 436->445 437->435 438->439 446 1037674-1037677 LocalFree 439->446 447 1037679-103767d 439->447 449 10375d1-10375db CertEnumCRLsInStore 442->449 443->442 448 10375e3-10375ed 443->448 450 1037483-1037487 444->450 451 1037504-1037512 CertEnumCertificatesInStore 444->451 452 10374b2-10374f9 call 104e4f5 call 1056431 * 2 call 10372d1 CertDuplicateCertificateContext CertDeleteCertificateFromStore 445->452 453 103748f-10374a2 call 10553fb 445->453 446->447 454 1037688-103768b 447->454 455 103767f-1037682 CertFreeCTLContext 447->455 458 1037645 448->458 459 10375ef-103761b call 1036f1b 448->459 456 10375e1 449->456 457 103753e-1037541 449->457 450->445 450->451 460 1037518 451->460 461 103746f 451->461 499 10374fb-10374fe 452->499 500 103752f-103753c call 1066c28 452->500 470 10374a7-10374ab 453->470 463 1037696-1037699 454->463 464 103768d-1037690 CertFreeCTLContext 454->464 455->454 456->448 467 1037553-1037557 457->467 468 1037543-1037547 457->468 458->423 459->458 484 103761d-103761e 459->484 460->437 461->436 471 10376a6-10376ab 463->471 472 103769b-10376a0 CertCloseStore 463->472 464->463 476 1037559-1037574 call 1055648 467->476 477 103757f-10375c6 call 104e4f5 call 1056431 * 2 call 10372d1 CertDuplicateCRLContext CertDeleteCertificateFromStore 467->477 474 10375cd-10375d0 468->474 475 103754d-1037551 468->475 479 103751d-103751e 470->479 480 10374ad-10374b0 470->480 472->471 474->449 475->467 475->474 491 103757a-103757d 476->491 492 1037628-103762e 476->492 506 1037633-1037640 call 1066c28 477->506 507 10375c8-10375cb 477->507 485 1037523-103752a call 104eec8 479->485 480->451 480->452 484->492 485->423 491->474 491->477 492->485 499->437 499->451 500->485 506->485 507->456 507->474
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • wcscmp.MSVCRT ref: 01037354
                                                                                                                                                                                                      • #246.CERTCLI(00000001,?,?,?), ref: 010373C9
                                                                                                                                                                                                      • CertEnumCertificatesInStore.CRYPT32(?,00000000), ref: 01037446
                                                                                                                                                                                                      • CertDuplicateCertificateContext.CRYPT32(00000000), ref: 010374EA
                                                                                                                                                                                                      • CertDeleteCertificateFromStore.CRYPT32(00000000), ref: 010374F1
                                                                                                                                                                                                      • CertEnumCertificatesInStore.CRYPT32(?,00000000), ref: 0103750B
                                                                                                                                                                                                        • Part of subcall function 01066C28: GetLastError.KERNEL32(0104F3D4), ref: 01066C28
                                                                                                                                                                                                      • CertDuplicateCRLContext.CRYPT32(010031E0), ref: 010375B7
                                                                                                                                                                                                      • CertDeleteCertificateFromStore.CRYPT32(00000000,?,?,000000FF), ref: 010375BE
                                                                                                                                                                                                      • CertEnumCRLsInStore.CRYPT32(?,00000000), ref: 010375D4
                                                                                                                                                                                                      • SysFreeString.OLEAUT32(?), ref: 0103764F
                                                                                                                                                                                                      • LocalFree.KERNEL32(?,0B9A0139,00000000), ref: 01037663
                                                                                                                                                                                                      • LocalFree.KERNEL32(?,0B9A0139,00000000), ref: 0103766D
                                                                                                                                                                                                      • LocalFree.KERNEL32(00000000,0B9A0139,00000000), ref: 01037677
                                                                                                                                                                                                      • CertFreeCTLContext.CRYPT32(?,00000000), ref: 01037682
                                                                                                                                                                                                      • CertFreeCTLContext.CRYPT32(010031E0,00000000), ref: 01037690
                                                                                                                                                                                                      • CertCloseStore.CRYPT32(?,00000002), ref: 010376A0
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 0000000A.00000002.2668757884.0000000001001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 01000000, based on PE: true
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668728494.0000000001000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668837967.000000000106F000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668875659.0000000001072000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668905907.0000000001076000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_1000000_certutil.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Cert$FreeStore$Context$CertificateEnumLocal$CertificatesDeleteDuplicateFrom$#246CloseErrorLastStringwcscmp
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 401606670-0
                                                                                                                                                                                                      • Opcode ID: b3fff229e5166f4e6cc762972fe177fa1337e6e3b7f45cacddaff0f9df6b87a3
                                                                                                                                                                                                      • Instruction ID: 5663189f973bf8a3f8e28287ecfd29d6335a9d8fcf8c3029201b98cacb3bd0ba
                                                                                                                                                                                                      • Opcode Fuzzy Hash: b3fff229e5166f4e6cc762972fe177fa1337e6e3b7f45cacddaff0f9df6b87a3
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 60B151B1D0021AEFDF629FD8CC859EEBBBDFB48310F1441A9E691B2190D7759A40DB60
                                                                                                                                                                                                      Function 0105EEE0 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 125fileCOMMON
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                      control_flow_graph 510 105eee0-105ef14 call 1047be0 513 105ef47-105ef52 510->513 514 105ef16-105ef2b InitializeCriticalSection 510->514 515 105ef54-105ef5f EnterCriticalSection 513->515 516 105ef69-105ef6f 513->516 514->513 515->516 517 105ef71-105ef72 516->517 518 105ef7c-105ef90 GetWindowsDirectoryA 516->518 517->518 519 105ef96-105ef9e 518->519 520 105f08a-105f091 518->520 521 105efb6-105efb8 519->521 522 105efa0-105efa6 519->522 523 105f093-105f098 LeaveCriticalSection 520->523 524 105f09e-105f0a5 520->524 526 105efba-105efbf 521->526 525 105efa7-105efad 522->525 523->524 527 105f0a7-105f0b6 call 105ed70 524->527 528 105f0cf-105f0dc call 10478b9 call 1047c1b 524->528 525->525 529 105efaf-105efb4 525->529 526->526 530 105efc1-105efc9 526->530 535 105f0bb-105f0c5 #242 527->535 529->521 534 105efca-105efd0 530->534 534->534 537 105efd2-105efe0 534->537 535->528 539 105efe2-105efef 537->539 540 105eff6-105f00d fopen 539->540 541 105eff1 539->541 542 105f057-105f066 call 104eec8 540->542 543 105f00f-105f015 540->543 541->540 542->520 544 105f017-105f026 fseek 543->544 545 105f080 543->545 547 105f068-105f07d fwrite 544->547 548 105f028-105f03a ftell 544->548 545->520 547->545 548->547 550 105f03c-105f055 fclose 548->550 550->539
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • InitializeCriticalSection.KERNEL32(01075074,010118D0,00000120,0101C86A,+certutil.log,00000000), ref: 0105EF1B
                                                                                                                                                                                                      • EnterCriticalSection.KERNEL32(01075074,010118D0,00000120,0101C86A,+certutil.log,00000000), ref: 0105EF59
                                                                                                                                                                                                      • GetWindowsDirectoryA.KERNEL32(?,00000104,010118D0,00000120,0101C86A,+certutil.log,00000000), ref: 0105EF88
                                                                                                                                                                                                      • fopen.MSVCRT ref: 0105EFFE
                                                                                                                                                                                                      • fseek.MSVCRT ref: 0105F01B
                                                                                                                                                                                                      • ftell.MSVCRT ref: 0105F02E
                                                                                                                                                                                                      • fclose.MSVCRT ref: 0105F042
                                                                                                                                                                                                      • fwrite.MSVCRT ref: 0105F077
                                                                                                                                                                                                      • LeaveCriticalSection.KERNEL32(01075074), ref: 0105F098
                                                                                                                                                                                                      • #242.CERTCLI(0105EDEA,00000192,000001A4,000003B4), ref: 0105F0C0
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      • ========================================================================, xrefs: 0105F072
                                                                                                                                                                                                      • \, xrefs: 0105EF96
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 0000000A.00000002.2668757884.0000000001001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 01000000, based on PE: true
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668728494.0000000001000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668837967.000000000106F000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668875659.0000000001072000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668905907.0000000001076000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_1000000_certutil.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CriticalSection$#242DirectoryEnterInitializeLeaveWindowsfclosefopenfseekftellfwrite
                                                                                                                                                                                                      • String ID: ========================================================================$\
                                                                                                                                                                                                      • API String ID: 2074209864-542432828
                                                                                                                                                                                                      • Opcode ID: 67f46b1285326092ba9d2784846363541e3a672b0c48fa5190c478438f84feb4
                                                                                                                                                                                                      • Instruction ID: daf2556d8f81783154056ad6c939c5c550408b989a0eb008843fbe48ea29db95
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 67f46b1285326092ba9d2784846363541e3a672b0c48fa5190c478438f84feb4
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 0041B270D002159BDB769B68DC08BDABBF1FB08700F1441A9FAC9EB185C7795A90CF94
                                                                                                                                                                                                      Function 0101BF0B Relevance: 17.9, APIs: 6, Strings: 4, Instructions: 423COMMON
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                      control_flow_graph 551 101bf0b-101bf99 call 1047be0 InitializeCriticalSection 555 101c0ec-101c0f0 551->555 556 101bf9f-101bfa5 551->556 557 101c0f6-101c0f8 555->557 558 101bfaa-101bfbc 555->558 559 101c2d5-101c2da call 104eec8 556->559 560 101c102-101c10b 557->560 561 101c0fa-101c0ff 557->561 563 101bfda-101bfea call 1051224 558->563 564 101bfbe-101bfc2 558->564 574 101c460-101c462 559->574 566 101c111-101c138 call 104e4f5 call 1056431 * 2 560->566 567 101c1a4-101c1a9 560->567 561->560 577 101bff8-101c00d lstrcmpW 563->577 578 101bfec-101bff3 call 105641f 563->578 564->563 569 101bfc4-101bfc8 564->569 636 101c340-101c348 call 101b8d3 566->636 571 101c1d7-101c1e4 567->571 572 101c1ab-101c1d2 call 104e4f5 call 1056431 * 2 567->572 569->563 575 101bfca-101bfce 569->575 581 101c1e6-101c1f1 571->581 582 101c1fd-101c203 571->582 572->636 583 101c4a0-101c4a7 574->583 584 101c464-101c467 574->584 575->563 576 101bfd0-101bfd4 575->576 576->557 576->563 589 101c013-101c01c 577->589 590 101c13d-101c152 call 101b8d3 577->590 612 101c0e5-101c0e8 578->612 581->582 595 101c1f3 581->595 586 101c205 582->586 587 101c20f-101c215 582->587 593 101c4a9 CoUninitialize 583->593 594 101c4af-101c4b6 583->594 584->583 585 101c469-101c476 call 101b5c5 584->585 619 101c491-101c498 585->619 620 101c478-101c490 call 104e4f5 call 1056431 * 2 585->620 586->587 599 101c221-101c228 587->599 600 101c217 587->600 602 101c033-101c037 589->602 603 101c01e-101c023 589->603 590->574 593->594 596 101c4c3-101c4d2 call 10478b9 call 1047c1b 594->596 597 101c4b8-101c4bd DeleteCriticalSection 594->597 595->582 597->596 610 101c258-101c26e call 104fd2f 599->610 611 101c22a-101c239 call 104efde 599->611 600->599 616 101c043-101c047 602->616 617 101c039-101c03d 602->617 603->602 613 101c025-101c02a 603->613 646 101c270-101c276 610->646 647 101c278-101c27c 610->647 642 101c246-101c24c 611->642 643 101c23b-101c241 611->643 612->555 613->602 622 101c02c-101c031 613->622 626 101c064 616->626 627 101c049-101c04f 616->627 617->557 617->616 619->583 633 101c49a-101c49b call 104ef08 619->633 620->619 622->602 622->626 631 101c069-101c06f 626->631 627->626 628 101c051-101c05e call 1051224 627->628 628->557 628->626 640 101c075-101c086 call 1051224 631->640 641 101c157-101c164 631->641 633->583 636->574 665 101c088-101c08b 640->665 666 101c08d-101c090 640->666 641->636 642->610 653 101c24e 642->653 643->559 646->559 648 101c2a5-101c2af 647->648 649 101c27e-101c28c CoInitialize 647->649 657 101c2b1-101c2b3 648->657 658 101c2df-101c2e1 648->658 655 101c29b 649->655 656 101c28e-101c291 649->656 653->610 655->648 656->655 661 101c293-101c299 656->661 662 101c2c1-101c2cd call 101be7a 657->662 663 101c2b5-101c2bf 657->663 667 101c2f0-101c2f7 658->667 668 101c2e3-101c2ea 658->668 661->559 662->667 686 101c2cf-101c2d0 662->686 663->636 665->631 674 101c092-101c09a 666->674 675 101c09d-101c0a2 666->675 670 101c303-101c30a 667->670 671 101c2f9-101c301 667->671 668->667 669 101c2ec-101c2ee 668->669 676 101c339-101c33b 669->676 678 101c316-101c327 670->678 679 101c30c-101c314 670->679 671->670 677 101c337-101c338 671->677 674->675 681 101c0a4-101c0a8 675->681 682 101c0cd-101c0d0 675->682 676->636 677->676 684 101c333-101c335 678->684 685 101c329-101c32c 678->685 679->677 679->678 687 101c169-101c172 681->687 688 101c0ae-101c0b0 681->688 682->612 683 101c0d2-101c0d4 682->683 689 101c185-101c19f 683->689 690 101c0da-101c0e2 683->690 684->677 692 101c34d-101c355 684->692 685->684 691 101c32e 685->691 686->559 687->636 693 101c177-101c180 688->693 694 101c0b6-101c0ca 688->694 689->636 690->612 691->684 695 101c357-101c360 692->695 696 101c389 692->696 693->636 694->682 697 101c362-101c36e 695->697 698 101c38f-101c3d6 call 1037328 695->698 696->698 697->698 699 101c370-101c37c 697->699 703 101c3d8-101c408 #206 call 104e4f5 call 1056431 * 2 698->703 704 101c40a-101c411 698->704 699->698 700 101c37e-101c387 699->700 700->698 703->574 704->574 705 101c413-101c430 call 104e4f5 call 1056431 * 2 704->705 717 101c435-101c43c 705->717 717->574 718 101c43e-101c45d call 104e4f5 call 1056431 * 2 717->718 718->574
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • InitializeCriticalSection.KERNEL32(01073EE4,01003680,00000088,0101C7BB,?,01003468,?,0000012D,00000C34,00000000,000001D1,?,00000000,00000000), ref: 0101BF5B
                                                                                                                                                                                                      • CoUninitialize.OLE32(?,stdio), ref: 0101C4A9
                                                                                                                                                                                                      • DeleteCriticalSection.KERNEL32(01073EE4,?,stdio), ref: 0101C4BD
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 0000000A.00000002.2668757884.0000000001001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 01000000, based on PE: true
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668728494.0000000001000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668837967.000000000106F000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668875659.0000000001072000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668905907.0000000001076000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_1000000_certutil.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CriticalSection$DeleteInitializeUninitialize
                                                                                                                                                                                                      • String ID: $CertSvc$stdio$uSAGE
                                                                                                                                                                                                      • API String ID: 2805211018-1727814767
                                                                                                                                                                                                      • Opcode ID: 034afa2286876e86a469d391c89d9b30965acbcac833818f4245dcf0ddbc93ef
                                                                                                                                                                                                      • Instruction ID: d68a0255ecea7340ba134a5999a58f562b0ea441204efb19dfb6c7be40fb9508
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 034afa2286876e86a469d391c89d9b30965acbcac833818f4245dcf0ddbc93ef
                                                                                                                                                                                                      • Instruction Fuzzy Hash: D2E1E870980216ABFB719FA9C984BAE7BF4FB15740F40815DEAC5A7249CB79C840CF50
                                                                                                                                                                                                      Function 01047957 Relevance: 15.1, APIs: 10, Instructions: 129COMMON
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                      control_flow_graph 726 1047957-1047976 call 1047be0 GetStartupInfoW 729 104799f-10479a3 726->729 730 1047978-1047989 726->730 732 10479cc-1047a1e __set_app_type __p__fmode __p__commode call 1047c68 729->732 730->729 731 104798b-1047995 730->731 733 1047997-104799d 731->733 734 10479b8-10479bc 731->734 741 1047a20-1047a2b __setusermatherr 732->741 742 1047a2c-1047a82 call 1047c56 _initterm __wgetmainargs _initterm 732->742 733->729 736 10479a5-10479ac 733->736 734->729 737 10479be-10479c0 734->737 736->729 739 10479ae-10479b6 736->739 740 10479c6-10479c9 737->740 739->740 740->732 741->742 745 1047a84-1047a8c 742->745 746 1047a91-1047a98 742->746 747 1047b40-1047b45 call 1047c1b 745->747 748 1047ad2-1047ad6 746->748 749 1047a9a-1047aa5 746->749 753 1047ab8-1047abe 748->753 754 1047ad8-1047add 748->754 750 1047aa7-1047aab 749->750 751 1047aad-1047ab1 749->751 750->749 750->751 751->753 755 1047ab3-1047ab5 751->755 757 1047ac6-1047aca 753->757 758 1047ac0-1047ac4 753->758 754->748 755->753 759 1047acc-1047ad0 757->759 760 1047adf-1047ae1 757->760 758->755 758->757 761 1047ae2-1047af9 call 101c824 759->761 760->761 764 1047b02-1047b3e _cexit 761->764 765 1047afb-1047afc exit 761->765 764->747 765->764
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 0000000A.00000002.2668757884.0000000001001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 01000000, based on PE: true
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668728494.0000000001000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668837967.000000000106F000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668875659.0000000001072000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668905907.0000000001076000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_1000000_certutil.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: _initterm$InfoStartup__p__commode__p__fmode__set_app_type__setusermatherr__wgetmainargs_cexitexit
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 3748450100-0
                                                                                                                                                                                                      • Opcode ID: 21f4a9d5e64cb211d9c14c7f1f9938ab49ffb6d9f2e22f197c4a44a75247b1ba
                                                                                                                                                                                                      • Instruction ID: 3ac8017e8d1e9baf2120a7f44b9a209d5e124f377e1624b07aa5d9005033b007
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 21f4a9d5e64cb211d9c14c7f1f9938ab49ffb6d9f2e22f197c4a44a75247b1ba
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 08516DF0D00219DFEB669F98E884BED77F4FB04710F1040BAE185A7295D7799A80CBA1
                                                                                                                                                                                                      Function 0104EA1A Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 30libraryloaderthreadCOMMON
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                      control_flow_graph 767 104ea1a-104ea28 GetStdHandle 768 104ea70-104ea74 767->768 769 104ea2a-104ea39 GetFileType 767->769 769->768 770 104ea3b-104ea42 769->770 771 104ea44-104ea51 GetModuleHandleW 770->771 772 104ea68-104ea6e SetThreadUILanguage 770->772 771->768 773 104ea53-104ea66 GetProcAddress 771->773 772->768 773->768 773->772
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetStdHandle.KERNEL32(000000F5,00000000,0101C857,00000000), ref: 0104EA1F
                                                                                                                                                                                                      • GetFileType.KERNEL32(00000000), ref: 0104EA2B
                                                                                                                                                                                                      • GetModuleHandleW.KERNEL32(kernel32.dll), ref: 0104EA49
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,SetThreadUILanguage), ref: 0104EA59
                                                                                                                                                                                                      • SetThreadUILanguage.KERNEL32(?), ref: 0104EA6C
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 0000000A.00000002.2668757884.0000000001001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 01000000, based on PE: true
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668728494.0000000001000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668837967.000000000106F000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668875659.0000000001072000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668905907.0000000001076000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_1000000_certutil.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Handle$AddressFileLanguageModuleProcThreadType
                                                                                                                                                                                                      • String ID: SetThreadUILanguage$kernel32.dll
                                                                                                                                                                                                      • API String ID: 3882882926-927383962
                                                                                                                                                                                                      • Opcode ID: e1d6ebda63d971ae5f1ad8d8849764b31dece5bd0226b143933af60105e68e00
                                                                                                                                                                                                      • Instruction ID: 96a6fe111c17007b7d666a41ee8c7ba9bbb0bf8c5c155db55b333d1325431b9d
                                                                                                                                                                                                      • Opcode Fuzzy Hash: e1d6ebda63d971ae5f1ad8d8849764b31dece5bd0226b143933af60105e68e00
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 7BF020B2A002014BAAB2DBBCDC8C6573ED87B017617040B34F2E5E60D0CB3CD4618794
                                                                                                                                                                                                      Function 77BB0A39 Relevance: 10.6, APIs: 7, Instructions: 141registrymemoryCOMMON
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                      control_flow_graph 774 77bb0a39-77bb0a5f 775 77bb0a63-77bb0a68 774->775 776 77bb0a61 774->776 777 77bb0a6a 775->777 778 77bb0a6c-77bb0a85 call 77bb07af 775->778 776->775 777->778 781 77bb0a8b-77bb0a8e 778->781 782 77bb0b79-77bb0b82 778->782 785 77bb0aad 781->785 786 77bb0a90-77bb0aa6 RegConnectRegistryW 781->786 783 77bb0b92-77bb0b95 782->783 784 77bb0b84-77bb0b8b 782->784 788 77bb0ba0-77bb0ba3 783->788 789 77bb0b97-77bb0b9a LocalFree 783->789 784->783 787 77bb0b8d-77bb0b90 RegCloseKey 784->787 791 77bb0ab4-77bb0ace RegOpenKeyExW 785->791 790 77bb0aa8 786->790 786->791 787->783 792 77bb0baa-77bb0bb4 call 77bb3706 788->792 793 77bb0ba5-77bb0ba8 RegCloseKey 788->793 789->788 790->782 791->782 794 77bb0ad4-77bb0adf 791->794 793->792 795 77bb0b22-77bb0b33 RegQueryValueExW 794->795 795->782 797 77bb0b35 795->797 800 77bb0ae8-77bb0aef 797->800 801 77bb0b37-77bb0b55 797->801 802 77bb0af1-77bb0af5 800->802 803 77bb0af7-77bb0b00 800->803 804 77bb0b5c-77bb0b61 801->804 805 77bb0b57-77bb0b5a 801->805 802->803 806 77bb0b09-77bb0b1b LocalAlloc 802->806 803->806 807 77bb0b02 803->807 808 77bb0b68-77bb0b72 804->808 809 77bb0b63-77bb0b66 804->809 805->804 810 77bb0b1d-77bb0b21 806->810 811 77bb0b74 806->811 807->806 808->782 809->808 810->795 811->782
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 77BB0A9C
                                                                                                                                                                                                      • RegOpenKeyExW.KERNEL32(80000002,00000001,00000000,00020019,?,?,00000001,?,00000001,00000001,00000000,77B9B342,00000001,?,00000001,?), ref: 77BB0AC4
                                                                                                                                                                                                      • LocalAlloc.KERNEL32(00000000,?), ref: 77BB0B10
                                                                                                                                                                                                      • RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 77BB0B2D
                                                                                                                                                                                                      • RegCloseKey.ADVAPI32(80000002,?,00000001,?,00000001,00000001,00000000,77B9B342,00000001,?,00000001,?), ref: 77BB0B90
                                                                                                                                                                                                      • LocalFree.KERNEL32(00000001,?,00000001,?,00000001,00000001,00000000,77B9B342,00000001,?,00000001,?), ref: 77BB0B9A
                                                                                                                                                                                                      • RegCloseKey.ADVAPI32(?,?,00000001,?,00000001,00000001,00000000,77B9B342,00000001,?,00000001,?), ref: 77BB0BA8
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 0000000A.00000002.2669135112.0000000077B91000.00000020.00000001.01000000.0000000D.sdmp, Offset: 77B90000, based on PE: true
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2669106858.0000000077B90000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2669169116.0000000077BB8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2669268771.0000000077BBA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_77b90000_certutil.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CloseLocal$AllocConnectFreeOpenQueryRegistryValue
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 3588026709-0
                                                                                                                                                                                                      • Opcode ID: 9bd545265f49c0b851fe4b1045249b2390624fb514f946d9efac0e3290c7678b
                                                                                                                                                                                                      • Instruction ID: e57b267e52c7b565756147c923a9046c063ea7d59950c7ec918eaab4178b9556
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 9bd545265f49c0b851fe4b1045249b2390624fb514f946d9efac0e3290c7678b
                                                                                                                                                                                                      • Instruction Fuzzy Hash: A3512BB290011AEFDF21DF85C981DBEBBB5FB44344F614569F912A3220D7359D50DBA0
                                                                                                                                                                                                      Function 77BA1307 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 44COMMON
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                      control_flow_graph 812 77ba1307-77ba131b call 77b917d1 815 77ba13ac-77ba13b1 call 77b9190c 812->815 816 77ba1321-77ba1353 InitializeCriticalSection getenv 812->816 818 77ba135d-77ba1369 call 77bb0c5f 816->818 819 77ba1355-77ba135b call 77ba0f76 816->819 823 77ba136e-77ba1370 818->823 827 77ba1375 819->827 825 77ba137a-77ba137d 823->825 826 77ba1372 823->826 825->815 828 77ba137f-77ba1385 825->828 826->827 827->825 828->815 829 77ba1387-77ba1395 getenv call 77ba10dc 828->829 829->815
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • InitializeCriticalSection.KERNEL32(77BB9C70,77BA13E0,0000000C,77BA13FD,00000001), ref: 77BA1329
                                                                                                                                                                                                      • getenv.MSVCRT ref: 77BA134E
                                                                                                                                                                                                      • getenv.MSVCRT ref: 77BA138C
                                                                                                                                                                                                        • Part of subcall function 77BA0F76: isxdigit.MSVCRT ref: 77BA0F88
                                                                                                                                                                                                        • Part of subcall function 77BA0F76: isdigit.MSVCRT ref: 77BA0F9C
                                                                                                                                                                                                        • Part of subcall function 77BA0F76: isxdigit.MSVCRT ref: 77BA0FD2
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 0000000A.00000002.2669135112.0000000077B91000.00000020.00000001.01000000.0000000D.sdmp, Offset: 77B90000, based on PE: true
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2669106858.0000000077B90000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2669169116.0000000077BB8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2669268771.0000000077BBA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_77b90000_certutil.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: getenvisxdigit$CriticalInitializeSectionisdigit
                                                                                                                                                                                                      • String ID: CERTSRV_DEBUG$CERTSRV_LOGFILE$Debug
                                                                                                                                                                                                      • API String ID: 1171175451-2055754498
                                                                                                                                                                                                      • Opcode ID: 5a9bdcc946f7ec08774296bfc9265fc102b90a27a38d8d7b8f9b69369c7d6248
                                                                                                                                                                                                      • Instruction ID: dbd1e2476bc1aecbf58600a58680c13a3f89da2a4949b0b7c0978847fec592da
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 5a9bdcc946f7ec08774296bfc9265fc102b90a27a38d8d7b8f9b69369c7d6248
                                                                                                                                                                                                      • Instruction Fuzzy Hash: D10175F5D0411DFDF761FFA28945E6E3BF4D7C0690B214A2AEC1197590E73944019F21
                                                                                                                                                                                                      Function 77BA146D Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38stringCOMMON
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                      control_flow_graph 832 77ba146d-77ba1479 833 77ba147b 832->833 834 77ba14c7-77ba14c9 832->834 835 77ba147c-77ba148e strcspn 833->835 836 77ba14bb-77ba14be 835->836 837 77ba1490-77ba1496 835->837 840 77ba14c0 836->840 841 77ba14c1-77ba14c4 836->841 838 77ba14a8-77ba14b0 fprintf 837->838 839 77ba1498-77ba14a6 fwprintf 837->839 842 77ba14b6-77ba14b9 838->842 839->842 840->841 841->835 843 77ba14c6 841->843 842->836 843->834
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 0000000A.00000002.2669135112.0000000077B91000.00000020.00000001.01000000.0000000D.sdmp, Offset: 77B90000, based on PE: true
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2669106858.0000000077B90000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2669169116.0000000077BB8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2669268771.0000000077BBA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_77b90000_certutil.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: fprintffwprintfstrcspn
                                                                                                                                                                                                      • String ID: %.*hs$%.*hs
