Edit tour

Windows Analysis Report
fNlAH8RgLk.exe

Overview

General Information

Sample Name:	fNlAH8RgLk.exe
Original Sample Name:	9a90e115834ba8339bd0cc43c034ad55.exe
Analysis ID:	1268859
MD5:	9a90e115834ba8339bd0cc43c034ad55
SHA1:	96109e6ba18aa69a359c90e1fe448e78ba6c1c57
SHA256:	583d8351de707ac2b46a2fb9fd9ee31056ad7a83b9fea10df5f3e5e46f890b92
Tags:	32exe
Infos:

Detection

Score:	52
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Injects code into the Windows Explorer (explorer.exe)

Uses 32bit PE files

One or more processes crash

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query locales information (e.g. system language)

Contains functionality to shutdown / reboot the system

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Contains functionality to query CPU information (cpuid)

Found potential string decryption / allocating functions

Sample execution stops while process was sleeping (likely an evasion)

Found evasive API chain (may stop execution after checking a module file name)

Contains functionality to call native functions

Contains functionality to communicate with device drivers

Contains functionality to enumerate running services

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to dynamically determine API calls

Found dropped PE file which has not been started or loaded

Uses the system / local time for branch decision (may execute only at specific dates)

PE file contains executable resources (Code or Archives)

AV process strings found (often used to terminate AV products)

Sample file is different than original file name gathered from version info

PE file contains an invalid checksum

Extensive use of GetProcAddress (often used to hide API calls)

Drops PE files

Found evasive API chain checking for process token information

Checks if the current process is being debugged

Contains functionality to delete services

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w10x64

fNlAH8RgLk.exe (PID: 6008 cmdline: C:\Users\user\Desktop\fNlAH8RgLk.exe MD5: 9A90E115834BA8339BD0CC43C034AD55)

irsetup.exe (PID: 5732 cmdline: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:1742194 "__IRAFN:C:\Users\user\Desktop\fNlAH8RgLk.exe" "__IRCT:0" "__IRTSS:0" "__IRSID:S-1-5-21-3853321935-2125563209-4053062332-1002 MD5: DEC931E86140139380EA0DF57CD132B6)

un.exe (PID: 7180 cmdline: "C:\un.exe" x -o+ -ppoiuytrewq C:\ProgramData\Data\upx.rar ziliao.jpg C:\ProgramData\Microsoft\Program\ MD5: 5770866EDBB1A095D7EDC981F37D9D53)

conhost.exe (PID: 7188 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

un.exe (PID: 7232 cmdline: "C:\un.exe" x -o+ -ppoiuytrewq C:\ProgramData\Data\upx.rar iusb3mon.exe iusb3mon.dat Media.xml C:\Microsoft\ MD5: 5770866EDBB1A095D7EDC981F37D9D53)

conhost.exe (PID: 7240 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

iusb3mon.exe (PID: 7300 cmdline: "C:\Microsoft\iusb3mon.exe" MD5: 1B9D1C5BDDAFF4DD75A470FA12E35E66)

WerFault.exe (PID: 7536 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7300 -s 860 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

explorer.exe (PID: 7320 cmdline: "C:\Windows\System32\explorer.exe" C:\WPS_Setup MD5: 166AB1B9462E5C1D6D18EC5EC0B6A5F7)

explorer.exe (PID: 7360 cmdline: C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding MD5: AD5296B280E8F522A8A897C96BAB0E1D)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: fNlAH8RgLk.exe	ReversingLabs: Detection: 34%
Source: fNlAH8RgLk.exe	Virustotal: Detection: 40%			Perma Link

Source: fNlAH8RgLk.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: fNlAH8RgLk.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: P:\Target\x64\ship\groove\x-none\grooveex.pdbeex.pdb000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 source: explorer.exe, 00000008.00000002.753799752.00007FFC1B351000.00000020.00000001.01000000.00000010.sdmp
Source:	Binary string: d:\Projects\WinRAR\rar\build\unrar64\Release\UnRAR.pdb source: irsetup.exe, 00000001.00000003.358642502.0000000005612000.00000004.00000020.00020000.00000000.sdmp, un.exe, 00000002.00000000.365274563.00007FF623A3B000.00000002.00000001.01000000.00000008.sdmp, un.exe, 00000002.00000002.366549204.00007FF623A3B000.00000002.00000001.01000000.00000008.sdmp, un.exe, 00000004.00000002.368988245.00007FF623A3B000.00000002.00000001.01000000.00000008.sdmp, un.exe, 00000004.00000000.367600023.00007FF623A3B000.00000002.00000001.01000000.00000008.sdmp, un.exe.1.dr
Source:	Binary string: P:\Target\x64\ship\groove\x-none\grooveex.pdb source: explorer.exe, 00000008.00000002.753799752.00007FFC1B351000.00000020.00000001.01000000.00000010.sdmp
Source:	Binary string: C:\vmagent_new\bin\joblist\357500\out\Release\SMLProxy64.pdb source: irsetup.exe, 00000001.00000003.363828516.000000000561D000.00000004.00000020.00020000.00000000.sdmp, SMLProxy64.exe.1.dr
Source:	Binary string: E:\build\APAssist\Release\WiFiHelper.pdb source: irsetup.exe, 00000001.00000003.362346389.0000000005613000.00000004.00000020.00020000.00000000.sdmp, WiFiHelper.exe.1.dr
Source:	Binary string: .Pdb% source: fNlAH8RgLk.exe
Source:	Binary string: e:\build\360SafeNotify\Release\360SafeNotify.pdb source: irsetup.exe, 00000001.00000003.363541218.000000000561E000.00000004.00000020.00020000.00000000.sdmp, 360SafeNotify.exe.1.dr
Source:	Binary string: P:\intermoutput\S_capital\SetupArpX64_capital\Release\SetupArpX64.pdb source: irsetup.exe, 00000001.00000003.362980098.000000000561F000.00000004.00000020.00020000.00000000.sdmp, SetupArpX64.exe.1.dr
Source:	Binary string: C:\vmagent_new\bin\joblist\594305\out\Release\360PayInsure.pdb source: irsetup.exe, 00000001.00000003.360794207.0000000005613000.00000004.00000020.00020000.00000000.sdmp, 360PayInsure.exe.1.dr
Source:	Binary string: eex.pdb source: explorer.exe, 00000008.00000002.753799752.00007FFC1B351000.00000020.00000001.01000000.00000010.sdmp
Source:	Binary string: C:\vmagent_new\bin\joblist\723346\out\Release\360RealPro.pdb source: irsetup.exe, 00000001.00000003.361488158.000000000561E000.00000004.00000020.00020000.00000000.sdmp, 360RealPro.exe.1.dr
Source:	Binary string: C:\vmagent_new\bin\joblist\144658\out\Release\360SCLog.pdb source: irsetup.exe, 00000001.00000003.361882449.000000000561F000.00000004.00000020.00020000.00000000.sdmp, 360sclog.exe.1.dr
Source:	Binary string: C:\vmagent_new\bin\joblist\640834\out\Release\InstallTMDB.pdb source: irsetup.exe, 00000001.00000003.363234690.000000000561C000.00000004.00000020.00020000.00000000.sdmp, InstallTMDB.exe.1.dr
Source:	Binary string: C:\vmagent_new\bin\joblist\263304\out\Release\360netcfg.pdb source: irsetup.exe, 00000001.00000003.362673831.000000000561A000.00000004.00000020.00020000.00000000.sdmp, 360netcfg.exe.1.dr

Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 1_2_0044A06A __EH_prolog3_GS,FindFirstFileA,FindClose,	1_2_0044A06A
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 1_2_004C2293 __EH_prolog3_GS,GetFullPathNameA,__cftof,PathIsUNCA,GetVolumeInformationA,CharUpperA,FindFirstFileA,FindClose,lstrlen,_strcpy_s,	1_2_004C2293
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 1_2_0044A753 __EH_prolog3_GS,GetFullPathNameA,lstrcpyn,_strlen,GetVolumeInformationA,CharUpperA,FindFirstFileA,FindClose,	1_2_0044A753
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 1_2_0044A8A2 __EH_prolog3_GS,GetFileAttributesA,_strlen,FindFirstFileA,FindClose,	1_2_0044A8A2
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 1_2_004860CD __EH_prolog3_GS,FindFirstFileA,IsWindow,InterlockedIncrement,FindNextFileA,FindClose,	1_2_004860CD
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 1_2_0044A1CC __EH_prolog3_GS,_strlen,FindFirstFileA,IsWindow,InterlockedIncrement,FindNextFileA,FindClose,FindFirstFileA,IsWindow,InterlockedIncrement,FindNextFileA,FindClose,	1_2_0044A1CC
Source: C:\un.exe	Code function: 2_2_00007FF623A10D2C FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,	2_2_00007FF623A10D2C

Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

Code function: 1_2_004359A7 __EH_prolog3_GS,GetLogicalDriveStringsA,MessageBoxA,GetDriveTypeA,MessageBoxA,