                                                                                                                                                                                                      • API String ID: 1965169809-2156586457
                                                                                                                                                                                                      • Opcode ID: c3ece54c214ae4c5f983d9d63de0609a65bb00af986f1d8a52700815478ea8d3
                                                                                                                                                                                                      • Instruction ID: 818c8919fee1fb3c334af66112a4b6c007c5c0d41da83c6096f293ab248b284e
                                                                                                                                                                                                      • Opcode Fuzzy Hash: c3ece54c214ae4c5f983d9d63de0609a65bb00af986f1d8a52700815478ea8d3
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 5BF0C27640C15EEBF7623A0DCD04B863FB9DFC1261F268D19F899A2141BF3544808F50
                                                                                                                                                                                                      Function 0105ECDB Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 55COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • #211.CERTCLI(..CertCli Version,?,?,00000000,?,?,?,0101C884,0000012D,00000C94,00000000,certutil.exe,5.2.3790.0 retail (srv03_rtm.030324-2048),+certutil.log), ref: 0105ECF0
                                                                                                                                                                                                      • LocalFree.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,00000000,00000C94,000000FF,?,?,00000000,?,certcli.dll,?,00000000), ref: 0105ED66
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 0000000A.00000002.2668757884.0000000001001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 01000000, based on PE: true
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668728494.0000000001000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668837967.000000000106F000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668875659.0000000001072000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668905907.0000000001076000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_1000000_certutil.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: #211FreeLocal
                                                                                                                                                                                                      • String ID: ..CertCli Version$certcli.dll
                                                                                                                                                                                                      • API String ID: 3648583106-230967742
                                                                                                                                                                                                      • Opcode ID: 99b20e43c711084861d4e6fa065bbe76a616f5168bc680a9b1eacbc7067c9794
                                                                                                                                                                                                      • Instruction ID: 1ba5aa630455951a9001cef4c9738e5a13521d2ff371456a41960c9dd3ddebb9
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 99b20e43c711084861d4e6fa065bbe76a616f5168bc680a9b1eacbc7067c9794
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 0B01AD3640011EBBDF22AF95CC05FDF7E7AAF55724F108164FA8465060D7769B20A7A4
                                                                                                                                                                                                      Function 0104EE51 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • #205.CERTCLI(00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0104EED9), ref: 0104EE61
                                                                                                                                                                                                        • Part of subcall function 0104EE28: #215.CERTCLI(00000000,8007000E,0104EE75,00000000,00000000,00000001), ref: 0104EE30
                                                                                                                                                                                                      • #206.CERTCLI(?,00000000,01006A58,00000000,00000000,00000000,00000001), ref: 0104EE99
                                                                                                                                                                                                      • #203.CERTCLI(000000FF,%u.%u.%u: %ws%ws%ws,00000000,00000000,00000000,00000000,?,00000000,01006A58,00000000,00000000,00000000,00000001), ref: 0104EEB4
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 0000000A.00000002.2668757884.0000000001001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 01000000, based on PE: true
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668728494.0000000001000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668837967.000000000106F000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668875659.0000000001072000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668905907.0000000001076000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_1000000_certutil.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: #203#205#206#215
                                                                                                                                                                                                      • String ID: %u.%u.%u: %ws%ws%ws
                                                                                                                                                                                                      • API String ID: 3547120709-3099205882
                                                                                                                                                                                                      • Opcode ID: afdd2ceea22e530a172dbd104921af13607cc589c79218caeef59f78e4e710d5
                                                                                                                                                                                                      • Instruction ID: c338e442875d6cf5778fe149848d67605149871a62a2da8e810eeaf4e185d91c
                                                                                                                                                                                                      • Opcode Fuzzy Hash: afdd2ceea22e530a172dbd104921af13607cc589c79218caeef59f78e4e710d5
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 7B0186B590010ABBEF10EF96CD81AAF37EDBB14300F004425BD91D71C1D676D951D760
                                                                                                                                                                                                      Function 01067BCA Relevance: 6.1, APIs: 4, Instructions: 71memoryCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetComputerNameExW.KERNEL32(00000003,00000000,00000000,00000000,00000000,00000001), ref: 01067C0E
                                                                                                                                                                                                      • LocalAlloc.KERNEL32(00000000,00000000), ref: 01067C1E
                                                                                                                                                                                                      • GetComputerNameExW.KERNEL32(00000010,00000000,00000000), ref: 01067C44
                                                                                                                                                                                                        • Part of subcall function 01066C28: GetLastError.KERNEL32(0104F3D4), ref: 01066C28
                                                                                                                                                                                                      • LocalFree.KERNEL32(00000000), ref: 01067C63
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 0000000A.00000002.2668757884.0000000001001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 01000000, based on PE: true
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668728494.0000000001000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668837967.000000000106F000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668875659.0000000001072000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668905907.0000000001076000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_1000000_certutil.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: ComputerLocalName$AllocErrorFreeLast
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 2895495810-0
                                                                                                                                                                                                      • Opcode ID: 6349a12e450aaaf6c9830246f735fa655bcd7dd20d3e13853907ebec8290f0c4
                                                                                                                                                                                                      • Instruction ID: 501790f532db1ce13a2cc919b0739ef0ecc937ad83bfaf15f3fadf7e0fd9f0cc
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 6349a12e450aaaf6c9830246f735fa655bcd7dd20d3e13853907ebec8290f0c4
                                                                                                                                                                                                      • Instruction Fuzzy Hash: B5212475D0020DFFDB11DFA9D9C09EEBBFCEB44264F2084AEE941D7205D6769A448B60
                                                                                                                                                                                                      Function 0105EE58 Relevance: 6.0, APIs: 4, Instructions: 43COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • EnterCriticalSection.KERNEL32(01075074,7622F530,00000000,00000000,0101C98B,certutil.exe), ref: 0105EE93
                                                                                                                                                                                                      • fclose.MSVCRT ref: 0105EEA6
                                                                                                                                                                                                      • LeaveCriticalSection.KERNEL32(01075074,7622F530,00000000,00000000,0101C98B,certutil.exe), ref: 0105EECB
                                                                                                                                                                                                      • DeleteCriticalSection.KERNEL32(01075074), ref: 0105EED6
                                                                                                                                                                                                        • Part of subcall function 0105ED70: GetSystemTime.KERNEL32(?,00000000), ref: 0105ED80
                                                                                                                                                                                                        • Part of subcall function 0105ED70: SystemTimeToFileTime.KERNEL32(?,?), ref: 0105ED8E
                                                                                                                                                                                                        • Part of subcall function 0105ED70: LocalFree.KERNEL32(?,?,00000000,?,?,00000000,00000000,?,00000001,?), ref: 0105EDE0
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 0000000A.00000002.2668757884.0000000001001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 01000000, based on PE: true
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668728494.0000000001000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668837967.000000000106F000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668875659.0000000001072000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668905907.0000000001076000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_1000000_certutil.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CriticalSectionTime$System$DeleteEnterFileFreeLeaveLocalfclose
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 1878943280-0
                                                                                                                                                                                                      • Opcode ID: ba56a27c74da561cc2641faa8fa005ea6d28618af04d1b238f663f48baddae62
                                                                                                                                                                                                      • Instruction ID: 112e0bc7f46e01d0500457ddbced3a872e54cbd3b3112077fa3c70e49dde6842
                                                                                                                                                                                                      • Opcode Fuzzy Hash: ba56a27c74da561cc2641faa8fa005ea6d28618af04d1b238f663f48baddae62
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 210162719112009FE3725B69ED49BDBBAE8F780311F000169FAC8E6049CB7A55019BE0
                                                                                                                                                                                                      Function 0105EA53 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28stringCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 0000000A.00000002.2668757884.0000000001001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 01000000, based on PE: true
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668728494.0000000001000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668837967.000000000106F000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668875659.0000000001072000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668905907.0000000001076000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_1000000_certutil.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: fprintfstrcspn
                                                                                                                                                                                                      • String ID: %.*hs
                                                                                                                                                                                                      • API String ID: 3161322671-3726413179
                                                                                                                                                                                                      • Opcode ID: 23a014061992f4b47521526ff7b99023b5fe8b5066c40d4e9562dcdf03c0ca95
                                                                                                                                                                                                      • Instruction ID: d5dc67a02dc8a1cb722904c4d963c1f82d138cc1244f98765652eb5f37286505
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 23a014061992f4b47521526ff7b99023b5fe8b5066c40d4e9562dcdf03c0ca95
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 7FE0E5368082522AE3B20639E804B53BFD4FBC1320F1444ADE9C851046D63555818350
                                                                                                                                                                                                      Function 0104FD2F Relevance: 4.6, APIs: 3, Instructions: 55memoryCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • LocalAlloc.KERNEL32(00000000,00000020,?,00000000,00000008,?,01051455,00000000,00000001,?,00000001,00000000,?,?,?,01063FA2), ref: 0104FD4B
                                                                                                                                                                                                      • GetComputerNameW.KERNEL32(00000000,00000010), ref: 0104FD70
                                                                                                                                                                                                      • LocalFree.KERNEL32(00000000,00000001,?,01051455,00000000,00000001,?,00000001,00000000,?,?,?,01063FA2,?,?,?), ref: 0104FDAB
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 0000000A.00000002.2668757884.0000000001001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 01000000, based on PE: true
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668728494.0000000001000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668837967.000000000106F000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668875659.0000000001072000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668905907.0000000001076000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_1000000_certutil.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Local$AllocComputerFreeName
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 2376863419-0
                                                                                                                                                                                                      • Opcode ID: 46d1a3958b2e364e57f875fa54153dcbba02d3449fbe9eb7b54afb2e6a289f67
                                                                                                                                                                                                      • Instruction ID: 7c27446d4c790479af204965c982bd9d8e3186b8286b87681b283e7315f67812
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 46d1a3958b2e364e57f875fa54153dcbba02d3449fbe9eb7b54afb2e6a289f67
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 73019EB260162BAFE7617FAD9CC4EAE77DCEB18750B008131FAD0DA205D6B4C80147A0
                                                                                                                                                                                                      Function 0105ED70 Relevance: 4.5, APIs: 3, Instructions: 46timeCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetSystemTime.KERNEL32(?,00000000), ref: 0105ED80
                                                                                                                                                                                                      • SystemTimeToFileTime.KERNEL32(?,?), ref: 0105ED8E
                                                                                                                                                                                                      • LocalFree.KERNEL32(?,?,00000000,?,?,00000000,00000000,?,00000001,?), ref: 0105EDE0
                                                                                                                                                                                                        • Part of subcall function 01066C28: GetLastError.KERNEL32(0104F3D4), ref: 01066C28
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 0000000A.00000002.2668757884.0000000001001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 01000000, based on PE: true
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668728494.0000000001000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668837967.000000000106F000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668875659.0000000001072000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668905907.0000000001076000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_1000000_certutil.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Time$System$ErrorFileFreeLastLocal
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 2367055805-0
                                                                                                                                                                                                      • Opcode ID: 76f4264055183314f796e7c3cd37e4b0c691bf066cdb384735fe83e45a1e64f8
                                                                                                                                                                                                      • Instruction ID: caaf13477b9cbd2a528486b8e912b3c654d28bd88397cc1482c91ce2eee51665
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 76f4264055183314f796e7c3cd37e4b0c691bf066cdb384735fe83e45a1e64f8
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 9D015676C0111EFBDB61ABA4DC08DEFBBBCEF04740B008066FA90E1008D63587109BA1
                                                                                                                                                                                                      Function 0105EDEA Relevance: 4.5, APIs: 3, Instructions: 24COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • EnterCriticalSection.KERNEL32(01075074), ref: 0105EE04
                                                                                                                                                                                                      • fflush.MSVCRT ref: 0105EE20
                                                                                                                                                                                                      • LeaveCriticalSection.KERNEL32(01075074), ref: 0105EE2C
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 0000000A.00000002.2668757884.0000000001001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 01000000, based on PE: true
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668728494.0000000001000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668837967.000000000106F000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668875659.0000000001072000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668905907.0000000001076000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_1000000_certutil.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CriticalSection$EnterLeavefflush
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 3028544373-0
                                                                                                                                                                                                      • Opcode ID: 4fe096c11ae35da48b75ccdcbf2dc555516a0128e765383ef7c393e003efb0e2
                                                                                                                                                                                                      • Instruction ID: f9dd7aa53c9a4497313bf8307602a7c1cd33316d3ad1cc2fe7aa05413a71177d
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 4fe096c11ae35da48b75ccdcbf2dc555516a0128e765383ef7c393e003efb0e2
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 08E01231D01121DB87735B55FC0889BFFB5FB94B11700842AF6C4E6018873A5512EBE4
                                                                                                                                                                                                      Function 010551DB Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 100COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • LocalFree.KERNEL32(?,00000001,00000014,?,?,00000002,?,?,?,00000000,?,00000000,00000000,00000000), ref: 010552A5
                                                                                                                                                                                                        • Part of subcall function 01066C28: GetLastError.KERNEL32(0104F3D4), ref: 01066C28
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 0000000A.00000002.2668757884.0000000001001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 01000000, based on PE: true
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668728494.0000000001000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668837967.000000000106F000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668875659.0000000001072000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668905907.0000000001076000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_1000000_certutil.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: ErrorFreeLastLocal
                                                                                                                                                                                                      • String ID: 2.5.4.3
                                                                                                                                                                                                      • API String ID: 3928016487-565167566
                                                                                                                                                                                                      • Opcode ID: e5e9bf69d965c90322ec43a982a21e01f7de9746226eacb96eca4afc01260588
                                                                                                                                                                                                      • Instruction ID: e4eb998d46cd3c6b2d8ea8f6f50d4bf1712271ec82391d3c437e227df66dab33
                                                                                                                                                                                                      • Opcode Fuzzy Hash: e5e9bf69d965c90322ec43a982a21e01f7de9746226eacb96eca4afc01260588
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 37317C31900209EFDBA1DF99C8809AFBBF5FF86390F108196FD85AB251D3709A41DB90
                                                                                                                                                                                                      Function 0101C7D7 Relevance: 3.0, APIs: 2, Instructions: 31windowCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • DefWindowProcW.USER32(?,?,?,?), ref: 0101C7FE
                                                                                                                                                                                                      • PostQuitMessage.USER32(00000000), ref: 0101C817
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 0000000A.00000002.2668757884.0000000001001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 01000000, based on PE: true
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668728494.0000000001000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668837967.000000000106F000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668875659.0000000001072000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668905907.0000000001076000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_1000000_certutil.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: MessagePostProcQuitWindow
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 3873111417-0
                                                                                                                                                                                                      • Opcode ID: d23c1a5fe193f3650e0e9b03c82dab00e39cc7acdd0c84ab31ac79601f2b9c5c
                                                                                                                                                                                                      • Instruction ID: 6eb04a37572a5683a7f6ead23899737d8a161687b201d56f604d04b6a87f1001
                                                                                                                                                                                                      • Opcode Fuzzy Hash: d23c1a5fe193f3650e0e9b03c82dab00e39cc7acdd0c84ab31ac79601f2b9c5c
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 54F0373608401EBFEF136F98DE449AA7F95EB047A1F088061BE8591129CA39C9219BA1
                                                                                                                                                                                                      Function 77BA21DB Relevance: 1.5, APIs: 1, Instructions: 26windowCOMMONLIBRARYCODE
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • FormatMessageW.KERNEL32(8000EEFF,8000FFFF,00000000,00000400,77BA228A,00000001,?,?,77BA228A,00000000,8000FFFF,?,00000001), ref: 77BA221B
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 0000000A.00000002.2669135112.0000000077B91000.00000020.00000001.01000000.0000000D.sdmp, Offset: 77B90000, based on PE: true
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2669106858.0000000077B90000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2669169116.0000000077BB8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2669268771.0000000077BBA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_77b90000_certutil.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: FormatMessage
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 1306739567-0
                                                                                                                                                                                                      • Opcode ID: f656b58b95f95cef3b3be4f816dc6592b080ee001618b2e02f92a3b4965d9e2b
                                                                                                                                                                                                      • Instruction ID: 28d662b4c15460cfadada2b1c347bee405e81766ffc2c3f159a9ba59067f198b
                                                                                                                                                                                                      • Opcode Fuzzy Hash: f656b58b95f95cef3b3be4f816dc6592b080ee001618b2e02f92a3b4965d9e2b
                                                                                                                                                                                                      • Instruction Fuzzy Hash: ECE0D87216830DFBFF098F64CD0AFD53B65EB84700F118414BA26A61D0D3B9D850D604
                                                                                                                                                                                                      Function 77BA2483 Relevance: 1.5, APIs: 1, Instructions: 9COMMONLIBRARYCODE
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • #248.CERTCLI(00000010,00000000,00000000,?,77BAF905,00000000,00000001,00000000,00000010,00000000), ref: 77BA2490
                                                                                                                                                                                                        • Part of subcall function 77BA222A: wcslen.MSVCRT ref: 77BA2272
                                                                                                                                                                                                        • Part of subcall function 77BA222A: LoadLibraryW.KERNEL32(ntdsbmsg.dll,00000000,8000FFFF,?,00000001), ref: 77BA22EA
                                                                                                                                                                                                        • Part of subcall function 77BA222A: #217.CERTCLI(8000FFFF,00000000,8000FFFF,?,00000001), ref: 77BA232A
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 0000000A.00000002.2669135112.0000000077B91000.00000020.00000001.01000000.0000000D.sdmp, Offset: 77B90000, based on PE: true
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2669106858.0000000077B90000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2669169116.0000000077BB8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2669268771.0000000077BBA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_77b90000_certutil.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: #217#248LibraryLoadwcslen
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 4191674252-0
                                                                                                                                                                                                      • Opcode ID: 71048dd2bf01686d528c300a985fb1558b6612efa631bb2715a04b506869d9d3
                                                                                                                                                                                                      • Instruction ID: 912546085ad674e5837e3d6b83448ce6426a3c2e586ef2c74bcc7ef5c8a2c7f0
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 71048dd2bf01686d528c300a985fb1558b6612efa631bb2715a04b506869d9d3
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 41B0923204420CB7DB122A82EC01F8A7F1AEBD4760F118011FA1C19460AA73AA61A795
                                                                                                                                                                                                      Function 77BB0C5F Relevance: 1.3, APIs: 1, Instructions: 40COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • LocalFree.KERNEL32(00000000,00000000,?,?,00000000,77B9F624,00000000,00000000,?,00000001,?,?,?,77BB0E7C,?,00000000), ref: 77BB0CAF
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 0000000A.00000002.2669135112.0000000077B91000.00000020.00000001.01000000.0000000D.sdmp, Offset: 77B90000, based on PE: true
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2669106858.0000000077B90000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2669169116.0000000077BB8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2669268771.0000000077BBA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_77b90000_certutil.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: FreeLocal
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 2826327444-0
                                                                                                                                                                                                      • Opcode ID: be0825e4b2ac17b7a9f444cd66b1786f6c045373278c6ca9c0c0ae35370ec2da
                                                                                                                                                                                                      • Instruction ID: a2551c2f759cd5c89a1b169e1639b41125409e7d88dde3b3397129bb786fab85
                                                                                                                                                                                                      • Opcode Fuzzy Hash: be0825e4b2ac17b7a9f444cd66b1786f6c045373278c6ca9c0c0ae35370ec2da
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 05F08C7221030AEFEB11CF94C985FFA37ACEB48350F104029FA4296160E7B9D910EBA1
                                                                                                                                                                                                      Function 77B992A1 Relevance: 1.3, APIs: 1, Instructions: 36stringCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • lstrcmpiW.KERNEL32(77BB81F0,?), ref: 77B992DB
                                                                                                                                                                                                        • Part of subcall function 77B99162: LoadStringW.USER32(00000065,?,00000200,?), ref: 77B991A1
                                                                                                                                                                                                        • Part of subcall function 77B99162: wcslen.MSVCRT ref: 77B991B6
                                                                                                                                                                                                        • Part of subcall function 77B99162: LocalAlloc.KERNEL32(00000000,?), ref: 77B991C4
                                                                                                                                                                                                        • Part of subcall function 77B99162: wcscpy.MSVCRT ref: 77B991DC
                                                                                                                                                                                                        • Part of subcall function 77B99162: LoadStringW.USER32(000000BC,?,00000200,?), ref: 77B9920E
                                                                                                                                                                                                        • Part of subcall function 77B99162: wcslen.MSVCRT ref: 77B9921F
                                                                                                                                                                                                        • Part of subcall function 77B99162: LocalAlloc.KERNEL32(00000000,?), ref: 77B9922D
                                                                                                                                                                                                        • Part of subcall function 77B99162: wcscpy.MSVCRT ref: 77B99241
                                                                                                                                                                                                        • Part of subcall function 77B99162: LocalFree.KERNEL32(0000303B,?), ref: 77B9926B
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 0000000A.00000002.2669135112.0000000077B91000.00000020.00000001.01000000.0000000D.sdmp, Offset: 77B90000, based on PE: true
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2669106858.0000000077B90000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2669169116.0000000077BB8000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2669268771.0000000077BBA000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_77b90000_certutil.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Local$AllocLoadStringwcscpywcslen$Freelstrcmpi
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 1980471570-0
                                                                                                                                                                                                      • Opcode ID: 767601b5458f7c399b8a49287a14e320a8ebfaa9ceb9b84121a529d392ed2afb
                                                                                                                                                                                                      • Instruction ID: 9cc3eb64873594bded9f317b1e474ca25becfa5818e5a5f0d6d6607bdf9e3a7b
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 767601b5458f7c399b8a49287a14e320a8ebfaa9ceb9b84121a529d392ed2afb
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 93F096B2200206DFF7615F66C884BA2B7ADFBD4265F324039D96587210E7758854CF98

                                                                                                                                                                                                      Non-executed Functions

                                                                                                                                                                                                      Function 0102713D Relevance: 62.0, APIs: 10, Strings: 25, Instructions: 800encryptionCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • LocalFree.KERNEL32(00000000,00000000,00000002,68570874,010288FB,00000000,00000000,?,010033D0,?,?,?,?,?,?,010288FB), ref: 010272FF
                                                                                                                                                                                                      • CryptDecodeObject.CRYPT32(00000001,0000001E,68570874,010288FB,00000000,?,00000000), ref: 01027639
                                                                                                                                                                                                      • LocalFree.KERNEL32(00000000,00000000,00000002,68570874,010288FB,00000000,00000000,?,010033D0,?,?,?,?,?,?,010288FB), ref: 01027923
                                                                                                                                                                                                        • Part of subcall function 01026F70: LocalFree.KERNEL32(010033D0,000001D3,00000000,?,010288FB,?,?,?,010279F6,000001FA,00000000,?,00000001,00000005,68570874,010288FB), ref: 01026FCA
                                                                                                                                                                                                      • LocalFree.KERNEL32(00000000,000002A6,00000001,00000006,68570874,010288FB,00000002,00000000,00000000,00000001,00000005,68570874,010288FB,00000002,00000000,00000000), ref: 01027937
                                                                                                                                                                                                      • LocalFree.KERNEL32(00000002,00000002,000000FF,00000000,00000000,00000000,00000000,?,00000000,00000000,?,010033D0), ref: 010277F0
                                                                                                                                                                                                        • Part of subcall function 01056431: vfwprintf.MSVCRT ref: 010567D1
                                                                                                                                                                                                      • LocalFree.KERNEL32(?,00000000,?,010033D0,?,?,?,?,?,?,010288FB,?), ref: 0102784C
                                                                                                                                                                                                      • CryptDecodeObject.CRYPT32(00000001,0000001B,68570874,010288FB,00000000,?,00000000), ref: 01027891
                                                                                                                                                                                                      • LocalFree.KERNEL32(?,00000000,?,010033D0,?,?,?,?,?,?,010288FB,?,00000002,00000000,00000001,?), ref: 01027A55
                                                                                                                                                                                                      • LocalFree.KERNEL32(00000000,00000000,?,010033D0,?,?,?,?,?,?,010288FB,?,00000002,00000000,00000001,?), ref: 01027A63
                                                                                                                                                                                                      • LocalFree.KERNEL32(00000000,00000000,?,010033D0,?,?,?,?,?,?,010288FB,?,00000002,00000000,00000001,?), ref: 01027A71
                                                                                                                                                                                                        • Part of subcall function 01056431: LocalFree.KERNEL32(00000000), ref: 01056827
                                                                                                                                                                                                        • Part of subcall function 01056431: LocalFree.KERNEL32(?), ref: 0105684A
                                                                                                                                                                                                        • Part of subcall function 01056431: GetModuleHandleW.KERNEL32(ntdll.dll,010105C8,00000830,01022610,%ws,00000000,?,?,?,00000000,00000000,?,00000000,00000000,?), ref: 01056499
                                                                                                                                                                                                        • Part of subcall function 01056431: GetProcAddress.KERNEL32(00000000,_vsnwprintf), ref: 010564A5
                                                                                                                                                                                                        • Part of subcall function 01056431: GetModuleHandleW.KERNEL32(msvcrt.dll,?,00000000,00000000,?), ref: 010564BE
                                                                                                                                                                                                        • Part of subcall function 01056431: GetProcAddress.KERNEL32(00000000,_vsnwprintf), ref: 010564C6
                                                                                                                                                                                                        • Part of subcall function 01056431: GetStdHandle.KERNEL32(000000F5,010105C8,00000830,01022610,%ws,00000000,?,?,?,00000000,00000000,?,00000000,00000000,?), ref: 010564D3
                                                                                                                                                                                                        • Part of subcall function 01056431: LocalFree.KERNEL32(?,?,?,?,?,00000000,00000000,?), ref: 01056551
                                                                                                                                                                                                        • Part of subcall function 01056431: LocalAlloc.KERNEL32(00000000,?,?,?,?,?,00000000,00000000,?), ref: 01056565
                                                                                                                                                                                                        • Part of subcall function 01056431: GetFileType.KERNEL32(?,?,?,?,?,00000000,00000000,?), ref: 010565C2
                                                                                                                                                                                                        • Part of subcall function 01056431: WriteConsoleW.KERNEL32(?,?,00000000,?,00000000), ref: 01056639
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 0000000A.00000002.2668757884.0000000001001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 01000000, based on PE: true
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668728494.0000000001000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668837967.000000000106F000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668875659.0000000001072000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668905907.0000000001076000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_1000000_certutil.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Local$Free$Handle$AddressCryptDecodeModuleObjectProc$AllocConsoleFileTypeWritevfwprintf
                                                                                                                                                                                                      • String ID: $ %ws%ws = %ws$ %ws[%u]: %hs%ws%ws%ws$%ws%ws$%ws%ws %ws$%ws%ws%ws: $%ws%x$1.2.840.113549.1.9.14$1.2.840.113549.1.9.15$1.2.840.113549.1.9.3$1.2.840.113549.1.9.4$1.2.840.113549.1.9.5$1.2.840.113549.1.9.6$1.2.840.113549.1.9.7$1.3.6.1.4.1.311.10.4.1$1.3.6.1.4.1.311.13.1$1.3.6.1.4.1.311.13.2.1$1.3.6.1.4.1.311.13.2.2$1.3.6.1.4.1.311.2.1.14$1.3.6.1.4.1.311.21.13$1.3.6.1.4.1.311.21.16$1.3.6.1.4.1.311.21.17$1.3.6.1.4.1.311.21.20$1.3.6.1.4.1.311.21.21$RequestClientId
                                                                                                                                                                                                      • API String ID: 1230284287-811482334
                                                                                                                                                                                                      • Opcode ID: 5630bf3e49e01dee4baf1b97b05a422f2a77269c97a32b4de2f1222efa106b82
                                                                                                                                                                                                      • Instruction ID: a414718cb591165e8552752c9ce750e23d4029e3a5e32612c3469e6dd0e2977b
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 5630bf3e49e01dee4baf1b97b05a422f2a77269c97a32b4de2f1222efa106b82
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 9742E931A40126BBFB129FB8CC41EAE7BA5AF64720F548655F9D4EB1D0EF71C9008B61
                                                                                                                                                                                                      Function 0104C167 Relevance: 61.9, APIs: 23, Strings: 12, Instructions: 651encryptionmemoryCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • CryptExportPublicKeyInfo.CRYPT32(?,00000002,00000001,00000000,0000000C), ref: 0104C1E3
                                                                                                                                                                                                      • LocalAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0104C204
                                                                                                                                                                                                      • CryptExportPublicKeyInfo.CRYPT32(?,00000002,00000001,?,0000000C), ref: 0104C22D
                                                                                                                                                                                                      • CertFindExtension.CRYPT32(2.5.29.14,?,?), ref: 0104C322
                                                                                                                                                                                                      • LocalAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0104C347
                                                                                                                                                                                                        • Part of subcall function 0104BA82: LocalFree.KERNEL32(00000000,000000C9,000004DD,00000001,0000011F,00000000,00000000,00000000,00000000,04DC00C9,00000002,-00000110,0104C3B6,?,00000000,?), ref: 0104BAC9
                                                                                                                                                                                                      • CAFindCertTypeByName.CERTCLI(?,00000000,000000E0,00000034,?,00000000,?,00000028,00000024,?,00000000,?,-00000010,00000014,00000018,?), ref: 0104C4A3
                                                                                                                                                                                                      • CAGetCertTypeExtensions.CERTCLI(?,0000003C,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0104C4B8
                                                                                                                                                                                                      • LocalAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0104C4DC
                                                                                                                                                                                                      • CertFindExtension.CRYPT32(1.3.6.1.4.1.311.13.2.3,?,?), ref: 0104C61F
                                                                                                                                                                                                      • LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0104CD70), ref: 0104C84C
                                                                                                                                                                                                      • LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0104CD70), ref: 0104C875
                                                                                                                                                                                                      • LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0104CD70), ref: 0104C889
                                                                                                                                                                                                      • LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0104CD70), ref: 0104C893
                                                                                                                                                                                                      • LocalFree.KERNEL32(?,?,?), ref: 0104C8A8
                                                                                                                                                                                                      • LocalFree.KERNEL32(?,?,?), ref: 0104C8B2
                                                                                                                                                                                                      • LocalFree.KERNEL32(?,?,?), ref: 0104C8BC
                                                                                                                                                                                                      • LocalFree.KERNEL32(?,?,?), ref: 0104C8C6
                                                                                                                                                                                                      • CAFreeCertTypeExtensions.CERTCLI(?,?,?,?), ref: 0104C8E0
                                                                                                                                                                                                      • CACloseCertType.CERTCLI(?,?,?), ref: 0104C8E9
                                                                                                                                                                                                        • Part of subcall function 01066C28: GetLastError.KERNEL32(0104F3D4), ref: 01066C28
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 0000000A.00000002.2668757884.0000000001001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 01000000, based on PE: true
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668728494.0000000001000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668837967.000000000106F000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668875659.0000000001072000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668905907.0000000001076000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_1000000_certutil.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Local$Free$Cert$Type$AllocFind$CryptExportExtensionExtensionsInfoPublic$CloseErrorLastName
                                                                                                                                                                                                      • String ID: 1.2.840.113549.1.9.14$1.3.6.1.4.1.311.10.9.1$1.3.6.1.4.1.311.13.2.3$1.3.6.1.4.1.311.2.1.14$1.3.6.1.4.1.311.21.1$1.3.6.1.4.1.311.21.2$2.5.29.14$2.5.29.15$2.5.29.19$2.5.29.32$2.5.29.37$SubCA
                                                                                                                                                                                                      • API String ID: 1702296457-1801506689
                                                                                                                                                                                                      • Opcode ID: d8fad0f32fafb16857bfb2e82c62c1d808e478bfc29ec5c36c8f9ae9a9fb4ffd
                                                                                                                                                                                                      • Instruction ID: 43f3d6517f7b82317ebe0277c6a47b9e92c10a14f09853395d22d1ce1028068a
                                                                                                                                                                                                      • Opcode Fuzzy Hash: d8fad0f32fafb16857bfb2e82c62c1d808e478bfc29ec5c36c8f9ae9a9fb4ffd
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 6D3259B290121DAFEB21DF98CDC09EE7BA8FB09350F45457AFE89A7250D7709944CB90
                                                                                                                                                                                                      Function 0104C916 Relevance: 56.8, APIs: 21, Strings: 11, Instructions: 797encryptionCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • CryptReleaseContext.ADVAPI32(?,00000000,?,?,000000C9,00000A4A,8007139F,?,?,?,00000000,09B800C9,8007139F,?,?,00000000), ref: 0104D18A
                                                                                                                                                                                                      • LocalFree.KERNEL32(?,?,?,000000C9,00000A4A,8007139F,?,?,?,00000000,09B800C9,8007139F,?,?,00000000,?), ref: 0104D19E
                                                                                                                                                                                                      • LocalFree.KERNEL32(?,?,?,000000C9,00000A4A,8007139F,?,?,?,00000000,09B800C9,8007139F,?,?,00000000,?), ref: 0104D1A8
                                                                                                                                                                                                      • LocalFree.KERNEL32(?,?,?,000000C9,00000A4A,8007139F,?,?,?,00000000,09B800C9,8007139F,?,?,00000000,?), ref: 0104D1B2
                                                                                                                                                                                                      • CertFreeCTLContext.CRYPT32(?,?,?,000000C9,00000A4A,8007139F,?,?,?,00000000,09B800C9,8007139F,?,?,00000000,?), ref: 0104D1BC
                                                                                                                                                                                                      • LocalFree.KERNEL32(?,?,?,000000C9,00000A4A,8007139F,?,?,?,00000000,09B800C9,8007139F,?,?,00000000,?), ref: 0104D1CA
                                                                                                                                                                                                      • LocalFree.KERNEL32(?,?,?,000000C9,00000A4A,8007139F,?,?,?,00000000,09B800C9,8007139F,?,?,00000000,?), ref: 0104D1D4
                                                                                                                                                                                                      • LocalFree.KERNEL32(?,?,?,000000C9,00000A4A,8007139F,?,?,?,00000000,09B800C9,8007139F,?,?,00000000,?), ref: 0104D1DE
                                                                                                                                                                                                      • LocalFree.KERNEL32(?,?,?,000000C9,00000A4A,8007139F,?,?,?,00000000,09B800C9,8007139F,?,?,00000000,?), ref: 0104D1E8
                                                                                                                                                                                                      • LocalFree.KERNEL32(?,?,?,000000C9,00000A4A,8007139F,?,?,?,00000000,09B800C9,8007139F,?,?,00000000,?), ref: 0104D1F2
                                                                                                                                                                                                      • LocalFree.KERNEL32(?,?,?,000000C9,00000A4A,8007139F,?,?,?,00000000,09B800C9,8007139F,?,?,00000000,?), ref: 0104D1FC
                                                                                                                                                                                                      • SysFreeString.OLEAUT32(?), ref: 0104D206
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 0000000A.00000002.2668757884.0000000001001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 01000000, based on PE: true
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668728494.0000000001000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668837967.000000000106F000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668875659.0000000001072000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668905907.0000000001076000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_1000000_certutil.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Free$Local$Context$CertCryptReleaseString
                                                                                                                                                                                                      • String ID: Active$CAServerName$CAType$CertificateAuthority_MicrosoftDefault.Policy$ParentCAMachine$ParentCAName$PolicyModules$RequestFileName$RevocationType$UseDS$certsrv_server
                                                                                                                                                                                                      • API String ID: 3602741310-3789567716
                                                                                                                                                                                                      • Opcode ID: 4485e0768bbecfd9261dad245de1c801f5f26cace5e417975201a13ffd0f901d
                                                                                                                                                                                                      • Instruction ID: d182f99165d5a7a554f49c975820c8ac56fea9a0cd1246566aea98d72c2a4965
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 4485e0768bbecfd9261dad245de1c801f5f26cace5e417975201a13ffd0f901d
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 335258B2901259BFEF61AF98CD84DEE7BA9FF18340F054179FE85A2020D3729D509B90
                                                                                                                                                                                                      Function 0103A15E Relevance: 26.5, APIs: 8, Strings: 7, Instructions: 259stringencryptionCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • lstrcmpW.KERNEL32(?,?,?,?), ref: 0103A242
                                                                                                                                                                                                        • Part of subcall function 0104D316: CryptReleaseContext.ADVAPI32(80092005,00000000,00E400CB,80090009,02F10139,00CD00CB,00000000,00000000,80092005,00000000,02F10139,80092005,00000000,?,80092005,00000000), ref: 0104D615
                                                                                                                                                                                                        • Part of subcall function 0104D316: LocalFree.KERNEL32(02F10139,02F10139,00CD00CB,00000000,00000000,80092005,00000000,02F10139,80092005,00000000,?,80092005,00000000,00000000,00000000), ref: 0104D632
                                                                                                                                                                                                      • LocalFree.KERNEL32(?,?,?,?,00000000,00000001,?,?,?,?,?), ref: 0103A357
                                                                                                                                                                                                      • LocalFree.KERNEL32(?,?,?,?,00000000,00000001,?,?,?,?,?), ref: 0103A3E1
                                                                                                                                                                                                      • CryptReleaseContext.ADVAPI32(?,00000000,?,?,?,00000000,00000001,?,?,?,?,?), ref: 0103A3FD
                                                                                                                                                                                                      • LocalFree.KERNEL32(?,?,?,?,00000000,00000001,?,?,?,?,?), ref: 0103A412
                                                                                                                                                                                                      • LocalFree.KERNEL32(?), ref: 0103A436
                                                                                                                                                                                                      • LocalFree.KERNEL32(?), ref: 0103A444
                                                                                                                                                                                                      • LocalFree.KERNEL32(?), ref: 0103A452
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 0000000A.00000002.2668757884.0000000001001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 01000000, based on PE: true
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668728494.0000000001000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668837967.000000000106F000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668875659.0000000001072000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668905907.0000000001076000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_1000000_certutil.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: FreeLocal$ContextCryptRelease$lstrcmp
                                                                                                                                                                                                      • String ID: $ $ %ws$ -- %ws$%ws:$%wsAT_KEYEXCHANGE$%wsAT_SIGNATURE
                                                                                                                                                                                                      • API String ID: 693825833-1183641393
                                                                                                                                                                                                      • Opcode ID: 502a347f0e3ed9be7acf9f9ebb031485f5cc16e90112c383c7299fbb7edc1179
                                                                                                                                                                                                      • Instruction ID: 5925f0f5ccb76b1ea142fd7542950d1cbfb4347872463e6083259e1a517a4a4a
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 502a347f0e3ed9be7acf9f9ebb031485f5cc16e90112c383c7299fbb7edc1179
                                                                                                                                                                                                      • Instruction Fuzzy Hash: D0918031A00216EFEF22AF98DC858DEBBB9FF94301F50856AFAC0A6154DF724650DB51
                                                                                                                                                                                                      Function 010399A3 Relevance: 23.0, APIs: 9, Strings: 4, Instructions: 201encryptionCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                        • Part of subcall function 01055DA6: SetCursor.USER32(00000000,0007000F,00000000,?,00000000), ref: 01055E48
                                                                                                                                                                                                        • Part of subcall function 01055DA6: CertCloseStore.CRYPT32(00000000,00000000), ref: 01055FAF
                                                                                                                                                                                                        • Part of subcall function 01055DA6: SysFreeString.OLEAUT32(00000000), ref: 01055FBD
                                                                                                                                                                                                        • Part of subcall function 01055DA6: LocalFree.KERNEL32(0007000F,00000040), ref: 01055FD1
                                                                                                                                                                                                        • Part of subcall function 01055DA6: LocalFree.KERNEL32(?,00000040), ref: 01055FDD
                                                                                                                                                                                                        • Part of subcall function 01055DA6: LocalFree.KERNEL32(?,00000040), ref: 01055FE7
                                                                                                                                                                                                      • CertFreeCTLContext.CRYPT32(00000000), ref: 01039BA9
                                                                                                                                                                                                      • CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 01039BB9
                                                                                                                                                                                                      • LocalFree.KERNEL32(?), ref: 01039BCF
                                                                                                                                                                                                      • LocalFree.KERNEL32(?), ref: 01039BD9
                                                                                                                                                                                                      • CryptDestroyKey.ADVAPI32(?), ref: 01039BE6
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      • CryptAcquireContext(%ws, %ws), xrefs: 01039A84
                                                                                                                                                                                                      • Microsoft Base Cryptographic Provider v1.0, xrefs: 01039A59
                                                                                                                                                                                                      • CryptAcquireContext() --> %x, xrefs: 01039AB0
                                                                                                                                                                                                      • Microsoft Strong Cryptographic Provider, xrefs: 01039A6D
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 0000000A.00000002.2668757884.0000000001001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 01000000, based on PE: true
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668728494.0000000001000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668837967.000000000106F000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668875659.0000000001072000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668905907.0000000001076000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_1000000_certutil.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Free$Local$CertContextCrypt$CloseCursorDestroyReleaseStoreString
                                                                                                                                                                                                      • String ID: CryptAcquireContext(%ws, %ws)$CryptAcquireContext() --> %x$Microsoft Base Cryptographic Provider v1.0$Microsoft Strong Cryptographic Provider
                                                                                                                                                                                                      • API String ID: 2925255588-2799195570
                                                                                                                                                                                                      • Opcode ID: 39ed76f8ee6dd725bf9345afbc7499895789e0e59ba0640503a041419ad74c7c
                                                                                                                                                                                                      • Instruction ID: 70e5b38e0717e3108f1cad903303078c8fddbe05f028a88863b71f42388cca07
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 39ed76f8ee6dd725bf9345afbc7499895789e0e59ba0640503a041419ad74c7c
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 5D616871A0021AFFEF229F98CD84DAEBFADFF48704F404556F984A6250D7B18A50CB90
                                                                                                                                                                                                      Function 01028914 Relevance: 21.3, APIs: 8, Strings: 4, Instructions: 287encryptionCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • LocalFree.KERNEL32(?,?,1.2.840.113549.1.7.1,00000000,00000001,?,?,?,?,?,?,?,?,?,?,?), ref: 0102898B
                                                                                                                                                                                                      • CryptMsgGetAndVerifySigner.CRYPT32(?,00000000,00000000,00000004,?,?), ref: 01028A41
                                                                                                                                                                                                      • CertFreeCTLContext.CRYPT32(?,?,?,00000000,00000000,00000000,00000000,00000000,?,?,?,?,00000000,?,140F0134,00000000), ref: 01028AC1
                                                                                                                                                                                                      • CryptMsgControl.CRYPT32(?,00000000,00000013,00000014,?,00000027,?,00000002,?,?,?,1.2.840.113549.1.7.1,00000000,00000001), ref: 01028B2E
                                                                                                                                                                                                      • CryptMsgGetParam.CRYPT32(?,00000016,00000000,?,?), ref: 01028BAB
                                                                                                                                                                                                        • Part of subcall function 01056431: LocalFree.KERNEL32(00000000), ref: 01056827
                                                                                                                                                                                                        • Part of subcall function 01056431: LocalFree.KERNEL32(?), ref: 0105684A
                                                                                                                                                                                                        • Part of subcall function 01056431: GetModuleHandleW.KERNEL32(ntdll.dll,010105C8,00000830,01022610,%ws,00000000,?,?,?,00000000,00000000,?,00000000,00000000,?), ref: 01056499