1_2_004359A7

Source: irsetup.exe, 00000001.00000003.360794207.0000000005613000.00000004.00000020.00020000.00000000.sdmp, 360PayInsure.exe.1.dr	String found in binary or memory: http://bbs.360.cn/forum.php?mod=forumdisplay&fid=140&filter=typeid&typeid=105325
Source: irsetup.exe, 00000001.00000003.361882449.000000000561F000.00000004.00000020.00020000.00000000.sdmp, 360sclog.exe.1.dr	String found in binary or memory: http://bbs.360safe.com/forum-100-1.htmlk2
Source: 360PayInsure.exe.1.dr	String found in binary or memory: http://bbs.360safe.com/forum-990-1.html
Source: irsetup.exe, 00000001.00000003.361488158.000000000561E000.00000004.00000020.00020000.00000000.sdmp, 360RealPro.exe.1.dr	String found in binary or memory: http://bbs.360safe.com/thread-2181954-1-1.html
Source: irsetup.exe, 00000001.00000003.361488158.000000000561E000.00000004.00000020.00020000.00000000.sdmp, 360RealPro.exe.1.dr	String found in binary or memory: http://bbs.360safe.com/thread-6839592-1-1.htmlhttp://bbs.360safe.com/forum-100-1.htmlUtils
Source: irsetup.exe, 00000001.00000003.363234690.000000000561C000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000003.360794207.0000000005613000.00000004.00000020.00020000.00000000.sdmp, InstallTMDB.exe.1.dr, 360PayInsure.exe.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDCodeSigningCA-1.crt0
Source: irsetup.exe, 00000001.00000003.363234690.000000000561C000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000003.360794207.0000000005613000.00000004.00000020.00020000.00000000.sdmp, InstallTMDB.exe.1.dr, 360PayInsure.exe.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: WPS_Setup_12980.exe.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: irsetup.exe, 00000001.00000003.363234690.000000000561C000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000003.360794207.0000000005613000.00000004.00000020.00020000.00000000.sdmp, InstallTMDB.exe.1.dr, 360PayInsure.exe.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: irsetup.exe, 00000001.00000003.360794207.0000000005613000.00000004.00000020.00020000.00000000.sdmp, 360PayInsure.exe.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: WPS_Setup_12980.exe.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: irsetup.exe, 00000001.00000003.363234690.000000000561C000.00000004.00000020.00020000.00000000.sdmp, InstallTMDB.exe.1.dr, WPS_Setup_12980.exe.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: irsetup.exe, 00000001.00000003.363234690.000000000561C000.00000004.00000020.00020000.00000000.sdmp, InstallTMDB.exe.1.dr, WPS_Setup_12980.exe.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: explorer.exe, 00000008.00000002.754050154.00007FFC1B439000.00000002.00000001.01000000.00000010.sdmp	String found in binary or memory: http://components.groove.net/Groove/Components/Root.osd?Package=net.groove.Groove.Tools.System.Groov
Source: explorer.exe, 00000008.00000002.754050154.00007FFC1B439000.00000002.00000001.01000000.00000010.sdmp	String found in binary or memory: http://components.groove.net/Groove/Components/SystemComponents/SystemComponents.osd?Package=net.gro
Source: irsetup.exe, 00000001.00000003.358642502.0000000005661000.00000004.00000020.00020000.00000000.sdmp, un.exe.1.dr	String found in binary or memory: http://crl.comodoca.com/COMODOCodeSigningCA2.crl0r
Source: irsetup.exe, 00000001.00000003.361488158.000000000561E000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000003.363234690.000000000561C000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000003.360794207.0000000005613000.00000004.00000020.00020000.00000000.sdmp, InstallTMDB.exe.1.dr, 360RealPro.exe.1.dr, 360PayInsure.exe.1.dr	String found in binary or memory: http://crl.globalsign.com/ca/gstsacasha384g4.crl0
Source: irsetup.exe, 00000001.00000003.361488158.000000000561E000.00000004.00000020.00020000.00000000.sdmp, 360RealPro.exe.1.dr	String found in binary or memory: http://crl.globalsign.com/codesigningrootr45.crl0U
Source: irsetup.exe, 00000001.00000003.362673831.000000000561A000.00000004.00000020.00020000.00000000.sdmp, 360netcfg.exe.1.dr	String found in binary or memory: http://crl.globalsign.com/gs/gstimestampingg2.crl0T
Source: irsetup.exe, 00000001.00000003.362673831.000000000561A000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000003.363828516.000000000561D000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000002.374638973.000000000016E000.00000004.00000010.00020000.00000000.sdmp, un.exe, 00000004.00000003.368550717.0000000002B41000.00000004.00000020.00020000.00000000.sdmp, SMLProxy64.exe.1.dr, 360netcfg.exe.1.dr, iusb3mon.exe.4.dr	String found in binary or memory: http://crl.globalsign.com/gs/gstimestampingsha2g2.crl0
Source: un.exe, 00000004.00000003.368550717.0000000002B41000.00000004.00000020.00020000.00000000.sdmp, iusb3mon.exe.4.dr	String found in binary or memory: http://crl.globalsign.com/gsextendcodesignsha2g3.crl0
Source: irsetup.exe, 00000001.00000003.361488158.000000000561E000.00000004.00000020.00020000.00000000.sdmp, 360RealPro.exe.1.dr	String found in binary or memory: http://crl.globalsign.com/gsgccr45evcodesignca2020.crl0
Source: irsetup.exe, 00000001.00000003.361488158.000000000561E000.00000004.00000020.00020000.00000000.sdmp, 360RealPro.exe.1.dr	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0G
Source: un.exe, 00000004.00000003.368550717.0000000002B41000.00000004.00000020.00020000.00000000.sdmp, iusb3mon.exe.4.dr	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0b
Source: irsetup.exe, 00000001.00000003.361488158.000000000561E000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000003.363234690.000000000561C000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000003.360794207.0000000005613000.00000004.00000020.00020000.00000000.sdmp, InstallTMDB.exe.1.dr, 360RealPro.exe.1.dr, 360PayInsure.exe.1.dr	String found in binary or memory: http://crl.globalsign.com/root-r6.crl0G
Source: un.exe, 00000004.00000003.368550717.0000000002B41000.00000004.00000020.00020000.00000000.sdmp, iusb3mon.exe.4.dr	String found in binary or memory: http://crl.globalsign.com/root.crl0G
Source: irsetup.exe, 00000001.00000003.362673831.000000000561A000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000003.363828516.000000000561D000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000002.374638973.000000000016E000.00000004.00000010.00020000.00000000.sdmp, un.exe, 00000004.00000003.368550717.0000000002B41000.00000004.00000020.00020000.00000000.sdmp, SMLProxy64.exe.1.dr, 360netcfg.exe.1.dr, iusb3mon.exe.4.dr	String found in binary or memory: http://crl.globalsign.net/root-r3.crl0
Source: irsetup.exe, 00000001.00000003.362673831.000000000561A000.00000004.00000020.00020000.00000000.sdmp, 360netcfg.exe.1.dr	String found in binary or memory: http://crl.globalsign.net/root.crl0
Source: irsetup.exe, 00000001.00000003.361882449.000000000561F000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000003.363828516.000000000561D000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000002.374638973.000000000016E000.00000004.00000010.00020000.00000000.sdmp, SMLProxy64.exe.1.dr, 360sclog.exe.1.dr	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: WPS_Setup_12980.exe.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: irsetup.exe, 00000001.00000003.363234690.000000000561C000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000003.360794207.0000000005613000.00000004.00000020.00020000.00000000.sdmp, InstallTMDB.exe.1.dr, 360PayInsure.exe.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: irsetup.exe, 00000001.00000003.363234690.000000000561C000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000003.360794207.0000000005613000.00000004.00000020.00020000.00000000.sdmp, InstallTMDB.exe.1.dr, 360PayInsure.exe.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: irsetup.exe, 00000001.00000003.360794207.0000000005613000.00000004.00000020.00020000.00000000.sdmp, 360PayInsure.exe.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: WPS_Setup_12980.exe.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: irsetup.exe, 00000001.00000003.363234690.000000000561C000.00000004.00000020.00020000.00000000.sdmp, InstallTMDB.exe.1.dr, WPS_Setup_12980.exe.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: WPS_Setup_12980.exe.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: irsetup.exe, 00000001.00000003.363234690.000000000561C000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000003.360794207.0000000005613000.00000004.00000020.00020000.00000000.sdmp, InstallTMDB.exe.1.dr, 360PayInsure.exe.1.dr	String found in binary or memory: http://crl3.digicert.com/assured-cs-g1.crl00
Source: irsetup.exe, 00000001.00000003.363234690.000000000561C000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000003.360794207.0000000005613000.00000004.00000020.00020000.00000000.sdmp, InstallTMDB.exe.1.dr, 360PayInsure.exe.1.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: irsetup.exe, 00000001.00000003.360794207.0000000005613000.00000004.00000020.00020000.00000000.sdmp, 360PayInsure.exe.1.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: irsetup.exe, 00000001.00000003.363234690.000000000561C000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000003.360794207.0000000005613000.00000004.00000020.00020000.00000000.sdmp, InstallTMDB.exe.1.dr, 360PayInsure.exe.1.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: irsetup.exe, 00000001.00000003.363234690.000000000561C000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000003.360794207.0000000005613000.00000004.00000020.00020000.00000000.sdmp, InstallTMDB.exe.1.dr, 360PayInsure.exe.1.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: WPS_Setup_12980.exe.1.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: irsetup.exe, 00000001.00000003.363234690.000000000561C000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000003.360794207.0000000005613000.00000004.00000020.00020000.00000000.sdmp, InstallTMDB.exe.1.dr, 360PayInsure.exe.1.dr	String found in binary or memory: http://crl4.digicert.com/assured-cs-g1.crl0L
Source: irsetup.exe, 00000001.00000003.363234690.000000000561C000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000003.360794207.0000000005613000.00000004.00000020.00020000.00000000.sdmp, InstallTMDB.exe.1.dr, 360PayInsure.exe.1.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
Source: irsetup.exe, 00000001.00000003.360794207.0000000005613000.00000004.00000020.00020000.00000000.sdmp, 360PayInsure.exe.1.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: irsetup.exe, 00000001.00000003.363541218.000000000561E000.00000004.00000020.00020000.00000000.sdmp, 360SafeNotify.exe.1.dr	String found in binary or memory: http://down.360safe.com/setup.exe
Source: irsetup.exe, 00000001.00000003.361882449.000000000561F000.00000004.00000020.00020000.00000000.sdmp, 360sclog.exe.1.dr	String found in binary or memory: http://down.360safe.com/setup.exeDllGetClassObjectCreateObjectInitLibsT
Source: irsetup.exe, 00000001.00000003.360794207.0000000005613000.00000004.00000020.00020000.00000000.sdmp, 360PayInsure.exe.1.dr	String found in binary or memory: http://down.360safe.com/setup.exeIsBetaVersion360ver.dllGetChangeSkinManagerGetMiniUICompatibleGetSi
Source: irsetup.exe, 00000001.00000003.361488158.000000000561E000.00000004.00000020.00020000.00000000.sdmp, 360RealPro.exe.1.dr	String found in binary or memory: http://down.360safe.com/setup.exeSOFTWARE
Source: irsetup.exe, 00000001.00000003.361488158.000000000561E000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000003.361882449.000000000561F000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000003.363541218.000000000561E000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000003.360794207.0000000005613000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000003.362346389.0000000005613000.00000004.00000020.00020000.00000000.sdmp, 360RealPro.exe.1.dr, 360SafeNotify.exe.1.dr, 360sclog.exe.1.dr, 360PayInsure.exe.1.dr, WiFiHelper.exe.1.dr	String found in binary or memory: http://down.360safe.com/setup.exehttp://down.360safe.com/setupbeta.exe
Source: irsetup.exe, 00000001.00000003.360794207.0000000005613000.00000004.00000020.00020000.00000000.sdmp, 360PayInsure.exe.1.dr	String found in binary or memory: http://down.360safe.com/setup.exehttp://down.360safe.com/setupbeta.exe$
Source: irsetup.exe, 00000001.00000003.361882449.000000000561F000.00000004.00000020.00020000.00000000.sdmp, 360sclog.exe.1.dr	String found in binary or memory: http://down.360safe.com/setup.exehttp://down.360safe.com/setupbeta.exe0
Source: irsetup.exe, 00000001.00000003.361882449.000000000561F000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000003.363541218.000000000561E000.00000004.00000020.00020000.00000000.sdmp, 360SafeNotify.exe.1.dr, 360sclog.exe.1.dr	String found in binary or memory: http://down.360safe.com/setup.exehttp://down.360safe.com/setupbeta.exe360
Source: irsetup.exe, 00000001.00000003.361882449.000000000561F000.00000004.00000020.00020000.00000000.sdmp, 360sclog.exe.1.dr	String found in binary or memory: http://down.360safe.com/setup.exehttp://down.360safe.com/setupbeta.exe8
Source: irsetup.exe, 00000001.00000003.361882449.000000000561F000.00000004.00000020.00020000.00000000.sdmp, 360sclog.exe.1.dr	String found in binary or memory: http://down.360safe.com/setup.exehttp://down.360safe.com/setupbeta.exeX
Source: irsetup.exe, 00000001.00000003.361488158.000000000561E000.00000004.00000020.00020000.00000000.sdmp, 360RealPro.exe.1.dr	String found in binary or memory: http://es.f.360.cn/stats.phpChromePlusHTML
Source: irsetup.exe, 00000001.00000003.360794207.0000000005613000.00000004.00000020.00020000.00000000.sdmp, 360PayInsure.exe.1.dr	String found in binary or memory: http://fuwu.360.cn/agreement.htmlOhttp://bbs.360.cn/forum.php?mod=forumdisplay&fid=140&filter=typeid
Source: irsetup.exe, 00000001.00000003.360794207.0000000005613000.00000004.00000020.00020000.00000000.sdmp, 360PayInsure.exe.1.dr	String found in binary or memory: http://fuwu.360.cn/jubao/wangzhi?url=%s$http://xianpei.360.cn/introduce.html
Source: irsetup.exe, 00000001.00000003.360794207.0000000005613000.00000004.00000020.00020000.00000000.sdmp, 360PayInsure.exe.1.dr	String found in binary or memory: http://fuwu.360.cn/lipei/baodan
Source: irsetup.exe, 00000001.00000003.361488158.000000000561E000.00000004.00000020.00020000.00000000.sdmp, 360RealPro.exe.1.dr	String found in binary or memory: http://hao.360.cn
Source: 360RealPro.exe.1.dr	String found in binary or memory: http://hao.360.cn/
Source: irsetup.exe, 00000001.00000003.361488158.000000000561E000.00000004.00000020.00020000.00000000.sdmp, 360RealPro.exe.1.dr	String found in binary or memory: http://hao.360.com
Source: irsetup.exe, 00000001.00000003.361488158.000000000561E000.00000004.00000020.00020000.00000000.sdmp, 360RealPro.exe.1.dr	String found in binary or memory: http://hao.360.com/
Source: fNlAH8RgLk.exe, un.exe.1.dr	String found in binary or memory: http://ocsp.comodoca.com0
Source: WPS_Setup_12980.exe.1.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: irsetup.exe, 00000001.00000003.363234690.000000000561C000.00000004.00000020.00020000.00000000.sdmp, InstallTMDB.exe.1.dr, WPS_Setup_12980.exe.1.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: irsetup.exe, 00000001.00000003.363234690.000000000561C000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000003.360794207.0000000005613000.00000004.00000020.00020000.00000000.sdmp, InstallTMDB.exe.1.dr, 360PayInsure.exe.1.dr, WPS_Setup_12980.exe.1.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: irsetup.exe, 00000001.00000003.363234690.000000000561C000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000003.360794207.0000000005613000.00000004.00000020.00020000.00000000.sdmp, InstallTMDB.exe.1.dr, 360PayInsure.exe.1.dr	String found in binary or memory: http://ocsp.digicert.com0L
Source: irsetup.exe, 00000001.00000003.363234690.000000000561C000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000003.360794207.0000000005613000.00000004.00000020.00020000.00000000.sdmp, InstallTMDB.exe.1.dr, 360PayInsure.exe.1.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: irsetup.exe, 00000001.00000003.360794207.0000000005613000.00000004.00000020.00020000.00000000.sdmp, 360PayInsure.exe.1.dr	String found in binary or memory: http://ocsp.digicert.com0O
Source: irsetup.exe, 00000001.00000003.363234690.000000000561C000.00000004.00000020.00020000.00000000.sdmp, InstallTMDB.exe.1.dr, WPS_Setup_12980.exe.1.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: irsetup.exe, 00000001.00000003.361488158.000000000561E000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000003.363234690.000000000561C000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000003.360794207.0000000005613000.00000004.00000020.00020000.00000000.sdmp, InstallTMDB.exe.1.dr, 360RealPro.exe.1.dr, 360PayInsure.exe.1.dr	String found in binary or memory: http://ocsp.globalsign.com/ca/gstsacasha384g40C
Source: irsetup.exe, 00000001.00000003.361488158.000000000561E000.00000004.00000020.00020000.00000000.sdmp, 360RealPro.exe.1.dr	String found in binary or memory: http://ocsp.globalsign.com/codesigningrootr450F
Source: irsetup.exe, 00000001.00000003.361488158.000000000561E000.00000004.00000020.00020000.00000000.sdmp, 360RealPro.exe.1.dr	String found in binary or memory: http://ocsp.globalsign.com/gsgccr45evcodesignca20200U
Source: un.exe, 00000004.00000003.368550717.0000000002B41000.00000004.00000020.00020000.00000000.sdmp, iusb3mon.exe.4.dr	String found in binary or memory: http://ocsp.globalsign.com/rootr103
Source: irsetup.exe, 00000001.00000003.361882449.000000000561F000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000003.363828516.000000000561D000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000002.374638973.000000000016E000.00000004.00000010.00020000.00000000.sdmp, SMLProxy64.exe.1.dr, 360sclog.exe.1.dr	String found in binary or memory: http://ocsp.thawte.com0
Source: un.exe, 00000004.00000003.368550717.0000000002B41000.00000004.00000020.00020000.00000000.sdmp, iusb3mon.exe.4.dr	String found in binary or memory: http://ocsp2.globalsign.com/gsextendcodesignsha2g30U
Source: irsetup.exe, 00000001.00000003.362673831.000000000561A000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000003.363828516.000000000561D000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000002.374638973.000000000016E000.00000004.00000010.00020000.00000000.sdmp, un.exe, 00000004.00000003.368550717.0000000002B41000.00000004.00000020.00020000.00000000.sdmp, SMLProxy64.exe.1.dr, 360netcfg.exe.1.dr, iusb3mon.exe.4.dr	String found in binary or memory: http://ocsp2.globalsign.com/gstimestampingsha2g20
Source: irsetup.exe, 00000001.00000003.361488158.000000000561E000.00000004.00000020.00020000.00000000.sdmp, un.exe, 00000004.00000003.368550717.0000000002B41000.00000004.00000020.00020000.00000000.sdmp, 360RealPro.exe.1.dr, iusb3mon.exe.4.dr	String found in binary or memory: http://ocsp2.globalsign.com/rootr306
Source: irsetup.exe, 00000001.00000003.361488158.000000000561E000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000003.363234690.000000000561C000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000003.360794207.0000000005613000.00000004.00000020.00020000.00000000.sdmp, InstallTMDB.exe.1.dr, 360RealPro.exe.1.dr, 360PayInsure.exe.1.dr	String found in binary or memory: http://ocsp2.globalsign.com/rootr606
Source: irsetup.exe, 00000001.00000003.361488158.000000000561E000.00000004.00000020.00020000.00000000.sdmp, 360RealPro.exe.1.dr	String found in binary or memory: http://s.360.cn/safe/stat.html?stype=realpro&type=%s&pid=%s&m=%s&zt=%d
Source: irsetup.exe, 00000001.00000003.360794207.0000000005613000.00000004.00000020.00020000.00000000.sdmp, 360PayInsure.exe.1.dr	String found in binary or memory: http://s.360.cn/wangdun/baoxian.html?stype=wd_bx&mi=