                                                                                                                                                                                                        • Part of subcall function 01056431: GetProcAddress.KERNEL32(00000000,_vsnwprintf), ref: 010564A5
                                                                                                                                                                                                        • Part of subcall function 01056431: GetModuleHandleW.KERNEL32(msvcrt.dll,?,00000000,00000000,?), ref: 010564BE
                                                                                                                                                                                                        • Part of subcall function 01056431: GetProcAddress.KERNEL32(00000000,_vsnwprintf), ref: 010564C6
                                                                                                                                                                                                        • Part of subcall function 01056431: GetStdHandle.KERNEL32(000000F5,010105C8,00000830,01022610,%ws,00000000,?,?,?,00000000,00000000,?,00000000,00000000,?), ref: 010564D3
                                                                                                                                                                                                        • Part of subcall function 01056431: LocalFree.KERNEL32(?,?,?,?,?,00000000,00000000,?), ref: 01056551
                                                                                                                                                                                                        • Part of subcall function 01056431: LocalAlloc.KERNEL32(00000000,?,?,?,?,?,00000000,00000000,?), ref: 01056565
                                                                                                                                                                                                        • Part of subcall function 01056431: GetFileType.KERNEL32(?,?,?,?,?,00000000,00000000,?), ref: 010565C2
                                                                                                                                                                                                        • Part of subcall function 01056431: WriteConsoleW.KERNEL32(?,?,00000000,?,00000000), ref: 01056639
                                                                                                                                                                                                        • Part of subcall function 01056431: vfwprintf.MSVCRT ref: 010567D1
                                                                                                                                                                                                        • Part of subcall function 01023498: SysFreeString.OLEAUT32(00000014), ref: 010235B7
                                                                                                                                                                                                      • LocalFree.KERNEL32(?,?,1.2.840.113549.1.7.1,00000000,00000001,?,?,?,?,?,?,?,?,?,?,?), ref: 01028C0B
                                                                                                                                                                                                      • LocalFree.KERNEL32(?,?,1.2.840.113549.1.7.1,00000000,00000001,?,?,?,?,?,?,?,?,?,?,?), ref: 01028C19
                                                                                                                                                                                                      • CertFreeCTLContext.CRYPT32(?,?,1.2.840.113549.1.7.1,00000000,00000001,?,?,?,?,?,?,?,?,?,?,?), ref: 01028C27
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 0000000A.00000002.2668757884.0000000001001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 01000000, based on PE: true
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668728494.0000000001000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668837967.000000000106F000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668875659.0000000001072000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668905907.0000000001076000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_1000000_certutil.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Free$Local$CryptHandle$AddressCertContextModuleProc$AllocConsoleControlFileParamSignerStringTypeVerifyWritevfwprintf
                                                                                                                                                                                                      • String ID: %ws: %d$%ws: %u$1.2.840.113549.1.7.1$1.3.6.1.5.5.7.6.2
                                                                                                                                                                                                      • API String ID: 2933635075-1976122595
                                                                                                                                                                                                      • Opcode ID: 7b89422bc6ded66b38dbb66ef2bb83b3f40cb88d7ad076073595bdfba0ce2edd
                                                                                                                                                                                                      • Instruction ID: b85117b203df5f4d74591bd385cc7095f30bf03206ee6ae23ea634cf5e925b38
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 7b89422bc6ded66b38dbb66ef2bb83b3f40cb88d7ad076073595bdfba0ce2edd
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 1FA190B5D00129AFEF229FA4CC44AEEBBF9FF48350F148166FA80B6150DB359941CB61
                                                                                                                                                                                                      Function 01049178 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 79encryptionCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • CertCreateCertificateContext.CRYPT32(00000001,00000000,00000000), ref: 01049187
                                                                                                                                                                                                      • CertAddCertificateContextToStore.CRYPT32(?,00000000,00000003,00000000), ref: 010491B8
                                                                                                                                                                                                      • CertFreeCTLContext.CRYPT32(00000000), ref: 01049232
                                                                                                                                                                                                      • CertCloseStore.CRYPT32(00000000,00000002), ref: 0104923F
                                                                                                                                                                                                        • Part of subcall function 01066C28: GetLastError.KERNEL32(0104F3D4), ref: 01066C28
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 0000000A.00000002.2668757884.0000000001001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 01000000, based on PE: true
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668728494.0000000001000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668837967.000000000106F000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668875659.0000000001072000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668905907.0000000001076000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_1000000_certutil.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Cert$Context$CertificateStore$CloseCreateErrorFreeLast
                                                                                                                                                                                                      • String ID: ROOT
                                                                                                                                                                                                      • API String ID: 2232888885-543233263
                                                                                                                                                                                                      • Opcode ID: f081e1386304be9559480089df77d1e10e0d976918dbb043b9866f0cff538eb9
                                                                                                                                                                                                      • Instruction ID: f69f2fbc6c7feec5b3a5d5d91ffc9bdb56eaa2744785127e27997d2f1f27e2ce
                                                                                                                                                                                                      • Opcode Fuzzy Hash: f081e1386304be9559480089df77d1e10e0d976918dbb043b9866f0cff538eb9
                                                                                                                                                                                                      • Instruction Fuzzy Hash: D21106B13813127BF3313BA19CC9FAF7D8CDB19BA8F000574BA80A6085CAA5DC0583B1
                                                                                                                                                                                                      Function 01052171 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79encryptionwindowCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • CryptFindOIDInfo.CRYPT32(00000003,?,00000002), ref: 01052180
                                                                                                                                                                                                      • CryptEncryptMessage.CRYPT32(00000024,?,?,?,00000000,00006603,00006801), ref: 01052202
                                                                                                                                                                                                      • LocalFree.KERNEL32(00000000), ref: 01052216
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 0000000A.00000002.2668757884.0000000001001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 01000000, based on PE: true
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668728494.0000000001000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668837967.000000000106F000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668875659.0000000001072000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668905907.0000000001076000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_1000000_certutil.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Crypt$EncryptFindFreeInfoLocalMessage
                                                                                                                                                                                                      • String ID: $
                                                                                                                                                                                                      • API String ID: 2442336630-3993045852
                                                                                                                                                                                                      • Opcode ID: 7cda67052ffa9292870e3242ac21f2ec722cff64e9f22b3fdf59e2ada57506b0
                                                                                                                                                                                                      • Instruction ID: b0e50b6b1978d934555015dc96efb27077e145a755e3628f8d801aa54ef3d72e
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 7cda67052ffa9292870e3242ac21f2ec722cff64e9f22b3fdf59e2ada57506b0
                                                                                                                                                                                                      • Instruction Fuzzy Hash: AE218E7660020AEFEB619F58DC44BAB7BE9EF58350F104419FE84E6144D77AD8518B60
                                                                                                                                                                                                      Function 0105B191 Relevance: 7.6, APIs: 5, Instructions: 89fileCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • FindFirstFileW.KERNEL32(?,?,?,?,00000000,?,?,01010E14,00000000), ref: 0105B1F9
                                                                                                                                                                                                      • LocalFree.KERNEL32(?,?,?,?,00000000,?), ref: 0105B24A
                                                                                                                                                                                                      • FindNextFileW.KERNEL32(?,?), ref: 0105B257
                                                                                                                                                                                                      • FindClose.KERNEL32(?), ref: 0105B27A
                                                                                                                                                                                                      • LocalFree.KERNEL32(?), ref: 0105B288
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 0000000A.00000002.2668757884.0000000001001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 01000000, based on PE: true
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668728494.0000000001000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668837967.000000000106F000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668875659.0000000001072000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668905907.0000000001076000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_1000000_certutil.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Find$FileFreeLocal$CloseFirstNext
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 2753939382-0
                                                                                                                                                                                                      • Opcode ID: 84d1a7b7014687d1b4fa8f345a92c71304d159e634f757f0d7d4d3f915a5f12a
                                                                                                                                                                                                      • Instruction ID: 2c0ff43be1ffafb684d8bc81b946b33a9b6d9a96e40dd32d5f226479ca173727
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 84d1a7b7014687d1b4fa8f345a92c71304d159e634f757f0d7d4d3f915a5f12a
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 0F314F7190415DDFDBB1AFA9CC849EEBBBAFF04384F10412AED94A7151D77169408F60
                                                                                                                                                                                                      Function 0102B91E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 98COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • LocalFree.KERNEL32(00000000), ref: 0102BA23
                                                                                                                                                                                                        • Part of subcall function 01066C28: GetLastError.KERNEL32(0104F3D4), ref: 01066C28
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 0000000A.00000002.2668757884.0000000001001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 01000000, based on PE: true
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668728494.0000000001000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668837967.000000000106F000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668875659.0000000001072000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668905907.0000000001076000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_1000000_certutil.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: ErrorFreeLastLocal
                                                                                                                                                                                                      • String ID: 1.3.14.3.2.3
                                                                                                                                                                                                      • API String ID: 3928016487-4110257572
                                                                                                                                                                                                      • Opcode ID: 8245967a8d4ff359d4538b78b3e64fdce7ef94e89b613a8718a6a621c7188ad5
                                                                                                                                                                                                      • Instruction ID: c70d241f5ca9acfd0218ff4474e5b29af464fd974c8a062d45a2917058a1266b
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 8245967a8d4ff359d4538b78b3e64fdce7ef94e89b613a8718a6a621c7188ad5
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 2E319F36200216BBEB626F99CC45FEF7FA9EF94B45F104018FBC066090DB768951DB61
                                                                                                                                                                                                      Function 01035151 Relevance: 6.1, APIs: 4, Instructions: 72memoryencryptionCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • CryptGetProvParam.ADVAPI32(?,?,00000000,00000000,00000000,?,00000000,00000000,?,?,0103A126,?,00000024,00000000,00000000,00000000), ref: 01035171
                                                                                                                                                                                                      • LocalAlloc.KERNEL32(00000000,00000000,?,?,0103A126,?,00000024,00000000,00000000,00000000), ref: 0103518F
                                                                                                                                                                                                      • LocalFree.KERNEL32(?,?,?,000000FF,?,?,0103A126,?,00000024,00000000,00000000,00000000), ref: 010351F7
                                                                                                                                                                                                        • Part of subcall function 01066C28: GetLastError.KERNEL32(0104F3D4), ref: 01066C28
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 0000000A.00000002.2668757884.0000000001001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 01000000, based on PE: true
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668728494.0000000001000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668837967.000000000106F000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668875659.0000000001072000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668905907.0000000001076000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_1000000_certutil.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Local$AllocCryptErrorFreeLastParamProv
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 2307310790-0
                                                                                                                                                                                                      • Opcode ID: 54cce9d5f51716e8e137dda5db656c57f14dde36e05081c814160bd62e10ba8b
                                                                                                                                                                                                      • Instruction ID: d7fe7d8be7064e5a4ce23c7487dd7c0f55a8ad1974286247ca7383d6ec665677
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 54cce9d5f51716e8e137dda5db656c57f14dde36e05081c814160bd62e10ba8b
                                                                                                                                                                                                      • Instruction Fuzzy Hash: E711B27250025AFBEB225FA6DC40CBF7AADEB816A0B104659FD91E2124E775C910CBA0
                                                                                                                                                                                                      Function 01020139 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40encryptionCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • CertFindExtension.CRYPT32(2.5.29.19,?,?), ref: 01020157
                                                                                                                                                                                                      • CryptDecodeObject.CRYPT32(00000001,0000000F,?,?,00000000,?,?), ref: 0102017C
                                                                                                                                                                                                        • Part of subcall function 01066C28: GetLastError.KERNEL32(0104F3D4), ref: 01066C28
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 0000000A.00000002.2668757884.0000000001001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 01000000, based on PE: true
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668728494.0000000001000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668837967.000000000106F000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668875659.0000000001072000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668905907.0000000001076000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_1000000_certutil.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CertCryptDecodeErrorExtensionFindLastObject
                                                                                                                                                                                                      • String ID: 2.5.29.19
                                                                                                                                                                                                      • API String ID: 455556749-814144176
                                                                                                                                                                                                      • Opcode ID: 4ff3e5eefbc4103602f87c7cc2ab74a35192d83136d16625350f7b0be5b5e0e9
                                                                                                                                                                                                      • Instruction ID: cffad2ac551bfe2bcc589a6605a9a3d0ea355ea28ca1ceef5d6500438296be50
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 4ff3e5eefbc4103602f87c7cc2ab74a35192d83136d16625350f7b0be5b5e0e9
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 3C01A436610215BFEB21AFA5CC05FD9BBE8EF04720F01C054FA849B295D371D914CB90
                                                                                                                                                                                                      Function 0101696D Relevance: 4.6, APIs: 3, Instructions: 110encryptionCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                        • Part of subcall function 01066C35: CertOpenStore.CRYPT32(00000005,00010001,00000000,00000000,00000000), ref: 01066C9D
                                                                                                                                                                                                        • Part of subcall function 01066C35: CertCloseStore.CRYPT32(?,00000002), ref: 01066E06
                                                                                                                                                                                                        • Part of subcall function 01066C35: LocalFree.KERNEL32(00000000,?,?,00000000,00000000,00000000,?,00000000), ref: 01066E1A
                                                                                                                                                                                                        • Part of subcall function 01066C35: LocalFree.KERNEL32(?,?,?,00000000,00000000,00000000,?,00000000), ref: 01066E24
                                                                                                                                                                                                      • CryptMsgClose.CRYPT32(00000003), ref: 01016A5F
                                                                                                                                                                                                      • CertCloseStore.CRYPT32(?,00000002), ref: 01016A6F
                                                                                                                                                                                                      • LocalFree.KERNEL32(?,08EF012E,8007000D,?,?,00000000,00000000,00000002,00000000,00000000,?,00000000,00000002,?,?,?), ref: 01016A7D
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 0000000A.00000002.2668757884.0000000001001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 01000000, based on PE: true
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668728494.0000000001000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668837967.000000000106F000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668875659.0000000001072000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668905907.0000000001076000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_1000000_certutil.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CertCloseFreeLocalStore$CryptOpen
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 4237729961-0
                                                                                                                                                                                                      • Opcode ID: 81c3344a726aec1214f5548950aa8efccd153bacb25259774c0b3454dfa3f4be
                                                                                                                                                                                                      • Instruction ID: 7bd96f0a6f28d876455e410ac71a5457fe42100d20745db7da66accebaec0a94
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 81c3344a726aec1214f5548950aa8efccd153bacb25259774c0b3454dfa3f4be
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 20316176800119FFDB21DB9ACC44CEEBBFDEB84711F54C166F995A6118D2BA8A40CF90
                                                                                                                                                                                                      Function 010671B5 Relevance: 3.1, APIs: 2, Instructions: 52encryptionCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • CryptSignCertificate.CRYPT32(00000000,?,?,00000002,00000000,00000000,00000000,?,00000002), ref: 010671DE
                                                                                                                                                                                                      • SetLastError.KERNEL32(8007000D,?,?,01067703,?,00000002,?,00000000,00000000,00000000,00000002,?,?,00000000,00000000,?), ref: 010671F4
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 0000000A.00000002.2668757884.0000000001001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 01000000, based on PE: true
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668728494.0000000001000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668837967.000000000106F000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668875659.0000000001072000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668905907.0000000001076000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_1000000_certutil.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CertificateCryptErrorLastSign
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 481880454-0
                                                                                                                                                                                                      • Opcode ID: 34b0524bb46a671a642f84b28cd7d74176300888f5ffa25098e41c2fbf5406ad
                                                                                                                                                                                                      • Instruction ID: 1fd25a57bc0055d79565e7416a586cdb0367beb2a04c441cdb138a46551b79ff
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 34b0524bb46a671a642f84b28cd7d74176300888f5ffa25098e41c2fbf5406ad
                                                                                                                                                                                                      • Instruction Fuzzy Hash: A311D73210020BEFEF625F99DC40BAA7BE9FF58329F14052AFAC495151D7B6D8A0DB50
                                                                                                                                                                                                      Function 0102A15B Relevance: 77.4, APIs: 38, Strings: 6, Instructions: 414fileCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                        • Part of subcall function 010674A7: GetACP.KERNEL32(?,?,010525CE,00000000,?,000000FF,?,?,?,010159AB,?), ref: 010674AF
                                                                                                                                                                                                      • fopen.MSVCRT ref: 0102A1C0
                                                                                                                                                                                                      • GetFileAttributesW.KERNEL32(?), ref: 0102A1DA
                                                                                                                                                                                                      • fclose.MSVCRT ref: 0102A5D4
                                                                                                                                                                                                      • fclose.MSVCRT ref: 0102A5E0
                                                                                                                                                                                                      • DeleteFileW.KERNEL32(?,00000001,00000001), ref: 0102A5ED
                                                                                                                                                                                                      • LocalFree.KERNEL32(?,00000001,00000001), ref: 0102A602
                                                                                                                                                                                                      • LocalFree.KERNEL32(?,00000001,00000001), ref: 0102A60D
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 0000000A.00000002.2668757884.0000000001001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 01000000, based on PE: true
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668728494.0000000001000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668837967.000000000106F000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668875659.0000000001072000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668905907.0000000001076000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_1000000_certutil.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: FileFreeLocalfclose$AttributesDeletefopen
                                                                                                                                                                                                      • String ID: = $Password Token$[Version]Signature="$Windows NT$"$epf$temp$tmp
                                                                                                                                                                                                      • API String ID: 383668874-1643389693
                                                                                                                                                                                                      • Opcode ID: f61853fccce879f602d60b086055e6972726249fabae72ba224aeef18e72731b
                                                                                                                                                                                                      • Instruction ID: 81aa33f373168f55e0c269d7ea158606ab7623bddcefcd404e5278cdbc71e5e6
                                                                                                                                                                                                      • Opcode Fuzzy Hash: f61853fccce879f602d60b086055e6972726249fabae72ba224aeef18e72731b
                                                                                                                                                                                                      • Instruction Fuzzy Hash: CFD1E532B08329EFEB325BA49C48BEE7BE9EB45710F24005AF5C99B481DF799540CB51
                                                                                                                                                                                                      Function 0105B984 Relevance: 38.8, APIs: 20, Strings: 2, Instructions: 278encryptionmemoryCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • ImpersonateSelf.ADVAPI32(00000002,00000000,?,00000000,00000000,00000000,00000001,?,00000104,?), ref: 0105B9A6
                                                                                                                                                                                                      • LocalFree.KERNEL32(?,?,00000000,?,?,?,SeBackupPrivilege,00000001,?,00000000,00000000,00000000,00000001,?,00000104,?), ref: 0105BA18
                                                                                                                                                                                                      • CreateDirectoryW.KERNEL32(?,00000000,?,?,00000000,?,?,?,SeBackupPrivilege,00000001,?,00000000,00000000,00000000,00000001,?), ref: 0105BA78
                                                                                                                                                                                                      • wcslen.MSVCRT ref: 0105BAA5
                                                                                                                                                                                                      • wcslen.MSVCRT ref: 0105BAAB
                                                                                                                                                                                                      • LocalAlloc.KERNEL32(00000000,?,00000000,00000000,00000001,?,00000104,?), ref: 0105BABA
                                                                                                                                                                                                      • wcscpy.MSVCRT ref: 0105BADB
                                                                                                                                                                                                      • wcscat.MSVCRT ref: 0105BAED
                                                                                                                                                                                                      • wcscat.MSVCRT ref: 0105BAF6
                                                                                                                                                                                                      • wcscat.MSVCRT ref: 0105BAFE
                                                                                                                                                                                                      • CertOpenStore.CRYPT32(0000000A,00000001,00000000,0002C200,010073F0), ref: 0105BB18
                                                                                                                                                                                                      • CertOpenStore.CRYPT32(00000002,00000001,00000000,00000000,00000000), ref: 0105BB3A
                                                                                                                                                                                                      • LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0105BC2B
                                                                                                                                                                                                      • LocalFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0105BC39
                                                                                                                                                                                                      • LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0105BC47
                                                                                                                                                                                                      • CertCloseStore.CRYPT32(?,00000002), ref: 0105BC5D