Source: WPS_Setup_12980.exe.1.dr	String found in binary or memory: http://s.symcb.com/universal-root.crl0
Source: WPS_Setup_12980.exe.1.dr	String found in binary or memory: http://s.symcd.com06
Source: irsetup.exe, 00000001.00000003.361882449.000000000561F000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000003.362673831.000000000561A000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000003.363828516.000000000561D000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000002.374638973.000000000016E000.00000004.00000010.00020000.00000000.sdmp, SMLProxy64.exe.1.dr, 360sclog.exe.1.dr, 360netcfg.exe.1.dr	String found in binary or memory: http://s1.symcb.com/pca3-g5.crl0
Source: irsetup.exe, 00000001.00000003.361882449.000000000561F000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000003.362673831.000000000561A000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000003.363828516.000000000561D000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000002.374638973.000000000016E000.00000004.00000010.00020000.00000000.sdmp, SMLProxy64.exe.1.dr, 360sclog.exe.1.dr, 360netcfg.exe.1.dr	String found in binary or memory: http://s2.symcb.com0
Source: explorer.exe, 00000008.00000002.750342451.0000000004D9F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.mggo5
Source: irsetup.exe, 00000001.00000003.362673831.000000000561A000.00000004.00000020.00020000.00000000.sdmp, 360netcfg.exe.1.dr	String found in binary or memory: http://sdup.360.cn/v3/safeup_libex.cabsafeup_libex.ini360app360safe
Source: irsetup.exe, 00000001.00000003.361488158.000000000561E000.00000004.00000020.00020000.00000000.sdmp, 360RealPro.exe.1.dr	String found in binary or memory: http://secure.globalsign.com/cacert/codesigningrootr45.crt0A
Source: un.exe, 00000004.00000003.368550717.0000000002B41000.00000004.00000020.00020000.00000000.sdmp, iusb3mon.exe.4.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gsextendcodesignsha2g3ocsp.crt0
Source: irsetup.exe, 00000001.00000003.361488158.000000000561E000.00000004.00000020.00020000.00000000.sdmp, 360RealPro.exe.1.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gsgccr45evcodesignca2020.crt0?
Source: irsetup.exe, 00000001.00000003.362673831.000000000561A000.00000004.00000020.00020000.00000000.sdmp, 360netcfg.exe.1.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gstimestampingg2.crt0
Source: irsetup.exe, 00000001.00000003.362673831.000000000561A000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000003.363828516.000000000561D000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000002.374638973.000000000016E000.00000004.00000010.00020000.00000000.sdmp, un.exe, 00000004.00000003.368550717.0000000002B41000.00000004.00000020.00020000.00000000.sdmp, SMLProxy64.exe.1.dr, 360netcfg.exe.1.dr, iusb3mon.exe.4.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gstimestampingsha2g2.crt0
Source: irsetup.exe, 00000001.00000003.361488158.000000000561E000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000003.363234690.000000000561C000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000003.360794207.0000000005613000.00000004.00000020.00020000.00000000.sdmp, InstallTMDB.exe.1.dr, 360RealPro.exe.1.dr, 360PayInsure.exe.1.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gstsacasha384g4.crt0
Source: irsetup.exe, 00000001.00000003.360794207.0000000005613000.00000004.00000020.00020000.00000000.sdmp, 360PayInsure.exe.1.dr	String found in binary or memory: http://service.weibo.com/share/share.php?title=&pic=Internet
Source: irsetup.exe, 00000001.00000003.363828516.000000000561D000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000002.374638973.000000000016E000.00000004.00000010.00020000.00000000.sdmp, SMLProxy64.exe.1.dr	String found in binary or memory: http://sf.symcb.com/sf.crl0a
Source: irsetup.exe, 00000001.00000003.361882449.000000000561F000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000003.362673831.000000000561A000.00000004.00000020.00020000.00000000.sdmp, 360sclog.exe.1.dr, 360netcfg.exe.1.dr	String found in binary or memory: http://sf.symcb.com/sf.crl0f
Source: irsetup.exe, 00000001.00000003.361882449.000000000561F000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000003.362673831.000000000561A000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000003.363828516.000000000561D000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000002.374638973.000000000016E000.00000004.00000010.00020000.00000000.sdmp, SMLProxy64.exe.1.dr, 360sclog.exe.1.dr, 360netcfg.exe.1.dr	String found in binary or memory: http://sf.symcb.com/sf.crt0
Source: irsetup.exe, 00000001.00000003.361882449.000000000561F000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000003.362673831.000000000561A000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000003.363828516.000000000561D000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000002.374638973.000000000016E000.00000004.00000010.00020000.00000000.sdmp, SMLProxy64.exe.1.dr, 360sclog.exe.1.dr, 360netcfg.exe.1.dr	String found in binary or memory: http://sf.symcd.com0&
Source: irsetup.exe, 00000001.00000003.363828516.000000000561D000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000002.374638973.000000000016E000.00000004.00000010.00020000.00000000.sdmp, SMLProxy64.exe.1.dr	String found in binary or memory: http://sv.symcb.com/sv.crl0a
Source: irsetup.exe, 00000001.00000003.361882449.000000000561F000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000003.362673831.000000000561A000.00000004.00000020.00020000.00000000.sdmp, 360sclog.exe.1.dr, 360netcfg.exe.1.dr	String found in binary or memory: http://sv.symcb.com/sv.crl0f
Source: irsetup.exe, 00000001.00000003.361882449.000000000561F000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000003.362673831.000000000561A000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000003.363828516.000000000561D000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000002.374638973.000000000016E000.00000004.00000010.00020000.00000000.sdmp, SMLProxy64.exe.1.dr, 360sclog.exe.1.dr, 360netcfg.exe.1.dr	String found in binary or memory: http://sv.symcb.com/sv.crt0
Source: irsetup.exe, 00000001.00000003.361882449.000000000561F000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000003.362673831.000000000561A000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000003.363828516.000000000561D000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000002.374638973.000000000016E000.00000004.00000010.00020000.00000000.sdmp, SMLProxy64.exe.1.dr, 360sclog.exe.1.dr, 360netcfg.exe.1.dr	String found in binary or memory: http://sv.symcd.com0&
Source: WPS_Setup_12980.exe.1.dr	String found in binary or memory: http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0(
Source: 360sclog.exe.1.dr	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: WPS_Setup_12980.exe.1.dr	String found in binary or memory: http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0
Source: irsetup.exe, 00000001.00000003.361882449.000000000561F000.00000004.00000020.00020000.00000000.sdmp, 360sclog.exe.1.dr	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0
Source: irsetup.exe, 00000001.00000003.361882449.000000000561F000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000003.363828516.000000000561D000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000002.374638973.000000000016E000.00000004.00000010.00020000.00000000.sdmp, SMLProxy64.exe.1.dr, 360sclog.exe.1.dr	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: irsetup.exe, 00000001.00000003.361882449.000000000561F000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000003.363828516.000000000561D000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000002.374638973.000000000016E000.00000004.00000010.00020000.00000000.sdmp, SMLProxy64.exe.1.dr, 360sclog.exe.1.dr	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: WPS_Setup_12980.exe.1.dr	String found in binary or memory: http://ts-ocsp.ws.symantec.com0;
Source: irsetup.exe, 00000001.00000003.362673831.000000000561A000.00000004.00000020.00020000.00000000.sdmp, 360netcfg.exe.1.dr	String found in binary or memory: http://update.360safe.com/v3/safeup_ds.cabsafeup_ds.ini360dsapp360dsplus
Source: irsetup.exe, 00000001.00000003.362673831.000000000561A000.00000004.00000020.00020000.00000000.sdmp, 360netcfg.exe.1.dr	String found in binary or memory: http://update.360safe.com/v3/safeup_ds64.cabsafeup_ds64.inihttp://sdup.360.cn/v3/safeup_libex64.cabs
Source: Amcache.hve.12.dr	String found in binary or memory: http://upx.sf.net
Source: irsetup.exe, 00000001.00000003.360794207.0000000005613000.00000004.00000020.00020000.00000000.sdmp, 360PayInsure.exe.1.dr	String found in binary or memory: http://www.110.360.cn/safevideo.html.http://bbs.360safe.com/thread-2508392-1-1.html$http://xianpei.3
Source: irsetup.exe, 00000001.00000003.361882449.000000000561F000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000003.363234690.000000000561C000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000003.362980098.000000000561F000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000003.362673831.000000000561A000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000003.362346389.000000000564C000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000003.360794207.0000000005613000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000003.363828516.000000000561D000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000002.374638973.000000000016E000.00000004.00000010.00020000.00000000.sdmp, irsetup.exe, 00000001.00000003.363541218.000000000565B000.00000004.00000020.00020000.00000000.sdmp, SetupArpX64.exe.1.dr, InstallTMDB.exe.1.dr, 360SafeNotify.exe.1.dr, SMLProxy64.exe.1.dr, 360sclog.exe.1.dr, 360PayInsure.exe.1.dr, WiFiHelper.exe.1.dr, 360netcfg.exe.1.dr	String found in binary or memory: http://www.360.cn
Source: irsetup.exe, 00000001.00000003.361488158.000000000561E000.00000004.00000020.00020000.00000000.sdmp, 360RealPro.exe.1.dr	String found in binary or memory: http://www.360.cn/n/10575.htmldetailshttp://bbs.360safe.com/thread-5744696-1-1.htmlSOFTWARE
Source: irsetup.exe, 00000001.00000003.361488158.000000000561E000.00000004.00000020.00020000.00000000.sdmp, 360RealPro.exe.1.dr	String found in binary or memory: http://www.360.cn/safeBrainhttp://weishi.360.cn/top_security//panel=14001http://www.360.cn/n/11802.h
Source: irsetup.exe, 00000001.00000003.361488158.000000000561E000.00000004.00000020.00020000.00000000.sdmp, 360RealPro.exe.1.dr	String found in binary or memory: http://www.360.cnu
Source: irsetup.exe, 00000001.00000003.360794207.0000000005613000.00000004.00000020.00020000.00000000.sdmp, 360PayInsure.exe.1.dr, WPS_Setup_12980.exe.1.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: irsetup.exe, 00000001.00000003.363234690.000000000561C000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000003.360794207.0000000005613000.00000004.00000020.00020000.00000000.sdmp, InstallTMDB.exe.1.dr, 360PayInsure.exe.1.dr	String found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
Source: irsetup.exe, 00000001.00000003.361488158.000000000561E000.00000004.00000020.00020000.00000000.sdmp, 360RealPro.exe.1.dr	String found in binary or memory: http://www.hao.360.cn
Source: irsetup.exe, 00000001.00000003.361488158.000000000561E000.00000004.00000020.00020000.00000000.sdmp, 360RealPro.exe.1.dr	String found in binary or memory: http://www.hao.360.com
Source: irsetup.exe, 00000001.00000003.361488158.000000000561E000.00000004.00000020.00020000.00000000.sdmp, 360RealPro.exe.1.dr	String found in binary or memory: http://www.hao.360.comwww.hao.360.comhao.360.comhttp://hao.360.comhttp://hao.360.com/http://www.hao.
Source: fNlAH8RgLk.exe	String found in binary or memory: http://www.indigorose.com
Source: iusb3mon.exe, 00000006.00000002.413012669.000000000050F000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: http://www.indigorose.com/route.php?pid=suf60buy
Source: irsetup.exe, 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: http://www.indigorose.com/route.php?pid=suf9buy
Source: irsetup.exe, 00000001.00000003.361488158.000000000561E000.00000004.00000020.00020000.00000000.sdmp, 360RealPro.exe.1.dr	String found in binary or memory: http://www.so.com
Source: irsetup.exe, 00000001.00000003.361488158.000000000561E000.00000004.00000020.00020000.00000000.sdmp, 360RealPro.exe.1.dr	String found in binary or memory: http://www.so.com/
Source: irsetup.exe, 00000001.00000003.360794207.0000000005613000.00000004.00000020.00020000.00000000.sdmp, 360PayInsure.exe.1.dr	String found in binary or memory: http://www.so.com/?src=wd_xp1http://hao.360.com/?wd_xp1https://hao.360.com/?wd_xp1360PayInsure.exepa
Source: irsetup.exe, 00000001.00000003.361488158.000000000561E000.00000004.00000020.00020000.00000000.sdmp, 360RealPro.exe.1.dr	String found in binary or memory: http://www.so.comhttp://www.so.com/www.haoso.com
Source: irsetup.exe, 00000001.00000003.361882449.000000000561F000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000003.362673831.000000000561A000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000003.363828516.000000000561D000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000002.374638973.000000000016E000.00000004.00000010.00020000.00000000.sdmp, SMLProxy64.exe.1.dr, 360sclog.exe.1.dr, 360netcfg.exe.1.dr	String found in binary or memory: http://www.symauth.com/cps0(
Source: irsetup.exe, 00000001.00000003.361882449.000000000561F000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000003.362673831.000000000561A000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000003.363828516.000000000561D000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000002.374638973.000000000016E000.00000004.00000010.00020000.00000000.sdmp, SMLProxy64.exe.1.dr, 360sclog.exe.1.dr, 360netcfg.exe.1.dr	String found in binary or memory: http://www.symauth.com/rpa00
Source: 360PayInsure.exe.1.dr	String found in binary or memory: http://www.winimage.com/zLibDll
Source: irsetup.exe, 00000001.00000003.372702887.0000000005534000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000003.372566173.0000000005533000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000003.372057503.000000000552C000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000003.371846549.0000000005527000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000003.372464969.000000000552D000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000003.355729735.0000000005616000.00000004.00000020.00020000.00000000.sdmp, irsetup.dat.1.dr	String found in binary or memory: http://www.yourcompany.com
Source: irsetup.exe, 00000001.00000003.360794207.0000000005613000.00000004.00000020.00020000.00000000.sdmp, 360PayInsure.exe.1.dr	String found in binary or memory: http://xianpei.360.cn/
Source: irsetup.exe, 00000001.00000003.360794207.0000000005613000.00000004.00000020.00020000.00000000.sdmp, 360PayInsure.exe.1.dr	String found in binary or memory: http://xianpei.360.cn/agreement.html3http://www.360.cn/privacy/v2/360anquanweishi.html#7
Source: irsetup.exe, 00000001.00000003.360794207.0000000005613000.00000004.00000020.00020000.00000000.sdmp, 360PayInsure.exe.1.dr	String found in binary or memory: http://xianpei.360.cn/fanlesuo-protocal.htmlhttps://xianpei.360.cn/fanlesuo-protocal.html360
Source: irsetup.exe, 00000001.00000003.360794207.0000000005613000.00000004.00000020.00020000.00000000.sdmp, 360PayInsure.exe.1.dr	String found in binary or memory: http://xianpei.360.cn/introduce.html
Source: irsetup.exe, 00000001.00000003.360794207.0000000005613000.00000004.00000020.00020000.00000000.sdmp, 360PayInsure.exe.1.dr	String found in binary or memory: http://xianpei.360.cn/protocal-pop.htmlhttps://xianpei.360.cn/protocal-pop.html360Q
Source: irsetup.exe, 00000001.00000003.360794207.0000000005613000.00000004.00000020.00020000.00000000.sdmp, 360PayInsure.exe.1.dr	String found in binary or memory: http://yx.360.cn/impression/%s&http://yx.360.cn/impression/%s?comment
Source: 360PayInsure.exe.1.dr	String found in binary or memory: https://bx.wd.360.cn/index.phpError
Source: irsetup.exe, 00000001.00000003.361882449.000000000561F000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000003.362673831.000000000561A000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000003.363828516.000000000561D000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000002.374638973.000000000016E000.00000004.00000010.00020000.00000000.sdmp, SMLProxy64.exe.1.dr, 360sclog.exe.1.dr, WPS_Setup_12980.exe.1.dr, 360netcfg.exe.1.dr	String found in binary or memory: https://d.symcb.com/cps0%
Source: irsetup.exe, 00000001.00000003.361882449.000000000561F000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000003.362673831.000000000561A000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000003.363828516.000000000561D000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000002.374638973.000000000016E000.00000004.00000010.00020000.00000000.sdmp, SMLProxy64.exe.1.dr, 360sclog.exe.1.dr, WPS_Setup_12980.exe.1.dr, 360netcfg.exe.1.dr	String found in binary or memory: https://d.symcb.com/rpa0
Source: WPS_Setup_12980.exe.1.dr	String found in binary or memory: https://d.symcb.com/rpa0.
Source: irsetup.exe, 00000001.00000003.361488158.000000000561E000.00000004.00000020.00020000.00000000.sdmp, 360RealPro.exe.1.dr	String found in binary or memory: https://hao.360.com
Source: irsetup.exe, 00000001.00000003.361488158.000000000561E000.00000004.00000020.00020000.00000000.sdmp, 360RealPro.exe.1.dr	String found in binary or memory: https://hao.360.com/?360safey1017?y1019?y1018?360safe
Source: irsetup.exe, 00000001.00000003.361488158.000000000561E000.00000004.00000020.00020000.00000000.sdmp, 360RealPro.exe.1.dr	String found in binary or memory: https://hao.360.comhao.360
Source: irsetup.exe, 00000001.00000003.361488158.000000000561E000.00000004.00000020.00020000.00000000.sdmp, 360RealPro.exe.1.dr	String found in binary or memory: https://hao.360.comhttps://hao.360.cnhttps://www.hao123.comhttp://hao123.comhttp://www.hao123.comhao
Source: irsetup.exe, 00000001.00000003.360794207.0000000005613000.00000004.00000020.00020000.00000000.sdmp, 360PayInsure.exe.1.dr	String found in binary or memory: https://pinst.360.cn/360se/wswgxp.cabhttps://pinst.360.cn/360chrome/360safe_shopping.cab
Source: irsetup.exe, 00000001.00000003.360794207.0000000005613000.00000004.00000020.00020000.00000000.sdmp, 360PayInsure.exe.1.dr	String found in binary or memory: https://u.xianpei.360.cn/
Source: irsetup.exe, 00000001.00000003.360794207.0000000005613000.00000004.00000020.00020000.00000000.sdmp, 360PayInsure.exe.1.dr	String found in binary or memory: https://u.xianpei.360.cn/?tid=%s#%s
Source: irsetup.exe, 00000001.00000003.363234690.000000000561C000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000003.360794207.0000000005613000.00000004.00000020.00020000.00000000.sdmp, InstallTMDB.exe.1.dr, 360PayInsure.exe.1.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: iusb3mon.exe.4.dr	String found in binary or memory: https://www.globalsign.com/repository/0
Source: irsetup.exe, 00000001.00000003.362673831.000000000561A000.00000004.00000020.00020000.00000000.sdmp, 360netcfg.exe.1.dr	String found in binary or memory: https://www.globalsign.com/repository/03
Source: irsetup.exe, 00000001.00000003.362673831.000000000561A000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000003.363828516.000000000561D000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000002.374638973.000000000016E000.00000004.00000010.00020000.00000000.sdmp, un.exe, 00000004.00000003.368550717.0000000002B41000.00000004.00000020.00020000.00000000.sdmp, SMLProxy64.exe.1.dr, 360netcfg.exe.1.dr, iusb3mon.exe.4.dr	String found in binary or memory: https://www.globalsign.com/repository/06

Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

Code function: 1_2_00456018 _memset,_memset,GetTempPathA,GetTempFileNameA,SetFileAttributesA,DeleteFileA,_memset,_memset,_memset,_memset,_memset,_memset,LoadLibraryA,LoadLibraryA,GetProcAddress,_strncpy,GetProcAddress,GlobalFree,GlobalFree,GlobalFree,FreeLibrary,URLDownloadToFileA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,

1_2_00456018

Source: fNlAH8RgLk.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Microsoft\iusb3mon.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7300 -s 860

Source: C:\un.exe

Code function: 2_2_00007FF623A1EB28 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,

2_2_00007FF623A1EB28

Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 1_2_00532231	1_2_00532231
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 1_2_005D0460	1_2_005D0460
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 1_2_005DA56E	1_2_005DA56E
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 1_2_00644500	1_2_00644500
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 1_2_0048C587	1_2_0048C587
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 1_2_004C8661	1_2_004C8661
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 1_2_0040E866	1_2_0040E866
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 1_2_0041C9D7	1_2_0041C9D7
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 1_2_00416BEB	1_2_00416BEB
Source: C:\un.exe	Code function: 2_2_00007FF623A0D3DC	2_2_00007FF623A0D3DC
Source: C:\un.exe	Code function: 2_2_00007FF623A099E4	2_2_00007FF623A099E4
Source: C:\un.exe	Code function: 2_2_00007FF623A02964	2_2_00007FF623A02964
Source: C:\un.exe	Code function: 2_2_00007FF623A070B8	2_2_00007FF623A070B8
Source: C:\un.exe	Code function: 2_2_00007FF623A29128	2_2_00007FF623A29128
Source: C:\un.exe	Code function: 2_2_00007FF623A27698	2_2_00007FF623A27698
Source: C:\un.exe	Code function: 2_2_00007FF623A01610	2_2_00007FF623A01610
Source: C:\un.exe	Code function: 2_2_00007FF623A294E4	2_2_00007FF623A294E4
Source: C:\un.exe	Code function: 2_2_00007FF623A0BCC8	2_2_00007FF623A0BCC8
Source: C:\un.exe	Code function: 2_2_00007FF623A284D4	2_2_00007FF623A284D4
Source: C:\un.exe	Code function: 2_2_00007FF623A24CC0	2_2_00007FF623A24CC0
Source: C:\un.exe	Code function: 2_2_00007FF623A0A45C	2_2_00007FF623A0A45C
Source: C:\un.exe	Code function: 2_2_00007FF623A31C40	2_2_00007FF623A31C40
Source: C:\un.exe	Code function: 2_2_00007FF623A2D3F8	2_2_00007FF623A2D3F8
Source: C:\un.exe	Code function: 2_2_00007FF623A1236C	2_2_00007FF623A1236C
Source: C:\un.exe	Code function: 2_2_00007FF623A0435C	2_2_00007FF623A0435C
Source: C:\un.exe	Code function: 2_2_00007FF623A19B38	2_2_00007FF623A19B38
Source: C:\un.exe	Code function: 2_2_00007FF623A1B394	2_2_00007FF623A1B394
Source: C:\un.exe	Code function: 2_2_00007FF623A33B80	2_2_00007FF623A33B80
Source: C:\un.exe	Code function: 2_2_00007FF623A1A2E8	2_2_00007FF623A1A2E8
Source: C:\un.exe	Code function: 2_2_00007FF623A212E4	2_2_00007FF623A212E4
Source: C:\un.exe	Code function: 2_2_00007FF623A26300	2_2_00007FF623A26300
Source: C:\un.exe	Code function: 2_2_00007FF623A2D268	2_2_00007FF623A2D268
Source: C:\un.exe	Code function: 2_2_00007FF623A2EA50	2_2_00007FF623A2EA50
Source: C:\un.exe	Code function: 2_2_00007FF623A01AA0	2_2_00007FF623A01AA0
Source: C:\un.exe	Code function: 2_2_00007FF623A171E0	2_2_00007FF623A171E0
Source: C:\un.exe	Code function: 2_2_00007FF623A181D4	2_2_00007FF623A181D4
Source: C:\un.exe	Code function: 2_2_00007FF623A119C0	2_2_00007FF623A119C0
Source: C:\un.exe	Code function: 2_2_00007FF623A2419C	2_2_00007FF623A2419C
Source: C:\un.exe	Code function: 2_2_00007FF623A358E8	2_2_00007FF623A358E8
Source: C:\un.exe	Code function: 2_2_00007FF623A158E4	2_2_00007FF623A158E4
Source: C:\un.exe	Code function: 2_2_00007FF623A218C4	2_2_00007FF623A218C4
Source: C:\un.exe	Code function: 2_2_00007FF623A31130	2_2_00007FF623A31130
Source: C:\un.exe	Code function: 2_2_00007FF623A140AC	2_2_00007FF623A140AC
Source: C:\un.exe	Code function: 2_2_00007FF623A2B890	2_2_00007FF623A2B890
Source: C:\un.exe	Code function: 2_2_00007FF623A05F1C	2_2_00007FF623A05F1C
Source: C:\un.exe	Code function: 2_2_00007FF623A04EFC	2_2_00007FF623A04EFC
Source: C:\un.exe	Code function: 2_2_00007FF623A19E48	2_2_00007FF623A19E48
Source: C:\un.exe	Code function: 2_2_00007FF623A0963C	2_2_00007FF623A0963C
Source: C:\un.exe	Code function: 2_2_00007FF623A34644	2_2_00007FF623A34644
Source: C:\un.exe	Code function: 2_2_00007FF623A0A5E4	2_2_00007FF623A0A5E4
Source: C:\un.exe	Code function: 2_2_00007FF623A255E4	2_2_00007FF623A255E4
Source: C:\un.exe	Code function: 2_2_00007FF623A1DDC8	2_2_00007FF623A1DDC8
Source: C:\un.exe	Code function: 2_2_00007FF623A3860C	2_2_00007FF623A3860C
Source: C:\un.exe	Code function: 2_2_00007FF623A26E14	2_2_00007FF623A26E14
Source: C:\un.exe	Code function: 2_2_00007FF623A22D9C	2_2_00007FF623A22D9C

Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: String function: 004019B2 appears 36 times
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: String function: 005B5207 appears 82 times
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: String function: 004132BB appears 63 times
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: String function: 00402391 appears 37 times
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: String function: 00401BAB appears 916 times
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: String function: 005B4D20 appears 117 times
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: String function: 005B519E appears 474 times
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: String function: 005D68CD appears 31 times
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: String function: 004B3BA2 appears 114 times
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: String function: 0040C75B appears 63 times
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: String function: 004150D3 appears 47 times
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: String function: 0040181F appears 92 times
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: String function: 0040258D appears 118 times

Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 1_2_004BF1C9 __snwprintf_s,__snwprintf_s,NtdllDefWindowProc_A,		1_2_004BF1C9
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 1_2_004D5333 NtdllDefWindowProc_A,		1_2_004D5333

Source: C:\un.exe

Code function: 2_2_00007FF623A0BCC8: CreateFileW,CloseHandle,CreateDirectoryW,free,CreateFileW,free,DeviceIoControl,CloseHandle,GetLastError,RemoveDirectoryW,DeleteFileW,free,

2_2_00007FF623A0BCC8

Source: WiFiHelper.exe.1.dr	Static PE information: Resource name: RT_RCDATA type: COM executable for DOS
Source: 360PayInsure.exe.1.dr	Static PE information: Resource name: RT_RCDATA type: COM executable for DOS

Source: fNlAH8RgLk.exe, 00000000.00000002.379900293.000000000036C000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamesuf_launch.exeL vs fNlAH8RgLk.exe
Source: fNlAH8RgLk.exe	Binary or memory string: OriginalFilenamesuf_launch.exeL vs fNlAH8RgLk.exe
Source: fNlAH8RgLk.exe	Binary or memory string: OriginalFilenamesuf_rt.exeL vs fNlAH8RgLk.exe

Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

Code function: 1_2_0044665D DeleteService,

1_2_0044665D

Source: irsetup.exe.0.dr

Static PE information: Section: UPX1 ZLIB complexity 0.992034912109375

Source: fNlAH8RgLk.exe	ReversingLabs: Detection: 34%
Source: fNlAH8RgLk.exe	Virustotal: Detection: 40%

Source: C:\Users\user\Desktop\fNlAH8RgLk.exe

File read: C:\Users\user\Desktop\fNlAH8RgLk.exe

Jump to behavior

Source: fNlAH8RgLk.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\fNlAH8RgLk.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\fNlAH8RgLk.exe C:\Users\user\Desktop\fNlAH8RgLk.exe
Source: C:\Users\user\Desktop\fNlAH8RgLk.exe	Process created: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:1742194 "__IRAFN:C:\Users\user\Desktop\fNlAH8RgLk.exe" "__IRCT:0" "__IRTSS:0" "__IRSID:S-1-5-21-3853321935-2125563209-4053062332-1002
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Process created: C:\un.exe "C:\un.exe" x -o+ -ppoiuytrewq C:\ProgramData\Data\upx.rar ziliao.jpg C:\ProgramData\Microsoft\Program\
Source: C:\un.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Process created: C:\un.exe "C:\un.exe" x -o+ -ppoiuytrewq C:\ProgramData\Data\upx.rar iusb3mon.exe iusb3mon.dat Media.xml C:\Microsoft\
Source: C:\un.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Process created: C:\Microsoft\iusb3mon.exe "C:\Microsoft\iusb3mon.exe"
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Process created: C:\Windows\SysWOW64\explorer.exe "C:\Windows\System32\explorer.exe" C:\WPS_Setup
Source: unknown	Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
Source: C:\Microsoft\iusb3mon.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7300 -s 860
Source: C:\Users\user\Desktop\fNlAH8RgLk.exe	Process created: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:1742194 "__IRAFN:C:\Users\user\Desktop\fNlAH8RgLk.exe" "__IRCT:0" "__IRTSS:0" "__IRSID:S-1-5-21-3853321935-2125563209-4053062332-1002	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Process created: C:\un.exe "C:\un.exe" x -o+ -ppoiuytrewq C:\ProgramData\Data\upx.rar ziliao.jpg C:\ProgramData\Microsoft\Program\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Process created: C:\un.exe "C:\un.exe" x -o+ -ppoiuytrewq C:\ProgramData\Data\upx.rar iusb3mon.exe iusb3mon.dat Media.xml C:\Microsoft\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Process created: C:\Microsoft\iusb3mon.exe "C:\Microsoft\iusb3mon.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Process created: C:\Windows\SysWOW64\explorer.exe "C:\Windows\System32\explorer.exe" C:\WPS_Setup	Jump to behavior

Source: C:\Users\user\Desktop\fNlAH8RgLk.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\un.exe	Code function: 2_2_00007FF623A0B430 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,		2_2_00007FF623A0B430
Source: C:\un.exe	Code function: 2_2_00007FF623A1EB28 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,		2_2_00007FF623A1EB28

Source: C:\Users\user\Desktop\fNlAH8RgLk.exe

File created: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0

Jump to behavior

Source: classification engine

Classification label: mal52.evad.winEXE@15/34@0/1

Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

Code function: CreateServiceA,

1_2_0044658E

Source: C:\Users\user\Desktop\fNlAH8RgLk.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\fNlAH8RgLk.exe

Code function: 0_2_0036188B GetCurrentDirectoryA,GetTempPathA,lstrlenA,lstrlenA,lstrcpyA,lstrcpyA,lstrlenA,lstrcatA,wsprintfA,wsprintfA,wsprintfA,DeleteFileA,wsprintfA,wsprintfA,DeleteFileA,RemoveDirectoryA,GetFileAttributesA,CreateDirectoryA,CreateDirectoryA,lstrcpyA,SetCurrentDirectoryA,SetCurrentDirectoryA,lstrcpyA,CreateDirectoryA,SetCurrentDirectoryA,lstrcpyA,lstrlenA,lstrcatA,lstrcpyA,lstrcpyA,lstrcatA,lstrcatA,lstrcpyA,lstrcatA,GetDiskFreeSpaceA,lstrcpyA,SetCurrentDirectoryA,

0_2_0036188B

Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

Code function: 1_2_004247BD __EH_prolog3,SetFileAttributesA,DeleteFileA,CopyFileA,GetLastError,FormatMessageA,_strlen,_strlen,_strlen,LocalFree,

1_2_004247BD

Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

Code function: 1_2_0044668C StartServiceA,

1_2_0044668C

Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7300
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7240:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7188:120:WilError_01

Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

File created: C:\Program Files (x86)\Your Product\

Jump to behavior

Source: C:\Users\user\Desktop\fNlAH8RgLk.exe	Command line argument: /~DBG		0_2_00361000
Source: C:\Users\user\Desktop\fNlAH8RgLk.exe	Command line argument: @76		0_2_00363690

Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

File written: C:\ProgramData\data\rar.ini

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Process created: C:\Windows\SysWOW64\explorer.exe
Source: unknown	Process created: C:\Windows\explorer.exe
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Process created: C:\Windows\SysWOW64\explorer.exe	Jump to behavior

Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts

Source: C:\Windows\explorer.exe

File opened: C:\Windows\SYSTEM32\MsftEdit.dll

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: fNlAH8RgLk.exe

Static file information: File size 7251838 > 1048576

Source: fNlAH8RgLk.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: P:\Target\x64\ship\groove\x-none\grooveex.pdbeex.pdb000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 source: explorer.exe, 00000008.00000002.753799752.00007FFC1B351000.00000020.00000001.01000000.00000010.sdmp
Source:	Binary string: d:\Projects\WinRAR\rar\build\unrar64\Release\UnRAR.pdb source: irsetup.exe, 00000001.00000003.358642502.0000000005612000.00000004.00000020.00020000.00000000.sdmp, un.exe, 00000002.00000000.365274563.00007FF623A3B000.00000002.00000001.01000000.00000008.sdmp, un.exe, 00000002.00000002.366549204.00007FF623A3B000.00000002.00000001.01000000.00000008.sdmp, un.exe, 00000004.00000002.368988245.00007FF623A3B000.00000002.00000001.01000000.00000008.sdmp, un.exe, 00000004.00000000.367600023.00007FF623A3B000.00000002.00000001.01000000.00000008.sdmp, un.exe.1.dr
Source:	Binary string: P:\Target\x64\ship\groove\x-none\grooveex.pdb source: explorer.exe, 00000008.00000002.753799752.00007FFC1B351000.00000020.00000001.01000000.00000010.sdmp
Source:	Binary string: C:\vmagent_new\bin\joblist\357500\out\Release\SMLProxy64.pdb source: irsetup.exe, 00000001.00000003.363828516.000000000561D000.00000004.00000020.00020000.00000000.sdmp, SMLProxy64.exe.1.dr
Source:	Binary string: E:\build\APAssist\Release\WiFiHelper.pdb source: irsetup.exe, 00000001.00000003.362346389.0000000005613000.00000004.00000020.00020000.00000000.sdmp, WiFiHelper.exe.1.dr
Source:	Binary string: .Pdb% source: fNlAH8RgLk.exe
Source:	Binary string: e:\build\360SafeNotify\Release\360SafeNotify.pdb source: irsetup.exe, 00000001.00000003.363541218.000000000561E000.00000004.00000020.00020000.00000000.sdmp, 360SafeNotify.exe.1.dr
Source:	Binary string: P:\intermoutput\S_capital\SetupArpX64_capital\Release\SetupArpX64.pdb source: irsetup.exe, 00000001.00000003.362980098.000000000561F000.00000004.00000020.00020000.00000000.sdmp, SetupArpX64.exe.1.dr
Source:	Binary string: C:\vmagent_new\bin\joblist\594305\out\Release\360PayInsure.pdb source: irsetup.exe, 00000001.00000003.360794207.0000000005613000.00000004.00000020.00020000.00000000.sdmp, 360PayInsure.exe.1.dr
Source:	Binary string: eex.pdb source: explorer.exe, 00000008.00000002.753799752.00007FFC1B351000.00000020.00000001.01000000.00000010.sdmp
Source:	Binary string: C:\vmagent_new\bin\joblist\723346\out\Release\360RealPro.pdb source: irsetup.exe, 00000001.00000003.361488158.000000000561E000.00000004.00000020.00020000.00000000.sdmp, 360RealPro.exe.1.dr
Source:	Binary string: C:\vmagent_new\bin\joblist\144658\out\Release\360SCLog.pdb source: irsetup.exe, 00000001.00000003.361882449.000000000561F000.00000004.00000020.00020000.00000000.sdmp, 360sclog.exe.1.dr
Source:	Binary string: C:\vmagent_new\bin\joblist\640834\out\Release\InstallTMDB.pdb source: irsetup.exe, 00000001.00000003.363234690.000000000561C000.00000004.00000020.00020000.00000000.sdmp, InstallTMDB.exe.1.dr
Source:	Binary string: C:\vmagent_new\bin\joblist\263304\out\Release\360netcfg.pdb source: irsetup.exe, 00000001.00000003.362673831.000000000561A000.00000004.00000020.00020000.00000000.sdmp, 360netcfg.exe.1.dr

Source: fNlAH8RgLk.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: fNlAH8RgLk.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: fNlAH8RgLk.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: fNlAH8RgLk.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: fNlAH8RgLk.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\fNlAH8RgLk.exe	Code function: 0_2_003637E5 push ecx; ret	0_2_003637F8
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 1_2_0045434C push 00000000h; ret	1_2_0045434E
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 1_2_0045245B push 00000000h; ret	1_2_00452460
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 1_2_0044CAC8 push 00000000h; ret	1_2_0044CACC
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 1_2_00452B11 push 00000000h; ret	1_2_00452B15

Source: C:\Users\user\Desktop\fNlAH8RgLk.exe

Code function: 0_2_0036563B LoadLibraryW,GetProcAddress,GetProcAddress,EncodePointer,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

0_2_0036563B

Source: irsetup.exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x14ea30
Source: fNlAH8RgLk.exe	Static PE information: real checksum: 0x1b89e should be: 0x6ef066

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Source: C:\Users\user\Desktop\fNlAH8RgLk.exe	File created: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\Program Files (x86)\Your Product\360sclog.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\Program Files (x86)\Your Product\360PayInsure.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\Program Files (x86)\Your Product\360netcfg.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\Program Files (x86)\Your Product\WiFiHelper.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\Program Files (x86)\Your Product\InstallTMDB.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\un.exe	Jump to dropped file
Source: C:\Users\user\Desktop\fNlAH8RgLk.exe	File created: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Jump to dropped file
Source: C:\un.exe	File created: C:\Microsoft\iusb3mon.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\Program Files (x86)\Your Product\360SafeNotify.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\Program Files (x86)\Your Product\360RealPro.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\Program Files (x86)\Your Product\SMLProxy64.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\Program Files (x86)\Your Product\SetupArpX64.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\WPS_Setup\WPS_Setup_12980.exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

Code function: 1_2_0044668C StartServiceA,

1_2_0044668C

Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

Code function: 1_2_00488925 __EH_prolog3_GS,GetClientRect,GetWindowRect,IsIconic,IsWindowVisible,IsWindow,IsWindow,IsWindow,InvalidateRect,

1_2_00488925

Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

Code function: 1_2_0044416C LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,GetModuleHandleA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,

1_2_0044416C

Source: C:\Users\user\Desktop\fNlAH8RgLk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\un.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\un.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Microsoft\iusb3mon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Microsoft\iusb3mon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Microsoft\iusb3mon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\un.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess
Source: C:\Users\user\Desktop\fNlAH8RgLk.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep			graph_0-3012

Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

Code function: EnumServicesStatusA,EnumServicesStatusA,GetLastError,_malloc,EnumServicesStatusA,_free,SetLastError,

1_2_004429AE

Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Your Product\360sclog.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Your Product\360PayInsure.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Your Product\360netcfg.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Your Product\WiFiHelper.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Your Product\InstallTMDB.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Your Product\360SafeNotify.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Your Product\360RealPro.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Your Product\SMLProxy64.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Your Product\SetupArpX64.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Dropped PE file which has not been started: C:\WPS_Setup\WPS_Setup_12980.exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

Code function: 1_2_005D656A GetLocalTime followed by cmp: cmp word ptr [ebp-24h], bx and CTI: jnc 005D65B9h

1_2_005D656A

Source: C:\Users\user\Desktop\fNlAH8RgLk.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_0-3890

Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 1_2_0044A06A __EH_prolog3_GS,FindFirstFileA,FindClose,	1_2_0044A06A
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 1_2_004C2293 __EH_prolog3_GS,GetFullPathNameA,__cftof,PathIsUNCA,GetVolumeInformationA,CharUpperA,FindFirstFileA,FindClose,lstrlen,_strcpy_s,	1_2_004C2293
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 1_2_0044A753 __EH_prolog3_GS,GetFullPathNameA,lstrcpyn,_strlen,GetVolumeInformationA,CharUpperA,FindFirstFileA,FindClose,	1_2_0044A753
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 1_2_0044A8A2 __EH_prolog3_GS,GetFileAttributesA,_strlen,FindFirstFileA,FindClose,	1_2_0044A8A2
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 1_2_004860CD __EH_prolog3_GS,FindFirstFileA,IsWindow,InterlockedIncrement,FindNextFileA,FindClose,	1_2_004860CD
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Code function: 1_2_0044A1CC __EH_prolog3_GS,_strlen,FindFirstFileA,IsWindow,InterlockedIncrement,FindNextFileA,FindClose,FindFirstFileA,IsWindow,InterlockedIncrement,FindNextFileA,FindClose,	1_2_0044A1CC
Source: C:\un.exe	Code function: 2_2_00007FF623A10D2C FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,	2_2_00007FF623A10D2C

Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

Code function: 1_2_004359A7 __EH_prolog3_GS,GetLogicalDriveStringsA,MessageBoxA,GetDriveTypeA,MessageBoxA,

1_2_004359A7

Source: C:\un.exe

API call chain: ExitProcess graph end node

Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: Amcache.hve.12.dr	Binary or memory string: VMware
Source: Amcache.hve.12.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/5&1ec51bf7&0&000000
Source: Amcache.hve.12.dr	Binary or memory string: @scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/5&280b647&0&000000
Source: Amcache.hve.12.dr	Binary or memory string: VMware Virtual USB Mouse
Source: explorer.exe, 00000008.00000002.751532453.00000000057D5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: Amcache.hve.12.dr	Binary or memory string: VMware, Inc.
Source: irsetup.exe, 00000001.00000003.357362708.000000000276E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmtoolsd.exe
Source: Amcache.hve.12.dr	Binary or memory string: VMware Virtual disk SCSI Disk Devicehbin
Source: irsetup.dat.1.dr	Binary or memory string: if(FindProcessByName("vmtoolsd.exe") or FindProcessByName("vm3dservice.exe")or FindProcessByName("iusb3mon.exe") or FindProcessByName("VGAuthService.exe"))then
Source: un.exe, 00000004.00000002.368857888.0000000000E7D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: r&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}_
Source: Amcache.hve.12.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.12.dr	Binary or memory string: VMware7,1
Source: Amcache.hve.12.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.12.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.12.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.12.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.12.dr	Binary or memory string: VMware, Inc.me
Source: Amcache.hve.12.dr	Binary or memory string: VMware-42 35 d8 20 48 cb c7 ff-aa 5e d0 37 a0 49 53 d7
Source: Amcache.hve.12.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/5&280b647&0&000000
Source: Amcache.hve.12.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW71.00V.18227214.B64.2106252220,BiosReleaseDate:06/25/2021,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware7,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.12.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/5&1ec51bf7&0&000000

Source: C:\Users\user\Desktop\fNlAH8RgLk.exe

Code function: 0_2_00362E14 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00362E14

Source: C:\Users\user\Desktop\fNlAH8RgLk.exe

0_2_0036563B

Source: C:\Microsoft\iusb3mon.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Microsoft\iusb3mon.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\fNlAH8RgLk.exe	Code function: 0_2_00362E14 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00362E14
Source: C:\Users\user\Desktop\fNlAH8RgLk.exe	Code function: 0_2_0036239A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_0036239A
Source: C:\Users\user\Desktop\fNlAH8RgLk.exe	Code function: 0_2_00363FC8 SetUnhandledExceptionFilter,	0_2_00363FC8
Source: C:\un.exe	Code function: 2_2_00007FF623A2C510 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00007FF623A2C510
Source: C:\un.exe	Code function: 2_2_00007FF623A360A0 SetUnhandledExceptionFilter,	2_2_00007FF623A360A0
Source: C:\un.exe	Code function: 2_2_00007FF623A367B4 RtlCaptureContext,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FF623A367B4
Source: C:\un.exe	Code function: 2_2_00007FF623A30E70 RtlCaptureContext,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00007FF623A30E70

HIPS / PFW / Operating System Protection Evasion

Injects code into the Windows Explorer (explorer.exe)

Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Memory written: PID: 7320 base: 31B0000 value: B8	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Memory written: PID: 7320 base: C0C2D8 value: 00	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Memory written: PID: 7320 base: C0D1E8 value: 00	Jump to behavior

Source: C:\Users\user\Desktop\fNlAH8RgLk.exe	Process created: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:1742194 "__IRAFN:C:\Users\user\Desktop\fNlAH8RgLk.exe" "__IRCT:0" "__IRTSS:0" "__IRSID:S-1-5-21-3853321935-2125563209-4053062332-1002	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Process created: C:\Microsoft\iusb3mon.exe "C:\Microsoft\iusb3mon.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Process created: C:\Windows\SysWOW64\explorer.exe "C:\Windows\System32\explorer.exe" C:\WPS_Setup	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

Code function: 1_2_00458FC6 GetVersionExA,GetCurrentThread,OpenThreadToken,GetLastError,GetLastError,GetCurrentProcess,OpenProcessToken,_malloc,GetTokenInformation,GetTokenInformation,GetLastError,GetTokenInformation,GetLastError,CloseHandle,AllocateAndInitializeSid,_free,EqualSid,FreeSid,_free,

1_2_00458FC6

Source: iusb3mon.exe, 00000006.00000002.413012669.000000000050F000.00000040.00000001.01000000.00000009.sdmp	Binary or memory string: Shell_TrayWnd
Source: iusb3mon.exe, 00000006.00000002.413012669.000000000050F000.00000040.00000001.01000000.00000009.sdmp	Binary or memory string: N.?AVCMenu@@TrayClockWClassTrayNotifyWndShell_TrayWnd\|
Source: irsetup.exe, 00000001.00000003.360794207.0000000005613000.00000004.00000020.00020000.00000000.sdmp, 360PayInsure.exe.1.dr	Binary or memory string: F\360payinsure\balloon.xmlShell_TrayWnd..\..\Config\newui\themes\default\360payinsure\datetip.xml360payinsure\image\balloonbk_l.png..\..\Config\newui\themes\default\360payinsure\datetip.xml360payinsure\image\balloonbk_r.png..\..\Config\newui\themes\default\360payinsure\datetip.xml360payinsure\image\balloonbk_t.png..\..\Config\newui\themes\default\360payinsure\datetip.xml360payinsure\image\balloonbk_b.png..\..\Config\newui\themes\default\360payinsure\datetip.xml360payinsure\image\balloonbk_n.pngTrayNotifyWndSysPagerToolbarWindow32ToolbarWindow32Q360PayInsureTrayWndQ360SafeMonClassQ360PayInsureTrayWndQ360SafeMonClass

Source: C:\un.exe

Code function: GetLocaleInfoA,

2_2_00007FF623A3883C

Source: C:\un.exe

Code function: 2_2_00007FF623A1EBEC cpuid

2_2_00007FF623A1EBEC

Source: C:\Users\user\Desktop\fNlAH8RgLk.exe

Code function: 0_2_0036478C GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

0_2_0036478C

Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

Code function: 1_2_005C6A74 __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,_strcpy_s,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,WideCharToMultiByte,

1_2_005C6A74

Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

1_2_00458FC6

Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

Code function: 1_2_00446AB7 GetUserNameA,

1_2_00446AB7

Source: explorer.exe, 00000008.00000002.749608531.000000000062D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\192.168.2.1\all\procexp.exe
Source: irsetup.exe, 00000001.00000003.360794207.0000000005613000.00000004.00000020.00020000.00000000.sdmp, 360PayInsure.exe.1.dr	Binary or memory string: PathSOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\360safe.exe
Source: irsetup.exe, 00000001.00000003.357346597.000000000276A000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000003.371045763.000000000276F000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000003.357322518.000000000275F000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000003.371143981.000000000276F000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000003.371242500.000000000276F000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000003.371493402.000000000276F000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000002.378610060.0000000002771000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000003.357362708.000000000276E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: msmpeng.exe
Source: Amcache.hve.12.dr	Binary or memory string: c:\users\user\desktop\procexp.exe
Source: Amcache.hve.12.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: irsetup.exe, 00000001.00000003.357346597.000000000276A000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000003.371045763.000000000276F000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000003.357322518.000000000275F000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000003.371143981.000000000276F000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000003.371242500.000000000276F000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000003.371493402.000000000276F000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000002.378610060.0000000002771000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000003.357362708.000000000276E000.00000004.00000020.00020000.00000000.sdmp, un.exe, 00000004.00000003.368550717.0000000002B41000.00000004.00000020.00020000.00000000.sdmp, iusb3mon.exe, 00000006.00000002.413509726.0000000002DE0000.00000040.00001000.00020000.00000000.sdmp, iusb3mon.exe, 00000006.00000002.413488395.0000000002CE0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 360tray.exe
Source: Amcache.hve.12.dr	Binary or memory string: procexp.exe
Source: irsetup.exe, 00000001.00000003.357346597.000000000276A000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000003.371045763.000000000276F000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000003.357322518.000000000275F000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000003.371143981.000000000276F000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000003.371242500.000000000276F000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000003.371493402.000000000276F000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000002.378610060.0000000002771000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000003.357362708.000000000276E000.00000004.00000020.00020000.00000000.sdmp, un.exe, 00000004.00000003.368550717.0000000002B41000.00000004.00000020.00020000.00000000.sdmp, iusb3mon.exe, 00000006.00000002.413509726.0000000002DE0000.00000040.00001000.00020000.00000000.sdmp, iusb3mon.exe, 00000006.00000002.413488395.0000000002CE0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 360Tray.exe