                                                                                                                                                                                                      • CertCloseStore.CRYPT32(?,00000002), ref: 0105BC69
                                                                                                                                                                                                      • LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0105BC73
                                                                                                                                                                                                      • RevertToSelf.ADVAPI32(SeBackupPrivilege,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0105BC89
                                                                                                                                                                                                        • Part of subcall function 01066C28: GetLastError.KERNEL32(0104F3D4), ref: 01066C28
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 0000000A.00000002.2668757884.0000000001001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 01000000, based on PE: true
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668728494.0000000001000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668837967.000000000106F000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668875659.0000000001072000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668905907.0000000001076000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_1000000_certutil.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Local$Free$CertStore$wcscat$CloseOpenSelfwcslen$AllocCreateDirectoryErrorImpersonateLastRevertwcscpy
                                                                                                                                                                                                      • String ID: .p12$SeBackupPrivilege
                                                                                                                                                                                                      • API String ID: 3436136381-305109965
                                                                                                                                                                                                      • Opcode ID: 053492c8e462908685d3b92e51e3573c4e963c2a3b7e987c4088d3126f3e4870
                                                                                                                                                                                                      • Instruction ID: 0b4c8f426e7869ed5ed678cb281eb66b2b0827feb7f360a82494a0ca83f15efa
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 053492c8e462908685d3b92e51e3573c4e963c2a3b7e987c4088d3126f3e4870
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 4191AC31D00219FBDBB2AFA98C85DEFBFBAEF44350F104566F995A6110D375AA00CB90
                                                                                                                                                                                                      Function 01044176 Relevance: 35.3, APIs: 3, Strings: 17, Instructions: 279COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • #207.CERTCLI(?,00000000,?,Request.StatusCode,?,Request.RequestType,?,Request.RequestFlags,?,Request.Disposition,?,00000000), ref: 01044475
                                                                                                                                                                                                      • #206.CERTCLI(?,?,00000000,?,00000000,?,Request.StatusCode,?,Request.RequestType,?,Request.RequestFlags,?,Request.Disposition,?,00000000), ref: 01044485
                                                                                                                                                                                                      • LocalFree.KERNEL32(?,ExtensionFlags,Request.Disposition,?,00000000), ref: 01044509
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 0000000A.00000002.2668757884.0000000001001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 01000000, based on PE: true
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668728494.0000000001000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668837967.000000000106F000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668875659.0000000001072000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668905907.0000000001076000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_1000000_certutil.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: #206#207FreeLocal
                                                                                                                                                                                                      • String ID: %u.%u$ %ws -- %ws$ (%d)$ -- $ -- %ws$ 0x%x$%ws%ws$1.3.6.1.4.1.311.21.1$CRLNameId$CRLPublishStatusCode$ExtensionFlags$IssuerNameID$Request.Disposition$Request.RequestFlags$Request.RequestType$Request.RevokedReason$Request.StatusCode
                                                                                                                                                                                                      • API String ID: 1195461207-4093795461
                                                                                                                                                                                                      • Opcode ID: 0ab4c9887e801482b15144cfd44c7487cf5a5eb14683db0d2e5068ef0e2499a3
                                                                                                                                                                                                      • Instruction ID: e4ada4f1e39aefb0d28c342643aa648de830a391cffd75f9d7faa46c09028247
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 0ab4c9887e801482b15144cfd44c7487cf5a5eb14683db0d2e5068ef0e2499a3
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 6791C3F1500216E7FB619FA8ED84BEE7EE8BB40785F408139EEE1E6191DB7484068791
                                                                                                                                                                                                      Function 0102913B Relevance: 26.6, APIs: 11, Strings: 4, Instructions: 399encryptionCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • LocalFree.KERNEL32(?), ref: 010292AC
                                                                                                                                                                                                        • Part of subcall function 01066C28: GetLastError.KERNEL32(0104F3D4), ref: 01066C28
                                                                                                                                                                                                      • PFXIsPFXBlob.CRYPT32(?), ref: 010292F4
                                                                                                                                                                                                      • CertEnumCertificatesInStore.CRYPT32(?,00000000), ref: 010293F2
                                                                                                                                                                                                      • LocalFree.KERNEL32(?), ref: 01029430
                                                                                                                                                                                                      • LocalFree.KERNEL32(?,?,?,?,01003398,?,00000000,?), ref: 01029487
                                                                                                                                                                                                      • CertEnumCertificatesInStore.CRYPT32(?,?), ref: 010294D4
                                                                                                                                                                                                      • LocalFree.KERNEL32(?,00000000,00000001,010714B8,?,?,00000002,?,?,010033D0,05F60134,00000000), ref: 0102960A
                                                                                                                                                                                                      • CertFreeCTLContext.CRYPT32(?,00000000,00000001,010714B8,?,?,00000002,?,?,010033D0,05F60134,00000000), ref: 01029619
                                                                                                                                                                                                      • CertCloseStore.CRYPT32(?,00000002), ref: 01029634
                                                                                                                                                                                                      • LocalFree.KERNEL32(?,00000000,00000001,010714B8,?,?,00000002,?,?,010033D0,05F60134,00000000), ref: 01029643
                                                                                                                                                                                                      • LocalFree.KERNEL32(?,00000000,00000001,010714B8,?,?,00000002,?,?,010033D0,05F60134,00000000), ref: 01029652
                                                                                                                                                                                                        • Part of subcall function 01019695: wcscmp.MSVCRT ref: 010196B8
                                                                                                                                                                                                        • Part of subcall function 01019695: wcsspn.MSVCRT ref: 010196D5
                                                                                                                                                                                                        • Part of subcall function 01019695: wcslen.MSVCRT ref: 010196EB
                                                                                                                                                                                                        • Part of subcall function 010242AD: wsprintfW.USER32 ref: 010242E5
                                                                                                                                                                                                        • Part of subcall function 010242AD: wcslen.MSVCRT ref: 010242F4
                                                                                                                                                                                                        • Part of subcall function 010242AD: wcslen.MSVCRT ref: 010242FF
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 0000000A.00000002.2668757884.0000000001001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 01000000, based on PE: true
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668728494.0000000001000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668837967.000000000106F000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668875659.0000000001072000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668905907.0000000001076000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_1000000_certutil.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Free$Local$Cert$Storewcslen$CertificatesEnum$BlobCloseContextErrorLastwcscmpwcsspnwsprintf
                                                                                                                                                                                                      • String ID: .bin$.key$.p12$.p7b
                                                                                                                                                                                                      • API String ID: 1268927928-2903063653
                                                                                                                                                                                                      • Opcode ID: 311fceaee1094cc388fa5d070fbc346d60ddd9aff4a39fd11c5e01351d8e60c6
                                                                                                                                                                                                      • Instruction ID: 32b63bfceed0df2b9daa47841de923347cfbbe12740450476e3f653ad837e6e9
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 311fceaee1094cc388fa5d070fbc346d60ddd9aff4a39fd11c5e01351d8e60c6
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 6DE1AE7190026AAFEF326FE5CC84FEE7BBAFF44308F104059E985AA155DB768950CB10
                                                                                                                                                                                                      Function 010349A0 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 195registryCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                        • Part of subcall function 01063EF2: RegCloseKey.ADVAPI32(?,092301B5,80070057,Config,?,00000006,Restore,?,00000007,Exit,?,00000004,Policy,?,00000006,010031E0), ref: 0106450B
                                                                                                                                                                                                        • Part of subcall function 01063EF2: RegCloseKey.ADVAPI32(?,092301B5,80070057,Config,?,00000006,Restore,?,00000007,Exit,?,00000004,Policy,?,00000006,010031E0), ref: 01064517
                                                                                                                                                                                                        • Part of subcall function 01063EF2: RegCloseKey.ADVAPI32(?,092301B5,80070057,Config,?,00000006,Restore,?,00000007,Exit,?,00000004,Policy,?,00000006,010031E0), ref: 01064521
                                                                                                                                                                                                        • Part of subcall function 01063EF2: RegCloseKey.ADVAPI32(?,092301B5,80070057,Config,?,00000006,Restore,?,00000007,Exit,?,00000004,Policy,?,00000006,010031E0), ref: 0106452B
                                                                                                                                                                                                        • Part of subcall function 01063EF2: LocalFree.KERNEL32(?,092301B5,80070057,Config,?,00000006,Restore,?,00000007,Exit,?,00000004,Policy,?,00000006,010031E0), ref: 0106453B
                                                                                                                                                                                                        • Part of subcall function 01063EF2: LocalFree.KERNEL32(?,092301B5,80070057,Config,?,00000006,Restore,?,00000007,Exit,?,00000004,Policy,?,00000006,010031E0), ref: 01064552
                                                                                                                                                                                                        • Part of subcall function 01063EF2: LocalFree.KERNEL32(?,092301B5,80070057,Config,?,00000006,Restore,?,00000007,Exit,?,00000004,Policy,?,00000006,010031E0), ref: 0106456D
                                                                                                                                                                                                      • RegCloseKey.ADVAPI32(?), ref: 01034B6C
                                                                                                                                                                                                      • RegCloseKey.ADVAPI32(?), ref: 01034B7A
                                                                                                                                                                                                      • LocalFree.KERNEL32(?), ref: 01034B8E
                                                                                                                                                                                                      • LocalFree.KERNEL32(?), ref: 01034B98
                                                                                                                                                                                                      • LocalFree.KERNEL32(?), ref: 01034BA2
                                                                                                                                                                                                      • LocalFree.KERNEL32(?), ref: 01034BAC
                                                                                                                                                                                                      • LocalFree.KERNEL32(?), ref: 01034BB6
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 0000000A.00000002.2668757884.0000000001001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 01000000, based on PE: true
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668728494.0000000001000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668837967.000000000106F000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668875659.0000000001072000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668905907.0000000001076000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_1000000_certutil.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: FreeLocal$Close
                                                                                                                                                                                                      • String ID: %ws%ws%ws%ws:$Configuration
                                                                                                                                                                                                      • API String ID: 3592837160-1914731656
                                                                                                                                                                                                      • Opcode ID: 71c7dfae7ff6b51e914ee9c1bc421f40c6ec1d979969bbfa107d5286967be2b0
                                                                                                                                                                                                      • Instruction ID: b13a491b840c05caadc24892e2b5d573cbc5b0ba71f587c2f710791279d0967e
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 71c7dfae7ff6b51e914ee9c1bc421f40c6ec1d979969bbfa107d5286967be2b0
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 39611A72D0021AEFDF519F94DC84DEEBBBEFB84300F50806AE691EA110D7759A81DB60
                                                                                                                                                                                                      Function 0105095E Relevance: 19.7, APIs: 13, Instructions: 175memoryCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • FoldStringW.KERNEL32(00000080,?,000000FF,?,00000010,75C3A230,00000000,?,00000000), ref: 01050999
                                                                                                                                                                                                      • FoldStringW.KERNEL32(00000080,?,000000FF,00000000,00000000,?,00000000), ref: 010509B4
                                                                                                                                                                                                      • LocalAlloc.KERNEL32(00000000,00000000,?,00000000), ref: 010509BF
                                                                                                                                                                                                      • FoldStringW.KERNEL32(00000080,?,000000FF,00000000,00000000,?,00000000), ref: 010509E8
                                                                                                                                                                                                      • iswspace.NTDLL(00000000,?,00000000), ref: 01050A1E
                                                                                                                                                                                                      • iswxdigit.NTDLL(00000000,?,?,?,?,?,?,?,?,?,?,?,?,01033620,-00000002,?), ref: 01050A51
                                                                                                                                                                                                      • iswdigit.MSVCRT ref: 01050A6F
                                                                                                                                                                                                      • iswxdigit.NTDLL(00000000), ref: 01050AAB
                                                                                                                                                                                                      • iswdigit.MSVCRT ref: 01050ABB
                                                                                                                                                                                                      • iswdigit.MSVCRT ref: 01050AD2
                                                                                                                                                                                                      • _wtoi.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,01033620,-00000002,?), ref: 01050ADA
                                                                                                                                                                                                      • iswspace.NTDLL(00000000,?,?,?,?,?,?,?,?,?,?,01033620,-00000002,?), ref: 01050AEF
                                                                                                                                                                                                      • LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,01033620,-00000002,?), ref: 01050B12
                                                                                                                                                                                                        • Part of subcall function 01066C28: GetLastError.KERNEL32(0104F3D4), ref: 01066C28
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 0000000A.00000002.2668757884.0000000001001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 01000000, based on PE: true
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668728494.0000000001000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668837967.000000000106F000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668875659.0000000001072000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668905907.0000000001076000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_1000000_certutil.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: FoldStringiswdigit$Localiswspaceiswxdigit$AllocErrorFreeLast_wtoi
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 2363576933-0
                                                                                                                                                                                                      • Opcode ID: ed337223a56f30d4a1a9a398c160a4786b9b26b06f5599dfdc12db0511bb905e
                                                                                                                                                                                                      • Instruction ID: fd80567260fc37ec8349c6f6f08b20492a640d10eb4bbce4be8826b20ac293ac
                                                                                                                                                                                                      • Opcode Fuzzy Hash: ed337223a56f30d4a1a9a398c160a4786b9b26b06f5599dfdc12db0511bb905e
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 3B51B07550430A9BEBA1AFA9D844A6F7BE8FF44754F100A2AFDC1C2248E775C8418B61
                                                                                                                                                                                                      Function 01043921 Relevance: 19.5, APIs: 6, Strings: 5, Instructions: 217memoryCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • wcscspn.MSVCRT ref: 01043966
                                                                                                                                                                                                      • LocalAlloc.KERNEL32(00000000,?), ref: 01043979
                                                                                                                                                                                                      • wcslen.MSVCRT ref: 01043A6E
                                                                                                                                                                                                      • LocalAlloc.KERNEL32(00000000,00000002), ref: 01043A85
                                                                                                                                                                                                      • wcscpy.MSVCRT ref: 01043AA3
                                                                                                                                                                                                      • LocalFree.KERNEL32(00000000,?,:Revoked,?,:LogFail,?,:Log,?,:Queue), ref: 01043AF7
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 0000000A.00000002.2668757884.0000000001001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 01000000, based on PE: true
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668728494.0000000001000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668837967.000000000106F000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668875659.0000000001072000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668905907.0000000001076000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_1000000_certutil.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Local$Alloc$Freewcscpywcscspnwcslen
                                                                                                                                                                                                      • String ID: :Log$:LogFail$:Queue$:Revoked$<>=
                                                                                                                                                                                                      • API String ID: 1236581658-466439153
                                                                                                                                                                                                      • Opcode ID: e79887d813ad024d07e7aefbbf129acf2bf0cf39aacfa97b324c69b0fcff5051
                                                                                                                                                                                                      • Instruction ID: 07acfd6df52a4f8d4080b8b7af31fb88ebed12b55a2878e7e643a9de2f3a5dfe
                                                                                                                                                                                                      • Opcode Fuzzy Hash: e79887d813ad024d07e7aefbbf129acf2bf0cf39aacfa97b324c69b0fcff5051
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 9171F2B5A40225EBDB22DF18C4C4AAEBBE4FF01354F1091A9E8D5DF291D7748D52CB90
                                                                                                                                                                                                      Function 01063948 Relevance: 18.2, APIs: 12, Instructions: 216memoryencryptionCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • CertGetCertificateContextProperty.CRYPT32(00000000,00000003,?,00000000), ref: 0106398B
                                                                                                                                                                                                      • SysFreeString.OLEAUT32(?), ref: 01063B7E
                                                                                                                                                                                                        • Part of subcall function 01063634: RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,00000000,00000000,00000000,00000001,?,00000104,?), ref: 0106370F
                                                                                                                                                                                                        • Part of subcall function 01063634: LocalFree.KERNEL32(00000000,?,?,?,?,?), ref: 0106371A
                                                                                                                                                                                                        • Part of subcall function 01063634: RegCloseKey.ADVAPI32(00000000,?,?,?,?), ref: 01063729
                                                                                                                                                                                                      • LocalAlloc.KERNEL32(00000000,00000007,00000000,00000000,00000000,00000000,00000001,00000000,?,00000000,00000000,00000000,00000000,00000000,00000001,00000014), ref: 01063A40
                                                                                                                                                                                                      • wcslen.MSVCRT ref: 01063A77
                                                                                                                                                                                                      • wcslen.MSVCRT ref: 01063AB9
                                                                                                                                                                                                      • LocalAlloc.KERNEL32(00000000,?), ref: 01063AD7
                                                                                                                                                                                                      • wcscpy.MSVCRT ref: 01063B05
                                                                                                                                                                                                      • wcslen.MSVCRT ref: 01063B0C
                                                                                                                                                                                                      • LocalFree.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000001,00000000,00000007,?,00000000,00000000), ref: 01063B5D
                                                                                                                                                                                                      • LocalFree.KERNEL32(?,00000000,00000000,00000000,00000000,00000001,00000000,00000007,?,00000000,00000000), ref: 01063B67
                                                                                                                                                                                                      • LocalFree.KERNEL32(?,00000000,00000000,00000000,00000000,00000001,00000000,00000007,?,00000000,00000000), ref: 01063B71
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 0000000A.00000002.2668757884.0000000001001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 01000000, based on PE: true
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668728494.0000000001000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668837967.000000000106F000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668875659.0000000001072000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668905907.0000000001076000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_1000000_certutil.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Local$Free$wcslen$AllocClose$CertCertificateContextPropertyStringwcscpy
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 3426514090-0
                                                                                                                                                                                                      • Opcode ID: d6ac0a2004ab477fdd4c11b15c1f1cf83ff01af5178122e9054a5bdf9a7bbb55
                                                                                                                                                                                                      • Instruction ID: ac288ce0bdb1c10d8e3210937ea98eb7f4cac161cb542b1aaacd9d5e66cda1ed
                                                                                                                                                                                                      • Opcode Fuzzy Hash: d6ac0a2004ab477fdd4c11b15c1f1cf83ff01af5178122e9054a5bdf9a7bbb55
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 3F715A7190021AEFDF22DF98D9849EEBBFDFF48310B10401AFA99AA140D7759951CFA1
                                                                                                                                                                                                      Function 01061971 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 196COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • LocalFree.KERNEL32(-00000108,000000FF,RequestAttributes,00000000,00000000,00000000,00000000,00000000,?,?,-00000110,00000000,?,-00000110,-00000084,-00000104), ref: 010619ED
                                                                                                                                                                                                      • LocalFree.KERNEL32(000000FF,000000FF,RequestAttributes,00000000,00000000,00000000,00000000,00000000,?,?,-00000110,00000000,?,-00000110,-00000084,-00000104), ref: 010619FE
                                                                                                                                                                                                      • SetupFindNextLine.SETUPAPI(?,?), ref: 01061AA8
                                                                                                                                                                                                        • Part of subcall function 0104EE51: #205.CERTCLI(00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0104EED9), ref: 0104EE61
                                                                                                                                                                                                        • Part of subcall function 0104EE51: #206.CERTCLI(?,00000000,01006A58,00000000,00000000,00000000,00000001), ref: 0104EE99
                                                                                                                                                                                                        • Part of subcall function 0104EE51: #203.CERTCLI(000000FF,%u.%u.%u: %ws%ws%ws,00000000,00000000,00000000,00000000,?,00000000,01006A58,00000000,00000000,00000000,00000001), ref: 0104EEB4
                                                                                                                                                                                                      • LocalFree.KERNEL32(-00000108,0BD30191,80070006,80070006,?,-00000110,00000000,?,-00000110,-00000084,-00000104,-00000108,00000001,0000001B,-00000014,00000000), ref: 01061B4F
                                                                                                                                                                                                      • LocalFree.KERNEL32(-00000104,0BD30191,80070006,80070006,?,-00000110,00000000,?,-00000110,-00000084,-00000104,-00000108,00000001,0000001B,-00000014,00000000), ref: 01061B59
                                                                                                                                                                                                      • LocalFree.KERNEL32(00000002,0BD30191,80070006,80070006,?,-00000110,00000000,?,-00000110,-00000084,-00000104,-00000108,00000001,0000001B,-00000014,00000000), ref: 01061B63
                                                                                                                                                                                                      • LocalFree.KERNEL32(-00000014,0BD30191,80070006,80070006,?,-00000110,00000000,?,-00000110,-00000084,-00000104,-00000108,00000001,0000001B,-00000014,00000000), ref: 01061B6D
                                                                                                                                                                                                        • Part of subcall function 0105FE65: SetupFindFirstLineW.SETUPAPI(?,?,?,00000000,?,?,00000000,000000FF,?,00000000,00000000,00000000,00000000,00000000,?,?), ref: 0105FE8C
                                                                                                                                                                                                        • Part of subcall function 0105FE65: SetupGetLineCountW.SETUPAPI(?,?,?,00000000,000000FF,?,00000000,00000000,00000000,00000000,00000000,?,?,?,00000000), ref: 0105FEA5