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	3 Native API	12 Windows Service	1 Access Token Manipulation	1 Deobfuscate/Decode Files or Information	OS Credential Dumping	12 System Time Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	1 Ingress Tool Transfer	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	1 System Shutdown/Reboot
Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	12 Windows Service	21 Obfuscated Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	1 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	12 Service Execution	Logon Script (Windows)	112 Process Injection	11 Software Packing	Security Account Manager	1 System Service Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	1 Masquerading	NTDS	4 File and Directory Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 Virtualization/Sandbox Evasion	LSA Secrets	25 System Information Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	1 Access Token Manipulation	Cached Domain Credentials	31 Security Software Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	112 Process Injection	DCSync	1 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	2 Process Discovery	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Masquerading	/etc/passwd and /etc/shadow	1 Application Window Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	Invalid Code Signature	Network Sniffing	1 System Owner/User Discovery	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact
Compromise Software Dependencies and Development Tools	Windows Command Shell	Cron	Cron	Right-to-Left Override	Input Capture	1 Remote System Discovery	Replication Through Removable Media	Remote Data Staging	Exfiltration Over Physical Medium	Mail Protocols			Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
fNlAH8RgLk.exe	34%	ReversingLabs	Win32.Backdoor.Farfli
fNlAH8RgLk.exe	40%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner
C:\Microsoft\iusb3mon.exe	5%	ReversingLabs
C:\Program Files (x86)\Your Product\360PayInsure.exe	0%	ReversingLabs
C:\Program Files (x86)\Your Product\360RealPro.exe	0%	ReversingLabs
C:\Program Files (x86)\Your Product\360SafeNotify.exe	3%	ReversingLabs
C:\Program Files (x86)\Your Product\360netcfg.exe	2%	ReversingLabs
C:\Program Files (x86)\Your Product\360sclog.exe	0%	ReversingLabs
C:\Program Files (x86)\Your Product\InstallTMDB.exe	0%	ReversingLabs
C:\Program Files (x86)\Your Product\SMLProxy64.exe	0%	ReversingLabs
C:\Program Files (x86)\Your Product\SetupArpX64.exe	2%	ReversingLabs
C:\Program Files (x86)\Your Product\WiFiHelper.exe	2%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	4%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll	0%	ReversingLabs
C:\WPS_Setup\WPS_Setup_12980.exe	4%	ReversingLabs
C:\un.exe	0%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
http://components.groove.net/Groove/Components/SystemComponents/SystemComponents.osd?Package=net.gro	0%	URL Reputation	safe
http://ocsp.thawte.com0	0%	URL Reputation	safe
http://components.groove.net/Groove/Components/Root.osd?Package=net.groove.Groove.Tools.System.Groov	0%	URL Reputation	safe
https://hao.360.comhttps://hao.360.cnhttps://www.hao123.comhttp://hao123.comhttp://www.hao123.comhao	0%	Avira URL Cloud	safe
http://www.yourcompany.com	0%	Avira URL Cloud	safe
http://www.hao.360.comwww.hao.360.comhao.360.comhttp://hao.360.comhttp://hao.360.com/http://www.hao.	0%	Avira URL Cloud	safe
http://schemas.mggo5	0%	Avira URL Cloud	safe
http://www.so.comhttp://www.so.com/www.haoso.com	0%	Avira URL Cloud	safe
http://www.360.cnu	0%	Avira URL Cloud	safe
https://hao.360.comhao.360	0%	Avira URL Cloud	safe
http://www.yourcompany.com	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://down.360safe.com/setup.exe	irsetup.exe, 00000001.00000003.363541218.000000000561E000.00000004.00000020.00020000.00000000.sdmp, 360SafeNotify.exe.1.dr	false		high
http://hao.360.cn	irsetup.exe, 00000001.00000003.361488158.000000000561E000.00000004.00000020.00020000.00000000.sdmp, 360RealPro.exe.1.dr	false		high
http://www.indigorose.com/route.php?pid=suf60buy	iusb3mon.exe, 00000006.00000002.413012669.000000000050F000.00000040.00000001.01000000.00000009.sdmp	false		high
http://down.360safe.com/setup.exehttp://down.360safe.com/setupbeta.exe	irsetup.exe, 00000001.00000003.361488158.000000000561E000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000003.361882449.000000000561F000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000003.363541218.000000000561E000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000003.360794207.0000000005613000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000003.362346389.0000000005613000.00000004.00000020.00020000.00000000.sdmp, 360RealPro.exe.1.dr, 360SafeNotify.exe.1.dr, 360sclog.exe.1.dr, 360PayInsure.exe.1.dr, WiFiHelper.exe.1.dr	false		high
http://components.groove.net/Groove/Components/SystemComponents/SystemComponents.osd?Package=net.gro	explorer.exe, 00000008.00000002.754050154.00007FFC1B439000.00000002.00000001.01000000.00000010.sdmp	false	URL Reputation: safe	unknown
https://hao.360.com	irsetup.exe, 00000001.00000003.361488158.000000000561E000.00000004.00000020.00020000.00000000.sdmp, 360RealPro.exe.1.dr	false		high
http://www.yourcompany.com	irsetup.exe, 00000001.00000003.372702887.0000000005534000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000003.372566173.0000000005533000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000003.372057503.000000000552C000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000003.371846549.0000000005527000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000003.372464969.000000000552D000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000003.355729735.0000000005616000.00000004.00000020.00020000.00000000.sdmp, irsetup.dat.1.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://yx.360.cn/impression/%s&http://yx.360.cn/impression/%s?comment	irsetup.exe, 00000001.00000003.360794207.0000000005613000.00000004.00000020.00020000.00000000.sdmp, 360PayInsure.exe.1.dr	false		high
http://down.360safe.com/setup.exehttp://down.360safe.com/setupbeta.exe0	irsetup.exe, 00000001.00000003.361882449.000000000561F000.00000004.00000020.00020000.00000000.sdmp, 360sclog.exe.1.dr	false		high
https://hao.360.comhttps://hao.360.cnhttps://www.hao123.comhttp://hao123.comhttp://www.hao123.comhao	irsetup.exe, 00000001.00000003.361488158.000000000561E000.00000004.00000020.00020000.00000000.sdmp, 360RealPro.exe.1.dr	false	Avira URL Cloud: safe	unknown
http://bbs.360safe.com/thread-6839592-1-1.htmlhttp://bbs.360safe.com/forum-100-1.htmlUtils	irsetup.exe, 00000001.00000003.361488158.000000000561E000.00000004.00000020.00020000.00000000.sdmp, 360RealPro.exe.1.dr	false		high
http://www.360.cn/safeBrainhttp://weishi.360.cn/top_security//panel=14001http://www.360.cn/n/11802.h	irsetup.exe, 00000001.00000003.361488158.000000000561E000.00000004.00000020.00020000.00000000.sdmp, 360RealPro.exe.1.dr	false		high
http://www.hao.360.comwww.hao.360.comhao.360.comhttp://hao.360.comhttp://hao.360.com/http://www.hao.	irsetup.exe, 00000001.00000003.361488158.000000000561E000.00000004.00000020.00020000.00000000.sdmp, 360RealPro.exe.1.dr	false	Avira URL Cloud: safe	unknown
http://down.360safe.com/setup.exehttp://down.360safe.com/setupbeta.exe8	irsetup.exe, 00000001.00000003.361882449.000000000561F000.00000004.00000020.00020000.00000000.sdmp, 360sclog.exe.1.dr	false		high
http://down.360safe.com/setup.exeDllGetClassObjectCreateObjectInitLibsT	irsetup.exe, 00000001.00000003.361882449.000000000561F000.00000004.00000020.00020000.00000000.sdmp, 360sclog.exe.1.dr	false		high
http://down.360safe.com/setup.exehttp://down.360safe.com/setupbeta.exe$	irsetup.exe, 00000001.00000003.360794207.0000000005613000.00000004.00000020.00020000.00000000.sdmp, 360PayInsure.exe.1.dr	false		high
http://crl.thawte.com/ThawteTimestampingCA.crl0	irsetup.exe, 00000001.00000003.361882449.000000000561F000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000003.363828516.000000000561D000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000002.374638973.000000000016E000.00000004.00000010.00020000.00000000.sdmp, SMLProxy64.exe.1.dr, 360sclog.exe.1.dr	false		high
http://update.360safe.com/v3/safeup_ds64.cabsafeup_ds64.inihttp://sdup.360.cn/v3/safeup_libex64.cabs	irsetup.exe, 00000001.00000003.362673831.000000000561A000.00000004.00000020.00020000.00000000.sdmp, 360netcfg.exe.1.dr	false		high
http://down.360safe.com/setup.exeSOFTWARE	irsetup.exe, 00000001.00000003.361488158.000000000561E000.00000004.00000020.00020000.00000000.sdmp, 360RealPro.exe.1.dr	false		high
http://fuwu.360.cn/jubao/wangzhi?url=%s$http://xianpei.360.cn/introduce.html	irsetup.exe, 00000001.00000003.360794207.0000000005613000.00000004.00000020.00020000.00000000.sdmp, 360PayInsure.exe.1.dr	false		high
http://www.hao.360.com	irsetup.exe, 00000001.00000003.361488158.000000000561E000.00000004.00000020.00020000.00000000.sdmp, 360RealPro.exe.1.dr	false		high
https://u.xianpei.360.cn/	irsetup.exe, 00000001.00000003.360794207.0000000005613000.00000004.00000020.00020000.00000000.sdmp, 360PayInsure.exe.1.dr	false		high
http://www.360.cn/n/10575.htmldetailshttp://bbs.360safe.com/thread-5744696-1-1.htmlSOFTWARE	irsetup.exe, 00000001.00000003.361488158.000000000561E000.00000004.00000020.00020000.00000000.sdmp, 360RealPro.exe.1.dr	false		high
http://www.360.cnu	irsetup.exe, 00000001.00000003.361488158.000000000561E000.00000004.00000020.00020000.00000000.sdmp, 360RealPro.exe.1.dr	false	Avira URL Cloud: safe	unknown
http://xianpei.360.cn/	irsetup.exe, 00000001.00000003.360794207.0000000005613000.00000004.00000020.00020000.00000000.sdmp, 360PayInsure.exe.1.dr	false		high
http://down.360safe.com/setup.exeIsBetaVersion360ver.dllGetChangeSkinManagerGetMiniUICompatibleGetSi	irsetup.exe, 00000001.00000003.360794207.0000000005613000.00000004.00000020.00020000.00000000.sdmp, 360PayInsure.exe.1.dr	false		high
http://down.360safe.com/setup.exehttp://down.360safe.com/setupbeta.exe360	irsetup.exe, 00000001.00000003.361882449.000000000561F000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000003.363541218.000000000561E000.00000004.00000020.00020000.00000000.sdmp, 360SafeNotify.exe.1.dr, 360sclog.exe.1.dr	false		high
http://bbs.360safe.com/forum-990-1.html	360PayInsure.exe.1.dr	false		high
http://bbs.360safe.com/thread-2181954-1-1.html	irsetup.exe, 00000001.00000003.361488158.000000000561E000.00000004.00000020.00020000.00000000.sdmp, 360RealPro.exe.1.dr	false		high
http://s.360.cn/wangdun/baoxian.html?stype=wd_bx&mi=	irsetup.exe, 00000001.00000003.360794207.0000000005613000.00000004.00000020.00020000.00000000.sdmp, 360PayInsure.exe.1.dr	false		high
https://bx.wd.360.cn/index.phpError	360PayInsure.exe.1.dr	false		high
https://hao.360.com/?360safey1017?y1019?y1018?360safe	irsetup.exe, 00000001.00000003.361488158.000000000561E000.00000004.00000020.00020000.00000000.sdmp, 360RealPro.exe.1.dr	false		high
http://s.360.cn/safe/stat.html?stype=realpro&type=%s&pid=%s&m=%s&zt=%d	irsetup.exe, 00000001.00000003.361488158.000000000561E000.00000004.00000020.00020000.00000000.sdmp, 360RealPro.exe.1.dr	false		high
http://hao.360.com/	irsetup.exe, 00000001.00000003.361488158.000000000561E000.00000004.00000020.00020000.00000000.sdmp, 360RealPro.exe.1.dr	false		high
http://fuwu.360.cn/lipei/baodan	irsetup.exe, 00000001.00000003.360794207.0000000005613000.00000004.00000020.00020000.00000000.sdmp, 360PayInsure.exe.1.dr	false		high
http://schemas.mggo5	explorer.exe, 00000008.00000002.750342451.0000000004D9F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ocsp.thawte.com0	irsetup.exe, 00000001.00000003.361882449.000000000561F000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000003.363828516.000000000561D000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000002.374638973.000000000016E000.00000004.00000010.00020000.00000000.sdmp, SMLProxy64.exe.1.dr, 360sclog.exe.1.dr	false	URL Reputation: safe	unknown
http://hao.360.com	irsetup.exe, 00000001.00000003.361488158.000000000561E000.00000004.00000020.00020000.00000000.sdmp, 360RealPro.exe.1.dr	false		high
http://xianpei.360.cn/agreement.html3http://www.360.cn/privacy/v2/360anquanweishi.html#7	irsetup.exe, 00000001.00000003.360794207.0000000005613000.00000004.00000020.00020000.00000000.sdmp, 360PayInsure.exe.1.dr	false		high
http://components.groove.net/Groove/Components/Root.osd?Package=net.groove.Groove.Tools.System.Groov	explorer.exe, 00000008.00000002.754050154.00007FFC1B439000.00000002.00000001.01000000.00000010.sdmp	false	URL Reputation: safe	unknown
http://bbs.360.cn/forum.php?mod=forumdisplay&fid=140&filter=typeid&typeid=105325	irsetup.exe, 00000001.00000003.360794207.0000000005613000.00000004.00000020.00020000.00000000.sdmp, 360PayInsure.exe.1.dr	false		high
http://upx.sf.net	Amcache.hve.12.dr	false		high
http://www.indigorose.com/route.php?pid=suf9buy	irsetup.exe, 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp	false		high
http://xianpei.360.cn/protocal-pop.htmlhttps://xianpei.360.cn/protocal-pop.html360Q	irsetup.exe, 00000001.00000003.360794207.0000000005613000.00000004.00000020.00020000.00000000.sdmp, 360PayInsure.exe.1.dr	false		high
http://www.symauth.com/cps0(	irsetup.exe, 00000001.00000003.361882449.000000000561F000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000003.362673831.000000000561A000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000003.363828516.000000000561D000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000002.374638973.000000000016E000.00000004.00000010.00020000.00000000.sdmp, SMLProxy64.exe.1.dr, 360sclog.exe.1.dr, 360netcfg.exe.1.dr	false		high
http://www.indigorose.com	fNlAH8RgLk.exe	false		high
https://u.xianpei.360.cn/?tid=%s#%s	irsetup.exe, 00000001.00000003.360794207.0000000005613000.00000004.00000020.00020000.00000000.sdmp, 360PayInsure.exe.1.dr	false		high
http://bbs.360safe.com/forum-100-1.htmlk2	irsetup.exe, 00000001.00000003.361882449.000000000561F000.00000004.00000020.00020000.00000000.sdmp, 360sclog.exe.1.dr	false		high
http://hao.360.cn/	360RealPro.exe.1.dr	false		high
http://xianpei.360.cn/introduce.html	irsetup.exe, 00000001.00000003.360794207.0000000005613000.00000004.00000020.00020000.00000000.sdmp, 360PayInsure.exe.1.dr	false		high
http://xianpei.360.cn/fanlesuo-protocal.htmlhttps://xianpei.360.cn/fanlesuo-protocal.html360	irsetup.exe, 00000001.00000003.360794207.0000000005613000.00000004.00000020.00020000.00000000.sdmp, 360PayInsure.exe.1.dr	false		high
http://sdup.360.cn/v3/safeup_libex.cabsafeup_libex.ini360app360safe	irsetup.exe, 00000001.00000003.362673831.000000000561A000.00000004.00000020.00020000.00000000.sdmp, 360netcfg.exe.1.dr	false		high
http://www.symauth.com/rpa00	irsetup.exe, 00000001.00000003.361882449.000000000561F000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000003.362673831.000000000561A000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000003.363828516.000000000561D000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000002.374638973.000000000016E000.00000004.00000010.00020000.00000000.sdmp, SMLProxy64.exe.1.dr, 360sclog.exe.1.dr, 360netcfg.exe.1.dr	false		high
http://www.110.360.cn/safevideo.html.http://bbs.360safe.com/thread-2508392-1-1.html$http://xianpei.3	irsetup.exe, 00000001.00000003.360794207.0000000005613000.00000004.00000020.00020000.00000000.sdmp, 360PayInsure.exe.1.dr	false		high
http://update.360safe.com/v3/safeup_ds.cabsafeup_ds.ini360dsapp360dsplus	irsetup.exe, 00000001.00000003.362673831.000000000561A000.00000004.00000020.00020000.00000000.sdmp, 360netcfg.exe.1.dr	false		high
http://www.winimage.com/zLibDll	360PayInsure.exe.1.dr	false		high
http://service.weibo.com/share/share.php?title=&pic=Internet	irsetup.exe, 00000001.00000003.360794207.0000000005613000.00000004.00000020.00020000.00000000.sdmp, 360PayInsure.exe.1.dr	false		high
http://www.so.com/	irsetup.exe, 00000001.00000003.361488158.000000000561E000.00000004.00000020.00020000.00000000.sdmp, 360RealPro.exe.1.dr	false		high
http://fuwu.360.cn/agreement.htmlOhttp://bbs.360.cn/forum.php?mod=forumdisplay&fid=140&filter=typeid	irsetup.exe, 00000001.00000003.360794207.0000000005613000.00000004.00000020.00020000.00000000.sdmp, 360PayInsure.exe.1.dr	false		high
http://es.f.360.cn/stats.phpChromePlusHTML	irsetup.exe, 00000001.00000003.361488158.000000000561E000.00000004.00000020.00020000.00000000.sdmp, 360RealPro.exe.1.dr	false		high
http://www.360.cn	irsetup.exe, 00000001.00000003.361882449.000000000561F000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000003.363234690.000000000561C000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000003.362980098.000000000561F000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000003.362673831.000000000561A000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000003.362346389.000000000564C000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000003.360794207.0000000005613000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000003.363828516.000000000561D000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000001.00000002.374638973.000000000016E000.00000004.00000010.00020000.00000000.sdmp, irsetup.exe, 00000001.00000003.363541218.000000000565B000.00000004.00000020.00020000.00000000.sdmp, SetupArpX64.exe.1.dr, InstallTMDB.exe.1.dr, 360SafeNotify.exe.1.dr, SMLProxy64.exe.1.dr, 360sclog.exe.1.dr, 360PayInsure.exe.1.dr, WiFiHelper.exe.1.dr, 360netcfg.exe.1.dr	false		high
http://www.hao.360.cn	irsetup.exe, 00000001.00000003.361488158.000000000561E000.00000004.00000020.00020000.00000000.sdmp, 360RealPro.exe.1.dr	false		high
http://down.360safe.com/setup.exehttp://down.360safe.com/setupbeta.exeX	irsetup.exe, 00000001.00000003.361882449.000000000561F000.00000004.00000020.00020000.00000000.sdmp, 360sclog.exe.1.dr	false		high
https://hao.360.comhao.360	irsetup.exe, 00000001.00000003.361488158.000000000561E000.00000004.00000020.00020000.00000000.sdmp, 360RealPro.exe.1.dr	false	Avira URL Cloud: safe	low
http://www.so.com	irsetup.exe, 00000001.00000003.361488158.000000000561E000.00000004.00000020.00020000.00000000.sdmp, 360RealPro.exe.1.dr	false		high
http://www.so.comhttp://www.so.com/www.haoso.com	irsetup.exe, 00000001.00000003.361488158.000000000561E000.00000004.00000020.00020000.00000000.sdmp, 360RealPro.exe.1.dr	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	38.0.0 Beryl
Analysis ID:	1268859
Start date and time:	2023-07-07 06:16:51 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 10m 17s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	fNlAH8RgLk.exe
Original Sample Name:	9a90e115834ba8339bd0cc43c034ad55.exe
Detection:	MAL
Classification:	mal52.evad.winEXE@15/34@0/1
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 99.9% (good quality ratio 90.4%) Quality average: 71% Quality standard deviation: 31.4%
HCA Information:	Successful, ratio: 86% Number of executed functions: 179 Number of non-executed functions: 188
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, rundll32.exe, WerFault.exe, WMIADAP.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 13.89.179.12
Excluded domains from analysis (whitelisted): login.live.com, blobcollector.events.data.trafficmanager.net, watson.telemetry.microsoft.com, onedsblobprdcus17.centralus.cloudapp.azure.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Program Files (x86)\Your Product\360PayInsure.exe	6#U6708#U5de5#U8d44#U53d1#U653e#U7ed3#U7b97.exe	Get hash	malicious	Unknown	Browse
C:\Program Files (x86)\Your Product\360PayInsure.exe	6#U6708#U5de5#U8d44#U53d1#U653e#U7ed3#U7b97.exe	Get hash	malicious	Unknown	Browse
C:\Microsoft\iusb3mon.exe	#U4e03#U6708#U5de5#U8d44#U63d0#U6210#U53d8#U52a8.exe	Get hash	malicious	Unknown	Browse
	6#U6708#U5de5#U8d44#U53d1#U653e#U7ed3#U7b97.exe	Get hash	malicious	Unknown	Browse
	6#U6708#U5de5#U8d44#U53d1#U653e#U7ed3#U7b97.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Microsoft\Media.xml

Download File

Process:	C:\un.exe
File Type:	data
Category:	dropped
Size (bytes):	120832
Entropy (8bit):	6.176735846098832
Encrypted:	false
SSDEEP:	1536:epabhKNU9Y1cRdbq4K3lDEZ8LCtv86YGTYTyZXxYsWVxDcdSwZJd0b:A4Yiu4cEZxtv862TyhxU0SeJd0b
MD5:	3C44FFEB6626913540CE8527FDD3BEE1
SHA1:	2787A3086BEE20D6CC8A6D241F8F2AB839627B94
SHA-256:	C8DCB9EB74ED66AB93620C0184011AF8E2619BFA94B46D60D5B3CB4EB9F7338E
SHA-512:	68F5599A89FDB06F07A83145978FED84D63AC9BD149F12066B8A94F427C4F98AFEEB9CDDF08772086E9365C5332CDB56D9489C414179E53729F95136828ADADD
Malicious:	false
Preview:	-.P.....................@...............................................!..L.!This program cannot be run in DOS mode....$........#A..B/.B/.B/.),.B/.)..B/.)+.B/.)).B/..:.B/.)..B/.B...B/..8..B/..8*.B/..8+.B/..8,.B/..8&.B/..8..B/..8-.B/.Rich.B/.........PE..L......d...........!... ............IY....... ............................... ............@.............................................h.......................T...`...................................@............ ...............................text............................... ..`.rdata..~.... ......................@..@.data...............................@....rsrc...h...........................@..@.reloc..T...........................@..B........................................................................................................................................................................................................................................................................................

C:\Microsoft\iusb3mon.dat

Download File

Process:	C:\un.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	135783
Entropy (8bit):	7.997441297528924
Encrypted:	true
SSDEEP:	3072:5GxL38Fy8dTdQ+Zih7Tgpf0WOGWShYkI33xIsaO1zq0aF7I:medTu+wtTgpf0WxxhQ3BIswVI
MD5:	4AE5E8BDD68861DF10F01FE268859588
SHA1:	E4597CE8BB10E432689B300249915863321B6625
SHA-256:	E650BFF476C2F77D87C26C2B20BEDB40FF1FBE43F20581BC1853C8DFD7B30046
SHA-512:	B82EBC66288B7047D95C08A3477653520921FB3954B64623C7A3CB8F0E7F7E3CEE3C7BC25138151074CFD609A22956F93FD130C0AD472A3DB78BDA63FAF9E18C
Malicious:	false
Preview:	PK...........V\.+.h.........q._TUProj.datSD\........RT.cd`i.a``Pa... fd.3Y................NH]-+.x....!...,-..Q.....V.LI@........a.K...UT...o.:dq.:d.[9dr8I..r%a^......"V..V...M..^,U..N....7...s.^/.i...S...3J.....>....09@.1b.KN.&W...K.LM...`..\...@KAj.#.1{...K.)BNO..f......n..}6...-...F....K..AJ"V.u...F{SU...}....... ...V..........V..1..XpW\|.b.{ZA$....g......,P....d.....07IO..F....@.C....V....>M,.=.+...R.[.[S...]..._...\|.w..O.i.&.;3.H.mJ......x...r6...1..&dQ...^.._l....j?n.1.....j...6r).........3.t..<0.1...y..us.}..H..Yf_.,s..U......V:X..z@.u..1..a...vxSXpx...E..~....s......a.I..y.Y.2..>,..7~.M.D..U8.....!........k.'..I@...%.d...D.....+...J.i\....7...5E..`7.v......0.~\.:.d.t.cG....u....t..........VI.q. ....i.5.x\.d...fQ..3x.D.N..b.P...7{........O\.."...E..E......8......Q.Q.)...2.......Y...!~.C).....UP..7.......3..N...:...z.....\.zY/.}.8..Bg....Y/.....2.NQ....g8.E...X...d~.+..J(....+.,9.]...I%.@...:f...2.....Q.D....aW-h..c.N..,......{.E3

C:\Microsoft\iusb3mon.exe

Download File

Process:	C:\un.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	486832
Entropy (8bit):	7.861787599828189
Encrypted:	false
SSDEEP:	12288:gNrhTLpMP+R+QDCfA832AtBYmz6af0F7Z1QVjSOsJ/:gthTiP+ffCfB5Lf0F7Z1EDsV
MD5:	1B9D1C5BDDAFF4DD75A470FA12E35E66
SHA1:	7078518F4236777D4E83217D53DDB9A82E7435D4
SHA-256:	09FA13690D4BB135B40E8C5A8ABE1D0072955981DDC7D8361D1BC3A23E79255F
SHA-512:	B8E2F8AA597D860EACAEE8C8BBB652EA5CDB0B14A6720B4C97481EC531FBDF2BA83B7F6E1D664447AE1C388C5E768BB972A6B8A9414151E2CC4374AAE3EA3194
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 5%
Joe Sandbox View:	Filename: #U4e03#U6708#U5de5#U8d44#U63d0#U6210#U53d8#U52a8.exe, Detection: malicious, Browse Filename: 6#U6708#U5de5#U8d44#U53d1#U653e#U7ed3#U7b97.exe, Detection: malicious, Browse Filename: 6#U6708#U5de5#U8d44#U53d1#U653e#U7ed3#U7b97.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......a...%.s.%.s.%.s.s.`...s...}...s.q=C.?.s..>y.(.s.%.r.x.s.G.`.<.s..8y...s..8x...s.%.s...s...u.$.s.Rich%.s.........................PE..L......T............................._.......p....@.................................C,......................................`........p..`u...........P..............................................................................................UPX0....................................UPX1................................@....rsrc........p...z..................@..............................................................................................................................................................................................................................................................................................................................................................................3.91.UPX!....

C:\Program Files (x86)\Your Product\360PayInsure.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1235936
Entropy (8bit):	6.438869107797385
Encrypted:	false
SSDEEP:	24576:BAGsm3KeRBHSYeHQn4+JTwoOQTVfgFq9i:h3h1ewn4qnTOB
MD5:	5BB9A277E78E6D8AA2782BD4E20D94C4
SHA1:	575CF58BD1308817A88E08D32AE71D6FB2969E5F
SHA-256:	43285B56677A2494D39AF03388DE80D9885FDD3BA4511A6375B29C93BF4EAF2D
SHA-512:	EB45CB32F8BB00D6BA2524F115D4B0A1547C4FB0B3D10C4DAEC003CA8B9CD0BCD3B24B11222402036438AC71DE45C899C6B95172E51D0A7EA21718AE9C296D71
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: 6#U6708#U5de5#U8d44#U53d1#U653e#U7ed3#U7b97.exe, Detection: malicious, Browse Filename: 6#U6708#U5de5#U8d44#U53d1#U653e#U7ed3#U7b97.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........d..7..7..7..7..7b.+7..7.(7..7.77..7.>7f.7..97..7...7..7...7..7..7..7.97~.7..)7..7.,7..7Rich..7........................PE..L.....Aa..........................................@..................................8....@..................................=..T....0...=..............H?...p...{...................................................................................text...h........................... ..`.rdata..\L.......N..................@..@.data........`.......L..............@....rsrc....=...0...>..................@..@.reloc..(~...p......................@..B........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Your Product\360RealPro.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	605416
Entropy (8bit):	6.601778426261702
Encrypted:	false
SSDEEP:	12288:8VohgnmJhL5+6qN3MRXHgkzJey/f+Pqq5uYz6waHxa3XAVt:82hlL5+6qN3MRXcy/rq5uYWwaHgkt
MD5:	CAC540F209AC56408429D98457C8A640
SHA1:	532BB1D7246B6E84ED6B8CC2503A789B82AC08A3
SHA-256:	DC5B9288FB0BC95D7F2712488E13F174E75BFB1EBF884AD0290B6FF3096A014E
SHA-512:	A4AC0ACAA4F7BA0F3692AD0132533808196335DE89F296064DA38CDDD22E8A588835E2998B7D96A7C16439DE055E0501D19BEFA5E99AA1A8FB4FECDDB7DB5016
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......>../z.j\|z.j\|z.j\|...\|{.j\|s..\|`.j\|s..\|w.j\|d..\|..j\|s..\|.j\|s..\|Y.j\|z.k\|(.j\|s..\|..j\|d..\|{.j\|s..\|{.j\|Richz.j\|........................PE..L...u.5d.................v........................@.......................................@.................................H...........................P,... ..hU..p................................c..@............................................text...@t.......v.................. ..`.rdata...:.......:...z..............@..@.data............R..................@....rsrc...............................@..@.reloc...n... ...p..................@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Your Product\360SafeNotify.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257352
Entropy (8bit):	6.825804480457841
Encrypted:	false
SSDEEP:	6144:6iFrTOKHRUeZ4KGBXciLjJO7j58AvvzYs34:3TOqRUFKGBXcihO79YK4
MD5:	D66764206A7FD0C6C4CCF273EDD99A83
SHA1:	63654FD7C510D9CC287FA5139229B04C3836C6CA
SHA-256:	0FC6FF4F5F077BDD953258085AD70C7EC57A05035B3B9DDA5305457738EDE9EB
SHA-512:	494049F81A60D1C8685602CEA910C58E9CD8B66D9F2DF8CFACB0CFBC2FAC53D99BE252D02D008408F2549BB484170EBD42FFABA81A4AA2DAC8CBE35BA885421F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......g..w#..$#..$#..$..'$"..$.$$6..$.2$...$.8$...$=.5$&..$.{.$"..$.{.$6..$#..$.$.5$...$=.%$"..$*. $"..$Rich#..$................PE..L......S.....................................0....@..........................0......k)....@..................................\|......................................`3..............................xi..@............0...............................text............................... ..`.rdata...\...0...^..................@..@.data...\W...........x..............@....rsrc...............................@..@.reloc...'.......(..................@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Your Product\360netcfg.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	243272
Entropy (8bit):	6.461994501621771
Encrypted:	false
SSDEEP:	3072:JY43hoAzCdvM8FuLxhsoFSZ3fnSp1W9H0cHnbqXq5a3Yz3nYKJH8UKrJN:JYSPGJMLvsmE3/o1W90cHbqX1kYR7L
MD5:	7D47BD34F018D83A329ADB17D9238E16
SHA1:	F32B34F0AD9F9DC7FA44C97B0C754CAB6A89A28D
SHA-256:	EBC9553C516C87CE4C224B0D835044AA905F0B976FAA2487BD6AB473181D3C33
SHA-512:	D9B13E2D8868455D41B0AF3FB0508410CC0502F8738CD854477A9EDF6AAF9AEC3C88CC8F1B18F3D86A933CF0F32BAF7B5545D2C05AAA8D01F54CE15E440B60D2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......NK............R;.....R-.w...R.5..-......-.............R$....x:.....R?....Rich...................PE..L....,.[.................J..........PH.......`....@.................................hD....@.................................L........P...R...........~...7....... ...c.................................@............`...............................text....I.......J.................. ..`.rdata...y...`...z...N..............@..@.data....j..........................@....rsrc....R...P...T..................@..@.reloc...0.......2...J..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Your Product\360sclog.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	431016
Entropy (8bit):	6.441099067344102
Encrypted:	false
SSDEEP:	12288:Qxb/HJKBpgeBtCxbGY6wvuE7VG0LYqFDk3BTXiXr0QBrLDGbnLcbcl:ab/8KLXLYquE0Q1Lcn+e
MD5:	62A97409C90C0FE85EDA0085E8FCEFAB
SHA1:	FD626547A837F2A721E7AFA872B694C4E42D30DE
SHA-256:	350446B68668D3DEA1EB6E011677E4A407309110DBAA178C68C7092E81F1746A
SHA-512:	20996553D8C00F11761C7360F385C2E9A772ED2248E403FEEDF254118512BDF43E1AF838171E7C69938F4850382A68BCC0390482A9A38B4DEDE542DD2D355893
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........rAO../.../.../.V\..../..k..../..k..../..A..../..k..q./..k..../......./..k..../..A..../..k..../.Rich../.........PE..L....'.X.............................b............@..................................B....@.................................$S..........8S...........^...5...p..h2..................................X...@...............L............................text............................... ..`.rdata..d...........................@..@.data.......p...f...X..............@....rsrc...8S.......T..................@..@.reloc...H...p...J..................@..B........................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Your Product\InstallTMDB.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	250384
Entropy (8bit):	6.4195361088846115
Encrypted:	false
SSDEEP:	3072:WsU3yKyNu7Q834o3C4D59eok4l6vTQC2mCd6IsLv2uQAswvLYaxMrpAS9Ty9Sqeh:+CKyN6Q8oB4D3eZ4lvIv2uO0Mrphhy9g
MD5:	BAF0FB3509F070E797938DCDABC32966
SHA1:	80CC2934358E37D8503AC8D1C1246137CB368CD3
SHA-256:	45A05414DF646B7054171F268C9164619F9DD6006C93697361B9ECF4D23305AA
SHA-512:	2199E8CEA0B37C2F07D3F3F408F2167351C9BC0AEAE2C46375D9AEBB65EE1DF098DA748497B556227EBC5D4A5802ECABF2C68600DA2BF2C1B73E93C3FC1BDCF3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........i.<...o...o...oY.ro...oY.poo..oY.qo...o5\|.n...o.`.n...o.`.n...oHa.n...oHa.n...o.`.n...o.p.o...o...o...oHa.n...oHa\|o...o...o...oHa.n...oRich...o........PE..L.....Gb.....................~......K........ ....@..................................N....@.................................l...d.......(...............xC..............p..........................0...@............ ...............................text............................... ..`.rdata....... ......................@..@.data...4<..........................@....rsrc...(...........................@..@.reloc...............t..............@..B................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Your Product\SMLProxy64.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	259400
Entropy (8bit):	6.226500572608065
Encrypted:	false
SSDEEP:	3072:qiG0+imy82Umtxr8dUaap/UUOY3VKcatIolfNUUVt4bRwGePhDuIzpbrxFQ:qiGQmt2UmPBRpYY3VKcatHfL8qjDuepo
MD5:	94D785A33C5B9314492444AE9E7E676E
SHA1:	056ABB46A6CCE6AF4E664DD106F1E7E7A1CCE545
SHA-256:	7135378B4A4F126D357DB586EEF5FDE6F3E8126CE06FB62B2C4BCDBAF01BA3F1
SHA-512:	02CC4EDB0279006851D59A3B6D4509A2A16343400C75FB9C97B797AD814A5D25A870AB516C1849E53246845E00AEAC28EAE6955966E04D2911E383E4BC56EE5D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........~.............?.............q}....q.....qk.........................Rich....................PE..d......].........."......&..........d..........@.............................0.......j....@.....................................................d....P..4....0..4........6... .. ....D...............................................@...............................text....%.......&.................. ..`.rdata..t~...@.......*..............@..@.data...pd.......$..................@....pdata..4....0......................@..@.rsrc...4....P......................@..@.reloc..0.... ......................@..B........................................................................................................................................................................................................................................................