                                                                                                                                                                                                        • Part of subcall function 0105FE65: SetupFindFirstLineW.SETUPAPI(?,?,Empty,00000000,?,00000000,000000FF,?,00000000,00000000,00000000,00000000,00000000,?,?), ref: 0105FEBB
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 0000000A.00000002.2668757884.0000000001001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 01000000, based on PE: true
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668728494.0000000001000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668837967.000000000106F000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668875659.0000000001072000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668905907.0000000001076000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_1000000_certutil.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: FreeLocal$LineSetup$Find$First$#203#205#206CountNext
                                                                                                                                                                                                      • String ID: 1.3.6.1.4.1.311.13.2.1$CertificateTemplate$RequestAttributes
                                                                                                                                                                                                      • API String ID: 3132961017-1909556752
                                                                                                                                                                                                      • Opcode ID: eca6ab9853847ca0fcf46ac3d8bcd2f0c941e7c51749fd0e334b086e4b5107e1
                                                                                                                                                                                                      • Instruction ID: b95b5e26671ffdf6d9fe7f11d3cfde9d916ba8ffce151d918ceaf80043475a68
                                                                                                                                                                                                      • Opcode Fuzzy Hash: eca6ab9853847ca0fcf46ac3d8bcd2f0c941e7c51749fd0e334b086e4b5107e1
                                                                                                                                                                                                      • Instruction Fuzzy Hash: BC612A75A00229FFDB21DF99CC80DEEBBBDEF84B40F14406AF681A6101D7749A41CBA1
                                                                                                                                                                                                      Function 0105C1B1 Relevance: 16.9, APIs: 11, Instructions: 354COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 0000000A.00000002.2668757884.0000000001001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 01000000, based on PE: true
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668728494.0000000001000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668837967.000000000106F000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668875659.0000000001072000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668905907.0000000001076000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_1000000_certutil.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: FreeTask$wcscat$wcscpy
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 949834427-0
                                                                                                                                                                                                      • Opcode ID: 116364c37779ecc553a1ba3b19ea025612b6ba661bd51b5852b3396018614125
                                                                                                                                                                                                      • Instruction ID: 09ede29ad0cf06cd9fc0ee5716b603a7e7835c3f393d04c5a42f785ec2a14f75
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 116364c37779ecc553a1ba3b19ea025612b6ba661bd51b5852b3396018614125
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 80E14C71901219EFEB64DFA4CD88AAEBBB5FF48310F5041D9E989A7250CB349E80CF50
                                                                                                                                                                                                      Function 0105D9AE Relevance: 15.9, APIs: 2, Strings: 7, Instructions: 113COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • IsValidSecurityDescriptor.ADVAPI32(?,00000000,00000000,00000000,?,?,?,?,?,?,?,0105E1D1,00000000,0000000F,00000000,00000000), ref: 0105DA34
                                                                                                                                                                                                      • GetSecurityDescriptorLength.ADVAPI32(?,?,?,?,?,?,?,?,0105E1D1,00000000,0000000F,00000000,00000000,00000000,?,00000000), ref: 0105DA3F
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 0000000A.00000002.2668757884.0000000001001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 01000000, based on PE: true
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668728494.0000000001000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668837967.000000000106F000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668875659.0000000001072000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668905907.0000000001076000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_1000000_certutil.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: DescriptorSecurity$LengthValid
                                                                                                                                                                                                      • String ID: NTSecurityDescriptor$authorityRevocationList$cACertificate$certificateRevocationList$certificationAuthority$objectClass$top
                                                                                                                                                                                                      • API String ID: 3472465454-344310349
                                                                                                                                                                                                      • Opcode ID: 988b184ef58229505e484aba6e2b198c34cc52d4e73a00e4e9ba9252e9000103
                                                                                                                                                                                                      • Instruction ID: d591dd57bbaac6860c00f680b6e42d268b849b0e01d040bd73ef267b6dbca4fd
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 988b184ef58229505e484aba6e2b198c34cc52d4e73a00e4e9ba9252e9000103
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 4251ABB590124D9FDB19CFA9D8808DEBBF4FF08354F14822AF959A3200E7759A48CF90
                                                                                                                                                                                                      Function 0106015E Relevance: 15.2, APIs: 4, Strings: 6, Instructions: 205COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                        • Part of subcall function 0105FB1E: LocalFree.KERNEL32(?,?,00000000,?,?,00000000,00000000,?), ref: 0105FCD0
                                                                                                                                                                                                        • Part of subcall function 0105FB1E: LocalFree.KERNEL32(00000000,?,00000000,?,?,00000000,00000000,?), ref: 0105FCDE
                                                                                                                                                                                                        • Part of subcall function 0105FB1E: LocalFree.KERNEL32(00000000,?,00000000,?,?,00000000,00000000,?), ref: 0105FCEC
                                                                                                                                                                                                      • LocalFree.KERNEL32(?,039E0191,00000001,00000001,?,OID,?,Notice,?,URL,00000000,00000000,00000000,00000000,00000000,?), ref: 01060358
                                                                                                                                                                                                      • LocalFree.KERNEL32(00000001,039E0191,00000001,00000001,?,OID,?,Notice,?,URL,00000000,00000000,00000000,00000000,00000000,?), ref: 01060362
                                                                                                                                                                                                      • LocalFree.KERNEL32(?,039E0191,00000001,00000001,?,OID,?,Notice,?,URL,00000000,00000000,00000000,00000000,00000000,?), ref: 0106036C
                                                                                                                                                                                                      • LocalFree.KERNEL32(00000000,039E0191,00000001,00000001,?,OID,?,Notice,?,URL,00000000,00000000,00000000,00000000,00000000,?), ref: 01060376
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 0000000A.00000002.2668757884.0000000001001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 01000000, based on PE: true
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668728494.0000000001000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668837967.000000000106F000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668875659.0000000001072000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668905907.0000000001076000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_1000000_certutil.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: FreeLocal
                                                                                                                                                                                                      • String ID: 1.3.6.1.5.5.7.2.1$1.3.6.1.5.5.7.2.2$Notice$OID$URL$_continue_
                                                                                                                                                                                                      • API String ID: 2826327444-425301210
                                                                                                                                                                                                      • Opcode ID: 5b4b5f642ca643a3d528b4be757ec46e071f5f76f6e07168c9987520f3e0eb63
                                                                                                                                                                                                      • Instruction ID: 90290118294bc5a58d2c5aa5f7b14437ffd1d7475260facb62343870673dec11
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 5b4b5f642ca643a3d528b4be757ec46e071f5f76f6e07168c9987520f3e0eb63
                                                                                                                                                                                                      • Instruction Fuzzy Hash: A951A471A8122ABFEB61EA95CC80DFFBABCFF05B40F004065F684B6145D7B45A41CBA1
                                                                                                                                                                                                      Function 01064909 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 221stringCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • lstrlenW.KERNEL32(CertServerMapiInfo,00000000,?,?,0103302F,00000000,?,?,?), ref: 01064948
                                                                                                                                                                                                        • Part of subcall function 0106484F: lstrlenW.KERNEL32(?,00000000,CertServerMapiInfo,?,?,0106496C,?,00000004,?,?,?,0103302F,00000000,?,?,?), ref: 01064869
                                                                                                                                                                                                        • Part of subcall function 0106484F: LsaOpenPolicy.ADVAPI32(00000000,?,?,00000004), ref: 0106488D
                                                                                                                                                                                                      • LsaRetrievePrivateData.ADVAPI32(?,0103302F,?), ref: 01064989
                                                                                                                                                                                                      • LsaClose.ADVAPI32(?), ref: 01064996
                                                                                                                                                                                                      • LocalFree.KERNEL32(00000000,008101AF,80004003,00000000,?,?,0103302F,00000000,?,?,?), ref: 01064AFF
                                                                                                                                                                                                      • LocalFree.KERNEL32(00000000,008101AF,80004003,00000000,?,?,0103302F,00000000,?,?,?), ref: 01064B18
                                                                                                                                                                                                      • LocalFree.KERNEL32(00000000,008101AF,80004003,00000000,?,?,0103302F,00000000,?,?,?), ref: 01064B34
                                                                                                                                                                                                      • LsaFreeMemory.ADVAPI32(?), ref: 01064B59
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 0000000A.00000002.2668757884.0000000001001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 01000000, based on PE: true
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668728494.0000000001000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668837967.000000000106F000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668875659.0000000001072000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668905907.0000000001076000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_1000000_certutil.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Free$Local$lstrlen$CloseDataMemoryOpenPolicyPrivateRetrieve
                                                                                                                                                                                                      • String ID: CertServerMapiInfo
                                                                                                                                                                                                      • API String ID: 1670096568-1372593450
                                                                                                                                                                                                      • Opcode ID: 6a0dd9a22b6af67b256ae041cfe24e2020cf33479aaa2a0eefc239c2251e49db
                                                                                                                                                                                                      • Instruction ID: 252967651a494fd29b5042aee93e942988792e93c74f30862a4c7271fd26adbf
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 6a0dd9a22b6af67b256ae041cfe24e2020cf33479aaa2a0eefc239c2251e49db
                                                                                                                                                                                                      • Instruction Fuzzy Hash: C9716F7190021ABFEF61DFA9C880AEE7BEDFF04340F14416AE995E7150D7749941CBA4
                                                                                                                                                                                                      Function 01060996 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 195COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                        • Part of subcall function 0105FE65: SetupFindFirstLineW.SETUPAPI(?,?,?,00000000,?,?,00000000,000000FF,?,00000000,00000000,00000000,00000000,00000000,?,?), ref: 0105FE8C
                                                                                                                                                                                                        • Part of subcall function 0105FE65: SetupGetLineCountW.SETUPAPI(?,?,?,00000000,000000FF,?,00000000,00000000,00000000,00000000,00000000,?,?,?,00000000), ref: 0105FEA5
                                                                                                                                                                                                        • Part of subcall function 0105FE65: SetupFindFirstLineW.SETUPAPI(?,?,Empty,00000000,?,00000000,000000FF,?,00000000,00000000,00000000,00000000,00000000,?,?), ref: 0105FEBB
                                                                                                                                                                                                      • SetupGetFieldCount.SETUPAPI(-00000108), ref: 01060A1B
                                                                                                                                                                                                      • LocalFree.KERNEL32(00000000,00000191,00000647,00000000,000003B0,00000000,00000000,00000000,00000001,00000010,00000000,00000000,00000002,-00000008,-0000000C,-00000010), ref: 01060B8E
                                                                                                                                                                                                      • LocalFree.KERNEL32(00000000,00000191,00000647,00000000,000003B0,00000000,00000000,00000000,00000001,00000010,00000000,00000000,00000002,-00000008,-0000000C,-00000010), ref: 01060B9D
                                                                                                                                                                                                        • Part of subcall function 0105EB2A: EnterCriticalSection.KERNEL32(01075074,?,00000000,?), ref: 0105EB92
                                                                                                                                                                                                        • Part of subcall function 0105EB2A: fprintf.MSVCRT ref: 0105EBBF
                                                                                                                                                                                                        • Part of subcall function 0105EB2A: fprintf.MSVCRT ref: 0105EBD4
                                                                                                                                                                                                        • Part of subcall function 0105EB2A: fprintf.MSVCRT ref: 0105EBF1
                                                                                                                                                                                                        • Part of subcall function 0105EB2A: fprintf.MSVCRT ref: 0105EC10
                                                                                                                                                                                                        • Part of subcall function 0105EB2A: fprintf.MSVCRT ref: 0105EC38
                                                                                                                                                                                                        • Part of subcall function 0105EB2A: #207.CERTCLI(00000000,00000001), ref: 0105EC48
                                                                                                                                                                                                        • Part of subcall function 0105EB2A: #208.CERTCLI(?,00000000,00000000,00000001), ref: 0105EC5B
                                                                                                                                                                                                        • Part of subcall function 0104EE51: #205.CERTCLI(00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0104EED9), ref: 0104EE61
                                                                                                                                                                                                        • Part of subcall function 0104EE51: #206.CERTCLI(?,00000000,01006A58,00000000,00000000,00000000,00000001), ref: 0104EE99
                                                                                                                                                                                                        • Part of subcall function 0104EE51: #203.CERTCLI(000000FF,%u.%u.%u: %ws%ws%ws,00000000,00000000,00000000,00000000,?,00000000,01006A58,00000000,00000000,00000000,00000001), ref: 0104EEB4
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 0000000A.00000002.2668757884.0000000001001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 01000000, based on PE: true
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668728494.0000000001000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668837967.000000000106F000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668875659.0000000001072000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668905907.0000000001076000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_1000000_certutil.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: fprintf$Setup$Line$CountFindFirstFreeLocal$#203#205#206#207#208CriticalEnterFieldSection
                                                                                                                                                                                                      • String ID: 2.5.29.32$Policies$PolicyStatementExtension
                                                                                                                                                                                                      • API String ID: 3301405227-3236618128
                                                                                                                                                                                                      • Opcode ID: 9c19169136b71c8e6a20fef26cd3827c59ad4a82438436c6c5be7864e9f626f3
                                                                                                                                                                                                      • Instruction ID: ee974523c22248f7bab208f58ea9b450712e0d7fc98b6368c832286e719cffd1
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 9c19169136b71c8e6a20fef26cd3827c59ad4a82438436c6c5be7864e9f626f3
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 97519231A80219BBEB619F95CC85FEFBBBDEF04754F008164FA84AA055D7B59A40C7A0
                                                                                                                                                                                                      Function 0104F9B4 Relevance: 13.8, APIs: 11, Instructions: 87memoryCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • wcslen.MSVCRT ref: 0104F9D0
                                                                                                                                                                                                      • wcslen.MSVCRT ref: 0104F9DF
                                                                                                                                                                                                      • wcslen.MSVCRT ref: 0104F9E7
                                                                                                                                                                                                      • LocalAlloc.KERNEL32(00000000,00000002,0104FA8F,?,00000000,0000000F,0000000F,0105E355,?,01001FC0,00000000,?,00000000,?,00000000,?), ref: 0104F9FA
                                                                                                                                                                                                      • wcscat.MSVCRT ref: 0104FA32
                                                                                                                                                                                                      • wcscat.MSVCRT ref: 0104FA38
                                                                                                                                                                                                      • wcscat.MSVCRT ref: 0104FA41
                                                                                                                                                                                                      • wcscat.MSVCRT ref: 0104FA4B
                                                                                                                                                                                                      • wcscat.MSVCRT ref: 0104FA58
                                                                                                                                                                                                      • wcscat.MSVCRT ref: 0104FA5D
                                                                                                                                                                                                      • LocalFree.KERNEL32(00000000,00000000,00000000,00000000,?,?,?), ref: 0104FA69
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 0000000A.00000002.2668757884.0000000001001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 01000000, based on PE: true
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668728494.0000000001000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668837967.000000000106F000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668875659.0000000001072000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668905907.0000000001076000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_1000000_certutil.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: wcscat$wcslen$Local$AllocFree
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 2167083909-0
                                                                                                                                                                                                      • Opcode ID: 6283012d5868252811c27d525b2df7fa6507d9e0938009e99b29f9c397986b2b
                                                                                                                                                                                                      • Instruction ID: 77cc329610b0b0f9ac45cab8ca2682fd98a4951273ac119ee290d2ccf240c675
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 6283012d5868252811c27d525b2df7fa6507d9e0938009e99b29f9c397986b2b
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 542160B620430AABEF21AF6DDC84E6A7BE8EF44314F154829FD85D6241DB75D8608B60
                                                                                                                                                                                                      Function 01061182 Relevance: 12.3, APIs: 7, Strings: 1, Instructions: 257memoryCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • LocalAlloc.KERNEL32(00000040,00000000,000000FF,?,000000FF,?,000000FF,?,000000FF,00000000,00000000,?,00000000,?,00000000,Template), ref: 0106128F
                                                                                                                                                                                                        • Part of subcall function 0105FE65: SetupFindFirstLineW.SETUPAPI(?,?,?,00000000,?,?,00000000,000000FF,?,00000000,00000000,00000000,00000000,00000000,?,?), ref: 0105FE8C
                                                                                                                                                                                                        • Part of subcall function 0105FE65: SetupGetLineCountW.SETUPAPI(?,?,?,00000000,000000FF,?,00000000,00000000,00000000,00000000,00000000,?,?,?,00000000), ref: 0105FEA5
                                                                                                                                                                                                        • Part of subcall function 0105FE65: SetupFindFirstLineW.SETUPAPI(?,?,Empty,00000000,?,00000000,000000FF,?,00000000,00000000,00000000,00000000,00000000,?,?), ref: 0105FEBB
                                                                                                                                                                                                      • wcslen.MSVCRT ref: 010612FB
                                                                                                                                                                                                      • LocalFree.KERNEL32(?,091C0191,80070006,80070006,00000000,Template,00000000,?,?,000000FF,?), ref: 0106142A
                                                                                                                                                                                                      • LocalFree.KERNEL32(?,091C0191,80070006,80070006,00000000,Template,00000000,?,?,000000FF,?), ref: 01061435
                                                                                                                                                                                                        • Part of subcall function 0105FDB2: SetupFindNextLine.SETUPAPI(00000000,00000000), ref: 0105FDC9
                                                                                                                                                                                                        • Part of subcall function 0105FDB2: LocalFree.KERNEL32(00000000,?,?,01060043,00000000,000000FF,00000000,?,00000000,00000000,00000000,00000000,?,00000000,000000FF,?), ref: 0105FDDB
                                                                                                                                                                                                        • Part of subcall function 0105FDB2: SetupFindNextLine.SETUPAPI(00000000,00000000), ref: 0105FE09
                                                                                                                                                                                                        • Part of subcall function 0105FDB2: LocalFree.KERNEL32(00000000,02A40191,00000000,00000000,?,029F0191,00000000,00000000,?,?,01060043,00000000,000000FF,00000000,?,00000000), ref: 0105FE56
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 0000000A.00000002.2668757884.0000000001001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 01000000, based on PE: true
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668728494.0000000001000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668837967.000000000106F000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668875659.0000000001072000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668905907.0000000001076000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_1000000_certutil.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: LineLocalSetup$FindFree$FirstNext$AllocCountwcslen
                                                                                                                                                                                                      • String ID: Template
                                                                                                                                                                                                      • API String ID: 1485435963-1846967765
                                                                                                                                                                                                      • Opcode ID: 1d8bc990083c67d6b567214b4b6c4600e965300e8bade83f89a962d69f8fd7b0
                                                                                                                                                                                                      • Instruction ID: f78051c5ef0e019907858ad514b52d9020e4467c5841e402179f88dfff9a0e5a
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 1d8bc990083c67d6b567214b4b6c4600e965300e8bade83f89a962d69f8fd7b0
                                                                                                                                                                                                      • Instruction Fuzzy Hash: D781AF7290022BFBDF319FA98C84DEF7AADEF84794F048065FA86A7140D7719D518B90
                                                                                                                                                                                                      Function 01050122 Relevance: 11.3, APIs: 9, Instructions: 69memoryCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 0000000A.00000002.2668757884.0000000001001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 01000000, based on PE: true
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668728494.0000000001000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668837967.000000000106F000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668875659.0000000001072000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668905907.0000000001076000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_1000000_certutil.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: wcslen$wcscat$AllocLocalwcscpy
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 50633733-0
                                                                                                                                                                                                      • Opcode ID: 92a6fa96a99254162b3126fee2f7b1443c1e09e2cbce83c9da83a347f0dc52aa
                                                                                                                                                                                                      • Instruction ID: 2152fcf66e56467ab1ddb0a0ddb61a33e7715aa42930d15b3f8bc98b06fcc943
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 92a6fa96a99254162b3126fee2f7b1443c1e09e2cbce83c9da83a347f0dc52aa
                                                                                                                                                                                                      • Instruction Fuzzy Hash: DC11B633504219ABEB225F58DC45ABF7BF5FF44361F10402BFE4496144DB75A4118BD5
                                                                                                                                                                                                      Function 010201A8 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 166encryptionCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • CertFindExtension.CRYPT32(2.5.29.37,?,?), ref: 010201D5
                                                                                                                                                                                                      • CertFindExtension.CRYPT32(1.3.6.1.4.1.311.21.10,?,?), ref: 0102028D
                                                                                                                                                                                                      • LocalFree.KERNEL32(00000000), ref: 01020342
                                                                                                                                                                                                      • LocalFree.KERNEL32(00000000), ref: 0102034D
                                                                                                                                                                                                        • Part of subcall function 0106765A: CryptDecodeObjectEx.CRYPT32(00000000,0000000C,010033D0,?,00008000,0000000C,?,?), ref: 0106769A
                                                                                                                                                                                                        • Part of subcall function 0106765A: SetLastError.KERNEL32(8007000D), ref: 010676AE
                                                                                                                                                                                                        • Part of subcall function 01066C28: GetLastError.KERNEL32(0104F3D4), ref: 01066C28
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 0000000A.00000002.2668757884.0000000001001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 01000000, based on PE: true
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668728494.0000000001000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668837967.000000000106F000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668875659.0000000001072000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668905907.0000000001076000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_1000000_certutil.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CertErrorExtensionFindFreeLastLocal$CryptDecodeObject
                                                                                                                                                                                                      • String ID: 1.3.6.1.4.1.311.21.10$2.5.29.37
                                                                                                                                                                                                      • API String ID: 24875122-86323330
                                                                                                                                                                                                      • Opcode ID: 8b5efe7720eb9ae03a142b573e467a4f754caf389525e49f7a7078718180f581
                                                                                                                                                                                                      • Instruction ID: 7643a32dfcee8ca170d7c0b6bfe87279e1f6b000753a2fe0a033ec4e8149caa4
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 8b5efe7720eb9ae03a142b573e467a4f754caf389525e49f7a7078718180f581
                                                                                                                                                                                                      • Instruction Fuzzy Hash: BC51C535A00328AFEB119FA8C890EAEBBF5EF0A310F1581D5F9D59B265C3719944CB50
                                                                                                                                                                                                      Function 01053937 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 73encryptionCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • #203.CERTCLI(000000FF, %hsCRL %u:,Delta ,00000000,?,00000000,00000000, Element.dwErrorStatus,01072D10,?, Element.dwInfoStatus), ref: 01053971
                                                                                                                                                                                                      • CertGetCRLContextProperty.CRYPT32(?,00000003,?,?), ref: 01053995
                                                                                                                                                                                                      • #203.CERTCLI(000000FF,0100E33C,?,00000000,00000000, Element.dwErrorStatus,01072D10,?, Element.dwInfoStatus), ref: 010539B4
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 0000000A.00000002.2668757884.0000000001001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 01000000, based on PE: true
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668728494.0000000001000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668837967.000000000106F000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668875659.0000000001072000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668905907.0000000001076000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_1000000_certutil.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: #203$CertContextProperty
                                                                                                                                                                                                      • String ID: %hsCRL %u:$ Issuer$Delta
                                                                                                                                                                                                      • API String ID: 3281124036-2991002003
                                                                                                                                                                                                      • Opcode ID: 9b4def7c13f90511f073e4fd172efb3415edc05e0e8a9d0eccb87ab36b650872
                                                                                                                                                                                                      • Instruction ID: 641e444bdc6430ecf212caf6b3ebb044f96327e329d4cff32df1e9f80a5ad595
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 9b4def7c13f90511f073e4fd172efb3415edc05e0e8a9d0eccb87ab36b650872
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 67118772640616BBBB62ABA8CC41EEF77ACFF14760F144115FDD4EA180DA71D90186A1
                                                                                                                                                                                                      Function 0103C901 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 60COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • CAGetCAExpiration.CERTCLI(?,?,?), ref: 0103C94B
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 0000000A.00000002.2668757884.0000000001001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 01000000, based on PE: true
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668728494.0000000001000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668837967.000000000106F000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668875659.0000000001072000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668905907.0000000001076000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_1000000_certutil.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Expiration
                                                                                                                                                                                                      • String ID: CAGetCAExpiration$Days$Months$Weeks$Years
                                                                                                                                                                                                      • API String ID: 1804620701-1525243900
                                                                                                                                                                                                      • Opcode ID: 933017df7d22f160c51f07dbcbaf5c0f890d6b41967337281d16d483a36abe8a
                                                                                                                                                                                                      • Instruction ID: 7656a1b64de33dfcfdef3ea7408aba17981a4550d24a3fad1c646aa75d17f55c
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 933017df7d22f160c51f07dbcbaf5c0f890d6b41967337281d16d483a36abe8a
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 1D11E6B1C00228AAEB02AF95D9889DEBFB8EF49310F514156E98077280CB7586818BE5
                                                                                                                                                                                                      Function 0102B124 Relevance: 9.2, APIs: 2, Strings: 4, Instructions: 247COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • LocalFree.KERNEL32(00000000,S/MIME,00000000,Full Certificate History,?,?), ref: 0102B260
                                                                                                                                                                                                        • Part of subcall function 010386A0: CertCreateCertificateContext.CRYPT32(00000001,00000000,?), ref: 010386BE
                                                                                                                                                                                                        • Part of subcall function 010386A0: LocalFree.KERNEL32(?), ref: 01038894
                                                                                                                                                                                                        • Part of subcall function 010386A0: CryptDestroyKey.ADVAPI32(00000002), ref: 010388A2
                                                                                                                                                                                                        • Part of subcall function 010386A0: CryptReleaseContext.ADVAPI32(00000002,00000000), ref: 010388B1
                                                                                                                                                                                                      • LocalFree.KERNEL32(00000000,00000000,Full Certificate History,?,?), ref: 0102B3E9
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 0000000A.00000002.2668757884.0000000001001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 01000000, based on PE: true
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668728494.0000000001000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668837967.000000000106F000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668875659.0000000001072000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668905907.0000000001076000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_1000000_certutil.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: FreeLocal$ContextCrypt$CertCertificateCreateDestroyRelease
                                                                                                                                                                                                      • String ID: dwKeySpec = %u$: %x$Full Certificate History$S/MIME
                                                                                                                                                                                                      • API String ID: 3037673667-4169409611
                                                                                                                                                                                                      • Opcode ID: ce8b3aa0ae612e351a780d47c0e5c76d8e40fc836de2c6e1828dde4be709eeb9
                                                                                                                                                                                                      • Instruction ID: 7c95faa6b7d948a1a7cc64f10861ba492791db8821d769d3a23b24f1711002a1
                                                                                                                                                                                                      • Opcode Fuzzy Hash: ce8b3aa0ae612e351a780d47c0e5c76d8e40fc836de2c6e1828dde4be709eeb9
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 0A917E7190021AEFEF51DF98CC819EEBBB5FF58305F648196F980B6190DB759980CB21
                                                                                                                                                                                                      Function 01031144 Relevance: 9.1, APIs: 6, Instructions: 145COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                        • Part of subcall function 0105BCCC: wcschr.MSVCRT ref: 0105BCFA
                                                                                                                                                                                                        • Part of subcall function 0105BCCC: wcslen.MSVCRT ref: 0105BD0D
                                                                                                                                                                                                        • Part of subcall function 0105BCCC: LocalAlloc.KERNEL32(00000000,?,0101CC84,?,?), ref: 0105BD63
                                                                                                                                                                                                        • Part of subcall function 0105BCCC: LocalFree.KERNEL32(00000000), ref: 0105BDAF
                                                                                                                                                                                                      • wcschr.MSVCRT ref: 01031186
                                                                                                                                                                                                      • wcslen.MSVCRT ref: 010311BB
                                                                                                                                                                                                        • Part of subcall function 01056431: LocalFree.KERNEL32(00000000), ref: 01056827
                                                                                                                                                                                                        • Part of subcall function 01056431: LocalFree.KERNEL32(?), ref: 0105684A
                                                                                                                                                                                                        • Part of subcall function 01056431: GetModuleHandleW.KERNEL32(ntdll.dll,010105C8,00000830,01022610,%ws,00000000,?,?,?,00000000,00000000,?,00000000,00000000,?), ref: 01056499
                                                                                                                                                                                                        • Part of subcall function 01056431: GetProcAddress.KERNEL32(00000000,_vsnwprintf), ref: 010564A5
                                                                                                                                                                                                        • Part of subcall function 01056431: GetModuleHandleW.KERNEL32(msvcrt.dll,?,00000000,00000000,?), ref: 010564BE
                                                                                                                                                                                                        • Part of subcall function 01056431: GetProcAddress.KERNEL32(00000000,_vsnwprintf), ref: 010564C6
                                                                                                                                                                                                        • Part of subcall function 01056431: GetStdHandle.KERNEL32(000000F5,010105C8,00000830,01022610,%ws,00000000,?,?,?,00000000,00000000,?,00000000,00000000,?), ref: 010564D3
                                                                                                                                                                                                        • Part of subcall function 01056431: LocalFree.KERNEL32(?,?,?,?,?,00000000,00000000,?), ref: 01056551
                                                                                                                                                                                                        • Part of subcall function 01056431: LocalAlloc.KERNEL32(00000000,?,?,?,?,?,00000000,00000000,?), ref: 01056565
                                                                                                                                                                                                        • Part of subcall function 01056431: GetFileType.KERNEL32(?,?,?,?,?,00000000,00000000,?), ref: 010565C2
                                                                                                                                                                                                        • Part of subcall function 01056431: WriteConsoleW.KERNEL32(?,?,00000000,?,00000000), ref: 01056639
                                                                                                                                                                                                        • Part of subcall function 0103093E: swprintf.MSVCRT(?,\\%ws\ROOT,?,00000000), ref: 01030969
                                                                                                                                                                                                        • Part of subcall function 0103093E: CertOpenStore.CRYPT32(0000000A,00010001,00000000,00098000,?), ref: 01030984
                                                                                                                                                                                                      • LocalFree.KERNEL32(?,04270135,80070057,0000085C,?,?,?), ref: 010312C7
                                                                                                                                                                                                        • Part of subcall function 01056431: vfwprintf.MSVCRT ref: 010567D1
                                                                                                                                                                                                      • LocalFree.KERNEL32(?,04270135,80070057,0000085C,?,?,?), ref: 010312D5
                                                                                                                                                                                                      • LocalFree.KERNEL32(?,04270135,80070057,0000085C,?,?,?), ref: 010312E3
                                                                                                                                                                                                      • LocalFree.KERNEL32(?,04270135,80070057,0000085C,?,?,?), ref: 010312F1
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 0000000A.00000002.2668757884.0000000001001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 01000000, based on PE: true
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668728494.0000000001000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668837967.000000000106F000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668875659.0000000001072000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668905907.0000000001076000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_1000000_certutil.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Local$Free$Handle$AddressAllocModuleProcwcschrwcslen$CertConsoleFileOpenStoreTypeWriteswprintfvfwprintf
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 2798616260-0
                                                                                                                                                                                                      • Opcode ID: 5595c9bb1f94803cad97ea7154fa30e5ebe5ca2f9148160a226853daad5e8dea
                                                                                                                                                                                                      • Instruction ID: 63577f3be6b271f64df7611d005938c96681e3d5ad7be955ada10fd91c0cf6f8
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 5595c9bb1f94803cad97ea7154fa30e5ebe5ca2f9148160a226853daad5e8dea
                                                                                                                                                                                                      • Instruction Fuzzy Hash: B641A272900116BBEF316FE5DC848EEBFBDAF58710F5085A9EAD0B2150CB360950CA50
                                                                                                                                                                                                      Function 01048931 Relevance: 9.1, APIs: 6, Instructions: 128encryptionmemoryCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                        • Part of subcall function 01063C74: LocalFree.KERNEL32(00000000,00000000,?,00000000,00000000,00000001,00000000,00000001,00000000,?,00000001,00000000,00000000,?), ref: 01063CD6
                                                                                                                                                                                                      • LocalAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00000000,00000000,?,00000000,00000000,?,?,?,?,D:AI(A;OICI;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;EA)(A;OICI;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;DA)(A;OICI;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;CA)(A;OIC), ref: 01048979
                                                                                                                                                                                                      • LocalFree.KERNEL32(00000000), ref: 01048A50
                                                                                                                                                                                                      • CertFreeCTLContext.CRYPT32(?), ref: 01048A5E
                                                                                                                                                                                                      • CertCloseStore.CRYPT32(?,00000002), ref: 01048A6E
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 0000000A.00000002.2668757884.0000000001001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 01000000, based on PE: true
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668728494.0000000001000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668837967.000000000106F000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668875659.0000000001072000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668905907.0000000001076000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_1000000_certutil.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: FreeLocal$Cert$AllocCloseContextStore
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 1764559594-0
                                                                                                                                                                                                      • Opcode ID: 6ca2e1048c81823fd377633480406bb676f9750238f8145a97a8a286d78752a5
                                                                                                                                                                                                      • Instruction ID: d227965c209f37008d17584b0a20ae23a69fdcc4b2808b8db35db5d7f2295ad9
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 6ca2e1048c81823fd377633480406bb676f9750238f8145a97a8a286d78752a5
                                                                                                                                                                                                      • Instruction Fuzzy Hash: D641D6B1900208FFEB21AFE8C8C0DAEBBB9FB41350F14897AE691A7100C3719D51CB10
                                                                                                                                                                                                      Function 0104A1A1 Relevance: 9.0, APIs: 6, Instructions: 50COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • LocalFree.KERNEL32(?,00000000,00000104,0104A263,000000CA,000010C6,00000000,00000102,00000000,00000000,00000000,00000000,O:BAG:BAD:AI(A;OICI;0x00000001;;;BA)(A;OICI;0x00000002;;;BA)(A;OICI;0x00000001;;;DA)(A;OICI;0x00000002;;;DA)(A;OICI;0x00000001;;;E,?,00000000,00000000), ref: 0104A144
                                                                                                                                                                                                      • CloseHandle.KERNEL32(?,00000000,00000104,0104A263,000000CA,000010C6,00000000,00000102,00000000,00000000,00000000,00000000,O:BAG:BAD:AI(A;OICI;0x00000001;;;BA)(A;OICI;0x00000002;;;BA)(A;OICI;0x00000001;;;DA)(A;OICI;0x00000002;;;DA)(A;OICI;0x00000001;;;E,?,00000000,00000000), ref: 0104A154
                                                                                                                                                                                                      • DeleteCriticalSection.KERNEL32(?,00000000,00000104,0104A263,000000CA,000010C6,00000000,00000102,00000000,00000000,00000000,00000000,O:BAG:BAD:AI(A;OICI;0x00000001;;;BA)(A;OICI;0x00000002;;;BA)(A;OICI;0x00000001;;;DA)(A;OICI;0x00000002;;;DA)(A;OICI;0x00000001;;;E,?,00000000,00000000), ref: 0104A166
                                                                                                                                                                                                      • LocalFree.KERNEL32(?,00000000,00000000,0104A263,000000CA,000010C6,00000000,00000102,00000000,00000000,00000000,00000000,O:BAG:BAD:AI(A;OICI;0x00000001;;;BA)(A;OICI;0x00000002;;;BA)(A;OICI;0x00000001;;;DA)(A;OICI;0x00000002;;;DA)(A;OICI;0x00000001;;;E,?,00000000,00000000), ref: 0104A1B3
                                                                                                                                                                                                      • LocalFree.KERNEL32(?,00000000,00000000,0104A263,000000CA,000010C6,00000000,00000102,00000000,00000000,00000000,00000000,O:BAG:BAD:AI(A;OICI;0x00000001;;;BA)(A;OICI;0x00000002;;;BA)(A;OICI;0x00000001;;;DA)(A;OICI;0x00000002;;;DA)(A;OICI;0x00000001;;;E,?,00000000,00000000), ref: 0104A1BD
                                                                                                                                                                                                      • LocalFree.KERNEL32(?,00000000,00000000,0104A263,000000CA,000010C6,00000000,00000102,00000000,00000000,00000000,00000000,O:BAG:BAD:AI(A;OICI;0x00000001;;;BA)(A;OICI;0x00000002;;;BA)(A;OICI;0x00000001;;;DA)(A;OICI;0x00000002;;;DA)(A;OICI;0x00000001;;;E,?,00000000,00000000), ref: 0104A1C7
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 0000000A.00000002.2668757884.0000000001001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 01000000, based on PE: true
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668728494.0000000001000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668837967.000000000106F000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668875659.0000000001072000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668905907.0000000001076000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_1000000_certutil.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: FreeLocal$CloseCriticalDeleteHandleSection
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 1006400846-0
                                                                                                                                                                                                      • Opcode ID: 1d514869b5c1416a9c7f068969f44ed89c12894646c73917e06afa388d38ba1a
                                                                                                                                                                                                      • Instruction ID: cec45745df8bf851e5a55a7cb69a086bab2d07b0b279bd44bb14f51a584a95c9
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 1d514869b5c1416a9c7f068969f44ed89c12894646c73917e06afa388d38ba1a
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 400116B6B417509FE7309FAD99C4857FBECAE48290354897EE6C7C3A14D774E8008B60
                                                                                                                                                                                                      Function 01033167 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 161encryptionCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • iswdigit.MSVCRT ref: 01033191
                                                                                                                                                                                                        • Part of subcall function 010525B7: LocalFree.KERNEL32(00000000,00000000,00000000,?,000000FF,?,?,?,010159AB,?), ref: 01052610
                                                                                                                                                                                                        • Part of subcall function 010674A7: GetACP.KERNEL32(?,?,010525CE,00000000,?,000000FF,?,?,?,010159AB,?), ref: 010674AF
                                                                                                                                                                                                      • CertFreeCTLContext.CRYPT32(?,?,?,000000FF,00000000,00000346,-00000347,00000000,00000000,00000000,00000000,00000000,?,?), ref: 0103331D
                                                                                                                                                                                                      • LocalFree.KERNEL32(?,00000000,00000346,-00000347,00000000,00000000,00000000,00000000,00000000,?,?), ref: 0103332B
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 0000000A.00000002.2668757884.0000000001001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 01000000, based on PE: true
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668728494.0000000001000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668837967.000000000106F000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668875659.0000000001072000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668905907.0000000001076000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_1000000_certutil.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Free$Local$CertContextiswdigit
                                                                                                                                                                                                      • String ID: ERA$KRA
                                                                                                                                                                                                      • API String ID: 2278909772-1967343933
                                                                                                                                                                                                      • Opcode ID: c5ae254d12cf1c564051e755850f3266f163dcc44d238c38e91aff5eee46b320
                                                                                                                                                                                                      • Instruction ID: fe24dcac1f1694f5df64117d65a8ef7f72b64468b0021fff35118f5264134533
                                                                                                                                                                                                      • Opcode Fuzzy Hash: c5ae254d12cf1c564051e755850f3266f163dcc44d238c38e91aff5eee46b320
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 2C41D132900116FBEB31AEA98CC5EEF7AFDBB40250F008569F591BE180C7758A40D750
                                                                                                                                                                                                      Function 0101A90E Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 137COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                        • Part of subcall function 0101A710: LocalAlloc.KERNEL32(00000000,00001000), ref: 0101A775
                                                                                                                                                                                                        • Part of subcall function 0101A710: LocalFree.KERNEL32(00000000,020A0140,00000000), ref: 0101A7AD
                                                                                                                                                                                                        • Part of subcall function 0101A710: SetLastError.KERNEL32(00000000), ref: 0101A7BC
                                                                                                                                                                                                      • DeleteUrlCacheEntryW.WININET(?), ref: 0101A9E1
                                                                                                                                                                                                      • LocalFree.KERNEL32(?), ref: 0101AA01
                                                                                                                                                                                                      • FindCloseUrlCache.WININET(?), ref: 0101AA75
                                                                                                                                                                                                      • LocalFree.KERNEL32(?), ref: 0101AAA0
                                                                                                                                                                                                        • Part of subcall function 01066C28: GetLastError.KERNEL32(0104F3D4), ref: 01066C28
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 0000000A.00000002.2668757884.0000000001001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 01000000, based on PE: true
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668728494.0000000001000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668837967.000000000106F000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668875659.0000000001072000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668905907.0000000001076000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_1000000_certutil.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Local$Free$CacheErrorLast$AllocCloseDeleteEntryFind
                                                                                                                                                                                                      • String ID: %ws
                                                                                                                                                                                                      • API String ID: 550329649-64044526
                                                                                                                                                                                                      • Opcode ID: ecced03f3ed83939f227e34abb2d75cb9baeacf82bf2e1a4a2f30804c59f8507
                                                                                                                                                                                                      • Instruction ID: 7ec3578f4210a7f45fbd630ccbca3741d50835aa8e4f544e69ceb797d1835971
                                                                                                                                                                                                      • Opcode Fuzzy Hash: ecced03f3ed83939f227e34abb2d75cb9baeacf82bf2e1a4a2f30804c59f8507
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 2A41E932B01256EFBB217FA59D819EEBBB9BB10211B50446AE9C6A3108DB3959408721
                                                                                                                                                                                                      Function 0105F94D Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 101COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 0000000A.00000002.2668757884.0000000001001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 01000000, based on PE: true
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668728494.0000000001000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668837967.000000000106F000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668875659.0000000001072000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668905907.0000000001076000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_1000000_certutil.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: wcschr$_wfopenfclosewcscspn
                                                                                                                                                                                                      • String ID: ;=
                                                                                                                                                                                                      • API String ID: 2281440366-2141602092
                                                                                                                                                                                                      • Opcode ID: 0c7dfcc4c9d1c06a0214a08df96c676f5c122e4a2ab7627f9aa7101139b404dc
                                                                                                                                                                                                      • Instruction ID: 250fedeab531d007f29c32973d19c68554e5cbe59178566944e9a3202e7f2a2b
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 0c7dfcc4c9d1c06a0214a08df96c676f5c122e4a2ab7627f9aa7101139b404dc
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 1A31D9B2D4061B9AEFB26B68DC44BEF77A8FB00354F500465EE81A7041EBBD9441CB92
                                                                                                                                                                                                      Function 0103093E Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 97encryptionCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • swprintf.MSVCRT(?,\\%ws\ROOT,?,00000000), ref: 01030969
                                                                                                                                                                                                      • CertOpenStore.CRYPT32(0000000A,00010001,00000000,00098000,?), ref: 01030984
                                                                                                                                                                                                      • CertEnumCertificatesInStore.CRYPT32(00000000,00000000), ref: 01030A21
                                                                                                                                                                                                      • CertCloseStore.CRYPT32(00000000,00000000), ref: 01030A5E
                                                                                                                                                                                                        • Part of subcall function 01066C28: GetLastError.KERNEL32(0104F3D4), ref: 01066C28
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 0000000A.00000002.2668757884.0000000001001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 01000000, based on PE: true
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668728494.0000000001000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668837967.000000000106F000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668875659.0000000001072000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668905907.0000000001076000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_1000000_certutil.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CertStore$CertificatesCloseEnumErrorLastOpenswprintf
                                                                                                                                                                                                      • String ID: \\%ws\ROOT
                                                                                                                                                                                                      • API String ID: 4219799622-1038985235
                                                                                                                                                                                                      • Opcode ID: 342cec02d94dc05a45f675e84adbe4727f8d77f0284ab880ec2106becb0aa765
                                                                                                                                                                                                      • Instruction ID: 3ec99b01f719da3d19cc52f1b18848fc35b47733845f399387311c033a39240b
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 342cec02d94dc05a45f675e84adbe4727f8d77f0284ab880ec2106becb0aa765
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 2721E3B1A40212BBE3317B619C84EAF7B9CEF94B50F404929FEC4A2244DF66844586B6
                                                                                                                                                                                                      Function 0101593A Relevance: 7.6, APIs: 5, Instructions: 110memoryencryptionCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • LocalAlloc.KERNEL32(00000000,?), ref: 01015954
                                                                                                                                                                                                      • LocalFree.KERNEL32(00000000), ref: 01015A42
                                                                                                                                                                                                        • Part of subcall function 010674A7: GetACP.KERNEL32(?,?,010525CE,00000000,?,000000FF,?,?,?,010159AB,?), ref: 010674AF
                                                                                                                                                                                                      • CertFindExtension.CRYPT32(?,?,00000000), ref: 010159DB
                                                                                                                                                                                                      • memmove.MSVCRT(?,?,?), ref: 01015A05
                                                                                                                                                                                                      • LocalFree.KERNEL32(?), ref: 01015A14
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 0000000A.00000002.2668757884.0000000001001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 01000000, based on PE: true
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668728494.0000000001000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668837967.000000000106F000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668875659.0000000001072000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668905907.0000000001076000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_1000000_certutil.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Local$Free$AllocCertExtensionFindmemmove
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 530224598-0
                                                                                                                                                                                                      • Opcode ID: 0c04d462be23fd725f8c1d2d680b5c3fb397501ca5d770a79ce649c89829a8be
                                                                                                                                                                                                      • Instruction ID: b7173b70e8c088e29cf5d7f52a6094d9c3a5a37acc0082470b424f4b8a56665a
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 0c04d462be23fd725f8c1d2d680b5c3fb397501ca5d770a79ce649c89829a8be
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 5A31927620030A9FEB218F68DC84AAE37E9FB85255F044129FE41DB248D779D850CBA1
                                                                                                                                                                                                      Function 0101F94D Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 158COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • _stricmp.MSVCRT(?,?,00000001,0000000C,?,?,00000002,?,?), ref: 0101FA45
                                                                                                                                                                                                        • Part of subcall function 0106765A: CryptDecodeObjectEx.CRYPT32(00000000,0000000C,010033D0,?,00008000,0000000C,?,?), ref: 0106769A
                                                                                                                                                                                                        • Part of subcall function 0106765A: SetLastError.KERNEL32(8007000D), ref: 010676AE
                                                                                                                                                                                                      • LocalFree.KERNEL32(00000000), ref: 0101FACC
                                                                                                                                                                                                      • LocalFree.KERNEL32(00000000), ref: 0101FAD7
                                                                                                                                                                                                        • Part of subcall function 01066E30: wcslen.MSVCRT ref: 01066E35
                                                                                                                                                                                                        • Part of subcall function 01066E30: LocalAlloc.KERNEL32(00000000,00000002,?,0104E4AA,?,?), ref: 01066E42
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 0000000A.00000002.2668757884.0000000001001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 01000000, based on PE: true
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668728494.0000000001000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668837967.000000000106F000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668875659.0000000001072000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668905907.0000000001076000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_1000000_certutil.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Local$Free$AllocCryptDecodeErrorLastObject_stricmpwcslen
                                                                                                                                                                                                      • String ID: 2.5.29.17
                                                                                                                                                                                                      • API String ID: 499368630-3611228087
                                                                                                                                                                                                      • Opcode ID: 9c7d31813f43472b90bd991586ddaabdc5dc14b496d81d5a3c2c931d882f9e23
                                                                                                                                                                                                      • Instruction ID: da94dee0bdef4d456d5aac499b82d203e4b986eb9db6a6c4b0a8223335e04abc
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 9c7d31813f43472b90bd991586ddaabdc5dc14b496d81d5a3c2c931d882f9e23
                                                                                                                                                                                                      • Instruction Fuzzy Hash: ED51E372A0010BAFDB15DF98C890EAE7BB6FF04350F458199F9856B2A6D779DC04CB90
                                                                                                                                                                                                      Function 010329A5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • #206.CERTCLI(?,?,?,?,?,?,?), ref: 010329E1
                                                                                                                                                                                                      • #207.CERTCLI(?,?,?,?), ref: 010329FD
                                                                                                                                                                                                      • LocalFree.KERNEL32(00000000,?,00000000,?,?,?,?), ref: 01032A29
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 0000000A.00000002.2668757884.0000000001001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 01000000, based on PE: true
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668728494.0000000001000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668837967.000000000106F000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668875659.0000000001072000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668905907.0000000001076000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_1000000_certutil.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: #206#207FreeLocal
                                                                                                                                                                                                      • String ID: %ws -- %u (%d)
                                                                                                                                                                                                      • API String ID: 1195461207-203170206
                                                                                                                                                                                                      • Opcode ID: e8e490bf91775b04de425ee1d9f93272e91eda88253ce60fefd7b163908489da
                                                                                                                                                                                                      • Instruction ID: 4bb6e2542c0582bfb9894aa5cdb5e4ee0ff1e791e7cba72c5dd43c1447802053
                                                                                                                                                                                                      • Opcode Fuzzy Hash: e8e490bf91775b04de425ee1d9f93272e91eda88253ce60fefd7b163908489da
                                                                                                                                                                                                      • Instruction Fuzzy Hash: CD01DD76900116FBEB21BBA59C44CEF3B6DEF94610B00C115FD9566204DF36C911DB61
                                                                                                                                                                                                      Function 0105A144 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 48registryCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                        • Part of subcall function 01063EF2: RegCloseKey.ADVAPI32(?,092301B5,80070057,Config,?,00000006,Restore,?,00000007,Exit,?,00000004,Policy,?,00000006,010031E0), ref: 0106450B
                                                                                                                                                                                                        • Part of subcall function 01063EF2: RegCloseKey.ADVAPI32(?,092301B5,80070057,Config,?,00000006,Restore,?,00000007,Exit,?,00000004,Policy,?,00000006,010031E0), ref: 01064517
                                                                                                                                                                                                        • Part of subcall function 01063EF2: RegCloseKey.ADVAPI32(?,092301B5,80070057,Config,?,00000006,Restore,?,00000007,Exit,?,00000004,Policy,?,00000006,010031E0), ref: 01064521
                                                                                                                                                                                                        • Part of subcall function 01063EF2: RegCloseKey.ADVAPI32(?,092301B5,80070057,Config,?,00000006,Restore,?,00000007,Exit,?,00000004,Policy,?,00000006,010031E0), ref: 0106452B
                                                                                                                                                                                                        • Part of subcall function 01063EF2: LocalFree.KERNEL32(?,092301B5,80070057,Config,?,00000006,Restore,?,00000007,Exit,?,00000004,Policy,?,00000006,010031E0), ref: 0106453B
                                                                                                                                                                                                        • Part of subcall function 01063EF2: LocalFree.KERNEL32(?,092301B5,80070057,Config,?,00000006,Restore,?,00000007,Exit,?,00000004,Policy,?,00000006,010031E0), ref: 01064552
                                                                                                                                                                                                        • Part of subcall function 01063EF2: LocalFree.KERNEL32(?,092301B5,80070057,Config,?,00000006,Restore,?,00000007,Exit,?,00000004,Policy,?,00000006,010031E0), ref: 0106456D
                                                                                                                                                                                                      • RegDeleteKeyW.ADVAPI32(00000001,RestoreInProgress), ref: 0105A189
                                                                                                                                                                                                      • RegCloseKey.ADVAPI32(?), ref: 0105A1A8
                                                                                                                                                                                                      • LocalFree.KERNEL32(?), ref: 0105A1B6
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 0000000A.00000002.2668757884.0000000001001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 01000000, based on PE: true
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668728494.0000000001000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668837967.000000000106F000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668875659.0000000001072000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668905907.0000000001076000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_1000000_certutil.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Close$FreeLocal$Delete
                                                                                                                                                                                                      • String ID: RestoreInProgress
                                                                                                                                                                                                      • API String ID: 2792685562-2014597814
                                                                                                                                                                                                      • Opcode ID: bc28b2075ca69dbb6d43ec29140e21bea39b35f1ac912d4f15ca6e88fe787480
                                                                                                                                                                                                      • Instruction ID: 4326972adc50093c4934f1c3df71a79ea2fe42bc0dd513cd7495301d940e16c1
                                                                                                                                                                                                      • Opcode Fuzzy Hash: bc28b2075ca69dbb6d43ec29140e21bea39b35f1ac912d4f15ca6e88fe787480
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 6D017176A00218FBEB71AB59CC45CDFFEB9EF40790F104265F985A2014D3719A40D694
                                                                                                                                                                                                      Function 0106697D Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 24libraryloaderCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetModuleHandleW.KERNEL32(advapi32.dll,00000000,01065D8E,00000000,00000001,?,00000000,00000000,userCertificate,00000000,?,0105E0E0,D:AI(A;OICI;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;EA)(A;OICI;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;DA)(A;OICI;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;CA)(A;OIC,00000000,00000000,?), ref: 0106698E
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,ConvertStringSecurityDescriptorToSecurityDescriptorW), ref: 0106699E
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      • ConvertStringSecurityDescriptorToSecurityDescriptorW, xrefs: 01066998
                                                                                                                                                                                                      • advapi32.dll, xrefs: 01066989
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 0000000A.00000002.2668757884.0000000001001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 01000000, based on PE: true
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668728494.0000000001000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668837967.000000000106F000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668875659.0000000001072000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668905907.0000000001076000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_1000000_certutil.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: AddressHandleModuleProc
                                                                                                                                                                                                      • String ID: ConvertStringSecurityDescriptorToSecurityDescriptorW$advapi32.dll
                                                                                                                                                                                                      • API String ID: 1646373207-2232865446
                                                                                                                                                                                                      • Opcode ID: fe7dd6b5647744e46501a2638d7faa71836f0a71b60877935bb74bafc9d13336
                                                                                                                                                                                                      • Instruction ID: bde1e8a606287cd444b201f7d46af932d75703541b230b41369d20dcac05260a
                                                                                                                                                                                                      • Opcode Fuzzy Hash: fe7dd6b5647744e46501a2638d7faa71836f0a71b60877935bb74bafc9d13336
                                                                                                                                                                                                      • Instruction Fuzzy Hash: CCE012316043129FDB629FB9FD04A8A7AE8BB49B40B000518F9C0E6154D736C814D7B2
                                                                                                                                                                                                      Function 0104814C Relevance: 6.4, APIs: 5, Instructions: 151memoryCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • LocalAlloc.KERNEL32(00000040,?,00000000,?,?,-00000048,000000FF,?,-000000C0,00000000,000000FF,00000000,?,00000000,-00000048,?), ref: 0104821B
                                                                                                                                                                                                      • LocalFree.KERNEL32(?,00000000,000000FF,00000000,?,00000000,-00000048,?,?,-00000034,-00000038,-000000C0,-00000048,?,?,00000000), ref: 0104829F
                                                                                                                                                                                                      • LocalFree.KERNEL32(?,00000000,000000FF,00000000,?,00000000,-00000048,?,?,-00000034,-00000038,-000000C0,-00000048,?,?,00000000), ref: 010482B8
                                                                                                                                                                                                      • LocalFree.KERNEL32(-000000C0,00000000,000000FF,00000000,?,00000000,-00000048,?,?,-00000034,-00000038,-000000C0,-00000048,?,?,00000000), ref: 010482C3
                                                                                                                                                                                                      • LocalFree.KERNEL32(00000000,00000000,000000FF,00000000,?,00000000,-00000048,?,?,-00000034,-00000038,-000000C0,-00000048,?,?,00000000), ref: 010482CE
                                                                                                                                                                                                        • Part of subcall function 0104BA82: LocalFree.KERNEL32(00000000,000000C9,000004DD,00000001,0000011F,00000000,00000000,00000000,00000000,04DC00C9,00000002,-00000110,0104C3B6,?,00000000,?), ref: 0104BAC9
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 0000000A.00000002.2668757884.0000000001001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 01000000, based on PE: true
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668728494.0000000001000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668837967.000000000106F000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668875659.0000000001072000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668905907.0000000001076000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_1000000_certutil.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Local$Free$Alloc
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 3098330729-0
                                                                                                                                                                                                      • Opcode ID: 23a2dc15fb770c3c2c50395ff9b03233fb62cd8c82cabbcda325afd2f79ced99
                                                                                                                                                                                                      • Instruction ID: dab1623894c8dff818055ddc2f180ef45c96ca4a7d684c2ee4ad13e6ea7ec65c
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 23a2dc15fb770c3c2c50395ff9b03233fb62cd8c82cabbcda325afd2f79ced99
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 9A515AB1A00618AFEF129FE8CDC0DEEBBB9FB48754F148577EA41B2150D7B199418B60
                                                                                                                                                                                                      Function 01033947 Relevance: 6.3, APIs: 5, Instructions: 83memoryCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • wcslen.MSVCRT ref: 01033966
                                                                                                                                                                                                      • LocalAlloc.KERNEL32(00000000,00000002,?,00000000,00000000,?,?,?,0101E587,010044D8,?), ref: 01033983
                                                                                                                                                                                                      • wcscpy.MSVCRT ref: 010339B8
                                                                                                                                                                                                      • wcslen.MSVCRT ref: 010339BF
                                                                                                                                                                                                      • LocalFree.KERNEL32(00000000,?,?,00000007,00000001,00000000,00000000,?,00000000,00000000,?,?,?,0101E587,010044D8,?), ref: 010339F8
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 0000000A.00000002.2668757884.0000000001001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 01000000, based on PE: true
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668728494.0000000001000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668837967.000000000106F000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668875659.0000000001072000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668905907.0000000001076000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_1000000_certutil.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Localwcslen$AllocFreewcscpy
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 289523597-0
                                                                                                                                                                                                      • Opcode ID: 7794361e1c5b196cc4498346bb15d4026252cb906a0ca7b97816850742257918
                                                                                                                                                                                                      • Instruction ID: 7be168f613aadfc49b8d065d9faf59b90982c8ee13e30ac7ebfe9efa0e566e43
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 7794361e1c5b196cc4498346bb15d4026252cb906a0ca7b97816850742257918
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 3721C532600111FBEB259B19CC85DAEBBADFF84710F11415AF989EB244E775E9418790
                                                                                                                                                                                                      Function 0103891C Relevance: 6.1, APIs: 4, Instructions: 85fileCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • ReadFile.KERNEL32(?,?,00000008,?,00000000), ref: 0103893D
                                                                                                                                                                                                      • LocalFree.KERNEL32(?), ref: 010389EE
                                                                                                                                                                                                        • Part of subcall function 01066C28: GetLastError.KERNEL32(0104F3D4), ref: 01066C28
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 0000000A.00000002.2668757884.0000000001001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 01000000, based on PE: true
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668728494.0000000001000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668837967.000000000106F000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668875659.0000000001072000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668905907.0000000001076000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_1000000_certutil.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: ErrorFileFreeLastLocalRead
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 678896739-0
                                                                                                                                                                                                      • Opcode ID: b66629546b907504fd26e5053ffa8b7302e04f8109d6046ded0314b5a100fa87
                                                                                                                                                                                                      • Instruction ID: 639db9b6d4ec68007d66c21da2207c90410beb647d4c6a712fc13e99bd42afc6
                                                                                                                                                                                                      • Opcode Fuzzy Hash: b66629546b907504fd26e5053ffa8b7302e04f8109d6046ded0314b5a100fa87
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 49215CB120120AEFEB20DF15DD40FBA7BADEB40355F088297F984DA044D775E920CBA2
                                                                                                                                                                                                      Function 0104D953 Relevance: 6.0, APIs: 4, Instructions: 44windowCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • SendMessageW.USER32(00000000,0000014B,00000000,00000000), ref: 0104D96D
                                                                                                                                                                                                      • SendMessageW.USER32(?,00000143,00000000,76948FB0), ref: 0104D983
                                                                                                                                                                                                      • wcslen.MSVCRT ref: 0104D98B
                                                                                                                                                                                                      • SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 0104D9A5
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 0000000A.00000002.2668757884.0000000001001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 01000000, based on PE: true
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668728494.0000000001000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668837967.000000000106F000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668875659.0000000001072000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668905907.0000000001076000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_1000000_certutil.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: MessageSend$wcslen
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 4115175101-0
                                                                                                                                                                                                      • Opcode ID: 6f5cec0e6c15db293a9453242de66d8e0e88bb8e9933de7934d0fd5f43f7f78c
                                                                                                                                                                                                      • Instruction ID: ec10ec4b5691dde99d5ff57b2f3487215161a4396ae310d6459e91d4bf51196a
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 6f5cec0e6c15db293a9453242de66d8e0e88bb8e9933de7934d0fd5f43f7f78c
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 40F0C8B21013197FFB217FA89CC0CBBB6DDEF90358F114539F2D4A21E082614C4A4761
                                                                                                                                                                                                      Function 0101711B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 0000000A.00000002.2668757884.0000000001001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 01000000, based on PE: true
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668728494.0000000001000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668837967.000000000106F000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668875659.0000000001072000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668905907.0000000001076000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_1000000_certutil.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: wcschrwcslen
                                                                                                                                                                                                      • String ID: %.*ws
                                                                                                                                                                                                      • API String ID: 2687138228-323388389
                                                                                                                                                                                                      • Opcode ID: 4dc27fdd07736304b44b09b32ff11f5ca0a1641874c09d72beeeb629038507cc
                                                                                                                                                                                                      • Instruction ID: 0ea881fb8c5e670b5bc22caec0ad5a737a8f98e844f609cf40c540b1943f9ebb
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 4dc27fdd07736304b44b09b32ff11f5ca0a1641874c09d72beeeb629038507cc
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 20E0863260912167D27517296C08EDF3BAAFFD2721F64042DF5CA86144EB79448286E5
                                                                                                                                                                                                      Function 010531B6 Relevance: 5.1, APIs: 4, Instructions: 74memoryCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                        • Part of subcall function 0106765A: CryptDecodeObjectEx.CRYPT32(00000000,0000000C,010033D0,?,00008000,0000000C,?,?), ref: 0106769A
                                                                                                                                                                                                        • Part of subcall function 0106765A: SetLastError.KERNEL32(8007000D), ref: 010676AE
                                                                                                                                                                                                      • LocalFree.KERNEL32(00000000,010376DA,00000000,00000004,00000002), ref: 01053267
                                                                                                                                                                                                        • Part of subcall function 01066C28: GetLastError.KERNEL32(0104F3D4), ref: 01066C28
                                                                                                                                                                                                      • wcslen.MSVCRT ref: 01053224
                                                                                                                                                                                                      • LocalAlloc.KERNEL32(00000000,?,01053286,00000004,2.5.4.3,00000000,010532B4,00000000,00000002,00000000,00000000,00000002,?,?,010376DA,00000000), ref: 01053232
                                                                                                                                                                                                      • wcscpy.MSVCRT ref: 01053254
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 0000000A.00000002.2668757884.0000000001001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 01000000, based on PE: true
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668728494.0000000001000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668837967.000000000106F000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668875659.0000000001072000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000A.00000002.2668905907.0000000001076000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_1000000_certutil.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: ErrorLastLocal$AllocCryptDecodeFreeObjectwcscpywcslen
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 149187933-0
                                                                                                                                                                                                      • Opcode ID: 7b8834eb692f4d5d6b0199a4efec03e67bc4e86a49f09db29dcadc880a8289d5
                                                                                                                                                                                                      • Instruction ID: 5448495bcf2f23659641215789d7b38f6d299994b0f3599a8df6e82b15ca58ac
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 7b8834eb692f4d5d6b0199a4efec03e67bc4e86a49f09db29dcadc880a8289d5
                                                                                                                                                                                                      • Instruction Fuzzy Hash: A7215B76600215FFEB659BA4CC06EEA7BA8FF08790F108159BD49AB150E675DE00CBA0