C:\Program Files (x86)\Your Product\SetupArpX64.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	246088
Entropy (8bit):	6.382970623199379
Encrypted:	false
SSDEEP:	6144:dXVfRILD5IJoY4auTKDtpVzz5gqwhqzie8:dXVfYD5MJDtpFzuzO
MD5:	6CE7734F7C72F4B7E0CB8497D369957C
SHA1:	ECB8A805FDBC8C1487531EEB99DD274CD8A0570F
SHA-256:	050CF678A4CA90C88734851ECAB015BC96E8A49B7BA9C7F5EC751BC73B918B05
SHA-512:	7D6941E82FB7FE7CE947F962D3D9DA4A96A6BC7014E346057CB7468AEDD78D6A5DE748E1A4432C0DC63D92F5AE3853214A4C08AAA8D45D4515D2F738219827A8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........}...}...}...2...}.......}.......}.....}.....}...}...}.......}.../...}.......}..Rich.}..........................PE..d...`..S..........#............................@............................................................................................<b..x...............h(..................0................................................................................text............................... ..`.rdata..............................@..@.data...P:...p.......Z..............@....pdata..h(.......*...r..............@..@.rsrc...............................@..@................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Your Product\WiFiHelper.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	240968
Entropy (8bit):	6.880059969311975
Encrypted:	false
SSDEEP:	6144:m7eg3RXX7TCF/YYMLcmaktJcDt9yZWE1+:m7eAhTYgYMgktJcD5E
MD5:	A8130BF291D60B2659EC297F79C03011
SHA1:	409BBF20A2F0B0062760C094DAE86CCA5D38F567
SHA-256:	C72E21ACE4E6369D5D223D375A8AA4C7EB9359F8F596383A9D23CFC19D057DC3
SHA-512:	855B2EDDB42C79B0505B153CCB16BF9B39DB0B0ADF04B40A0B0C750377CE3BDE92FA00221660F25DCA2EEBB0ADFF30BC828EA032563E83A4B987FF39ABCECD02
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......xC&:<"Hi<"Hi<"Hi.m.i>"Hi5Z.i*"Hi5Z.i."Hi5Z.i."Hi..%i="Hi<"Ii."Hi..3i'"Hi5Z.i-"Hi5Z.i="Hi5Z.i="HiRich<"Hi........PE..L...(..S.....................t...............0....@.......................................@...................................................................$....3..............................0n..@............0..4............................text............................... ..`.rdata...i...0...j..................@..@.data....Q.......(..................@....rsrc..............................@..@.reloc..<+.......,...d..............@..B........................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Program\ziliao.jpg

Download File

Process:	C:\un.exe
File Type:	data
Category:	dropped
Size (bytes):	364544
Entropy (8bit):	6.990414693256013
Encrypted:	false
SSDEEP:	6144:1bkvoQn9UIC3CZsJ8g0y4q0TplCVDbaube:pEvC3jdlGHWDbaube
MD5:	06465757C8D17DCF452AC3F727501980
SHA1:	701D2596B3224ADEE8B35A5A098B6F8583DB7302
SHA-256:	09E7BCAD5164FD76BD952AE329D1456C62C3F4DFF951148F9C5C9DD6D38B1B20
SHA-512:	C5282049F6F60E488C80AD1BBA0F4E67976B649B58F8283CFAD1F9514127986C80D5BA7A5665EAED40721CC3742F47BD4157786495473CB98E7279E45262AE8C
Malicious:	false
Preview:	-"h.....................8.................................................,..$PQK.HJOWJYM.[YNNOD.ZU.JEN.QN.4/+.MOTU.............v.z\..\..\....v.]......]......$..\.......t.3....._..R...O.....7..R......\.. ......(.....]..*Q[P\..........................(5..,....@T.................X..........e........H.........................................................................7...........................................................................................H...............................DU@D.... .......X.....................X.JTYDY...!...H...X...H..............8..8.TYDY............H..................8....JULO[...7.......(...8..............8..:................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_iusb3mon.exe_533583c58edbecc1aec14ce6b8049d85f78a438_16713590_1d369ce7\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9563286137052361
Encrypted:	false
SSDEEP:	96:CTFH6hgQoF9acoI7Jf/pXIQcQvc6QcEDMcw3DL+HbHgoC5AJkq+Ok6GFYAKcEoN0:E8hgQIHBUZMXojLrU7/u7sUS274It3F
MD5:	E8E3C589B39B8A72CE19657EBEE2CDBF
SHA1:	658A483068C8B7AAF86642B76821A69961168490
SHA-256:	4B56310AD4B0BEC25D1FE0653BB37AC30E43CF3C49824BF5FFB7507B746C2589
SHA-512:	AC430711962FEE228774CBFAD11514CEE99E8DAA1DC748736CB29461AF1215579105D4AD986DF7CCB2E492BE55572FD742F97B9CF2A363E78E97D7AA0F79D1DC
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.3.3.2.0.9.4.7.4.7.4.0.4.1.4.6.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.3.3.2.0.9.4.7.5.5.3.7.2.8.9.7.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.1.7.3.2.3.c.c.3.-.0.4.6.9.-.4.3.7.e.-.b.e.a.2.-.4.a.c.2.0.7.d.5.b.0.0.f.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.1.c.0.4.1.2.8.6.-.e.a.7.d.-.4.a.b.5.-.a.4.3.4.-.8.7.4.f.b.a.d.5.c.1.c.c.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.i.u.s.b.3.m.o.n...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.t.u._.r.t...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.c.8.4.-.0.0.0.1.-.0.0.1.f.-.5.3.1.3.-.9.a.6.d.d.5.b.0.d.9.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.a.3.3.a.7.4.5.6.7.f.f.7.a.b.5.0.9.7.5.1.f.c.5.7.b.b.f.f.1.7.9.e.0.0.0.0.0.9.0.4.!.0.0.0.0.7.0.7.8.5.1.8.f.4.2.3.6.7.7.7.d.4.e.8.3.2.1.7.d.5.3.d.d.b.9.a.8.2.e.7.4.3.5.d.4.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7F9B.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Fri Jul 7 13:17:55 2023, 0x1205a4 type
Category:	dropped
Size (bytes):	63338
Entropy (8bit):	2.1133675930118634
Encrypted:	false
SSDEEP:	384:pptHKFVsWFvXgDIlSsNeOAV3ZrcqXqZL:/IsWFv+pmKrK
MD5:	4DD891AE96D9688504C96245ABB1069B
SHA1:	025B4FB9CDC5AF77160A0D40C7213C66A9C277DC
SHA-256:	5F2F6F95EE7130AA615E6A2987DB19E6B13CF865A1EE59C123822B602BD362B2
SHA-512:	921B5258F577CC2E2CEC402CCCF01EB4D6B6D5E38ABD0C9DFE00444643A60F6179F43A73EFEDAC03B4D10C14B045A851E7A41BB72B18C60FC0E1199CC5000F4D
Malicious:	false
Preview:	MDMP....... ..........d............$...............8.......$...T.......4...t9..........`.......8...........T........... "..J...........x...........d....................................................................U...........B..............GenuineIntelW...........T...........}..d.............................0..2...............P.a.c.i.f.i.c. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................P.a.c.i.f.i.c. .D.a.y.l.i.g.h.t. .T.i.m.e...........................................1.7.1.3.4...1...x.8.6.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8152.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6310
Entropy (8bit):	3.7283341992668886
Encrypted:	false
SSDEEP:	192:Rrl7r3GLNi3u6Ia9gY/STCpr189b19sfWHm:RrlsNi+6Ia6Y/Sh12fH
MD5:	F1C334064D4FF85FAC33F6520592539E
SHA1:	F2A596DAF82C911569DF1C4CB0F479E589AC071D
SHA-256:	EC3057C101C743A3A5961FA7C383775D4C6C1239D973D40CEAD3B38D78F90149
SHA-512:	EA1294067D0AC69F43ABAC542C88566513A7D6F3EB6B3E584D836FC23C518E0D3246ACB0A175D180E95A8761FFB52F7E66BD9BB18F32A6FC569B613FCE20063D
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.3.0.0.<./.P.i.d.>.......

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8191.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4657
Entropy (8bit):	4.486594968988295
Encrypted:	false
SSDEEP:	48:cvIwSD8zsJJgtWI942VWgc8sqYjX8fm8M4J3cR2ZFg+q8+UnmanoBfg2yd:uITfbf2kgrsqYoJMA88mAoFg2yd
MD5:	AA44B116C07D680D2C5683E8022A353D
SHA1:	8A5852EAE87F1031A2C6CEE94C48875641B1BFA7
SHA-256:	E116E2B0E8E37BCC596E5E505CB214E0448527F57D2150364F4E18252F86FE1C
SHA-512:	B16EF02F6218330826ABC4D1FE54D0884BEF21FFC558268065660EAC6B1EA5AEF3B33D60DEE6FA264988992C0545232DA3243122DD20A7DEA10E1508D9EFB8D2
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="2118148" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

C:\ProgramData\data\UPX.rar

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	RAR archive data, flags: EncryptedBlockHeader
Category:	dropped
Size (bytes):	865340
Entropy (8bit):	7.999802123118812
Encrypted:	true
SSDEEP:	24576:BsIow/1fkkir0vAsXOKyKVTL8m9kqMilXbzT:t1MXrHUdygbMiJbzT
MD5:	BCB4E84D2E5618A434924F9133EA2EB6
SHA1:	C5CEC2B0654E044F7606B2AF9EABB543A95120D2
SHA-256:	50FC373CC7D214B806BA21CE2BD21572D7C322F1C6E61C05416ECCBD6BE5C06C
SHA-512:	8EAF0859DFA01E2871DC254C2CD0537F7DDD32D29177D5F6379CBABCE944E3DBD7DEC7C7BD58179BB193E09E9C88CD32662FDFA0DA1F8EC5E9909BF76AD5B264
Malicious:	false
Preview:	Rar!....s...........N../Lq./...W....k7..-..3.......7..H..;.n....;.......`wl.......9.e.O...."n..w.-......y.#}..D...W...b..\|..D#.J..y`............Z~X.+......z..xh..0E?..!.D...!...nmIK....YY..o...Wft...N........~....2...."<w.d<.v8..5.I......d....:s..H.u..../W}..m...w...[@V../d..........^..2L@...aB....}8.XHg..P..?-.e..V._.Xc.<..!o1pO.$...e.......?.sN'F."T.....kv..>...`..l.qC.#d...9.\|:..1P...........<...c]1..Y.%.)^I.<.a\|....>%..84...F....#.U=.`.J...ma.wV..8.......q....\..7.rQ.82..D.B.kYU...S...'f......&=......@...>.m.\|..t....u.....8...G.L~..v.>..._.......>.6@@.$5.....e.c.%e..I.b...U....F\|+_.....9...$2.r\-,B.....P..p.a.....p...3.C..Khz...._.4.3.....$....>Pa...(._~w....LZ..n..p....oh]Y..g..C%.@1.r.O...T...F..0..!nq....s'..... .)..@........z..j...CQ......N...6..4.....cZ...L....B?...B.yk.'..(.N.l..\.iHChx.WC[d....T......g"T7.....!^.\|X..Z.......1...x..EC....=.Iw`f+....T.....d-Q...2....D*..w.).......W)...y`.....:x...XYC..S.gC?]...m..z ...KP4..

C:\ProgramData\data\rar.ini

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.921928094887362
Encrypted:	false
SSDEEP:	3:oeJ:o8
MD5:	51C11DB1054DD4650A33BF481EC27060
SHA1:	17686B75163D8753BE27E407AAD97A76F311FC7B
SHA-256:	FC835086345B170AC995C35F24546E1B7268E3D3524A125A9396A4EC8B7D3F35
SHA-512:	94D5C2A0CB03B38657BAB246A695C6528FC5F7D3DDBE716641DD59EC83A67D6AB28C083000026D10114E7AB8F8225F7C90C9FCE25EF0611F46AA3899D096D80F
Malicious:	false
Preview:	C:\\un.exe

C:\Users\user\AppData\Local\Temp\Xshell 6 Update Log.txt

Download File

Process:	C:\Microsoft\iusb3mon.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	463
Entropy (8bit):	5.176687529840517
Encrypted:	false
SSDEEP:	12:kNftkjY6BiftJiS3nWdpljGrBqBxW6baqBgGoQdn:kltkc6Btw2ljxw6baOgGo4
MD5:	941AF9400444815FFF953F61C4B37565
SHA1:	C1FDBDCC03DC190B9512FC61E7681216DFBB464C
SHA-256:	26D3C04156FC8F9D695E85E26E07770CD2A967820F963A1742E7FBDB6EE2DF73
SHA-512:	8688B98188ABE14E25A76A494ABE5155CFA9002B7091CD219C1B5E7E1931878D503C176BA3C32723959C6A3433146BF902F34CFA17D3AA6FDDEF4C9C17CC3541
Malicious:	false
Preview:	[07/07/2023 06:17:51] Success.Update started: C:\Microsoft\iusb3mon.exe..[07/07/2023 06:17:51] Notice.Update engine version: 3.8.0.0..[07/07/2023 06:17:51] Notice.Product: Xshell 6..[07/07/2023 06:17:51] Success.Language set: Primary = 9, Secondary = 1..[07/07/2023 06:17:51] Success.Include script: _TU20_Global_Functions.lua..[07/07/2023 06:18:09] Success.Run client data event: Client Script..[07/07/2023 06:18:09] Notice.Exit update process (Return code: 0)..

C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\IRIMG1.JPG

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 497x63, components 3
Category:	dropped
Size (bytes):	2362
Entropy (8bit):	7.670995643119166
Encrypted:	false
SSDEEP:	48:o9YMAuERADl78E1g3e2OHBTTxE4+NaEIT9paYvo6su:gh7EQVXgt+NYgTnw6X
MD5:	3220A6AEFB4FC719CC8849F060859169
SHA1:	85F624DEBCEFD45FDFDF559AC2510A7D1501B412
SHA-256:	988CF422CBF400D41C48FBE491B425A827A1B70691F483679C1DF02FB9352765
SHA-512:	5C45EA8F64B3CDFB262C642BD36B08C822427150D28977AF33C9021A6316B6EFED83F3172C16343FD703D351AF3966B06926E5B33630D51B723709712689881D
Malicious:	false
Preview:	......JFIF.....H.H.....C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......?...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...T.)..{-.I.U..i..P.U....)..J..9..A@.(Lu..k...5R.T......}..E&..$.O.P}..@>.}..L....,.....t......c...ar.Z\.....R...7 .....z......k.OS.Q.'....r..?...4.x...P.G..y....L.........\|....;z.a.4......SL...S.!.d+.3.....w..)..i.....{.......Hi....)._.~..q/..Ji..v@<.....ne......j..q..Q.C..}G.L".5I!]........._E..")..*..1.....SM...qj...j1.+...n..M:..C..j.H.....;...N..

C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\IRIMG2.JPG

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS2 Windows, datetime=2008:07:08 14:20:15], baseline, precision 8, 166x312, components 3
Category:	dropped
Size (bytes):	29054
Entropy (8bit):	5.195708227193176
Encrypted:	false
SSDEEP:	384:wjV66AV66RU53DaYNg7y5fJ+dwd7L/dSivXHk4eo:wjs6As6R4aYyCfToi7R
MD5:	AC40DED6736E08664F2D86A65C47EF60
SHA1:	C352715BBF5AE6C93EEB30DF2C01B6F44FAEDAAA
SHA-256:	F35985FE1E46A767BE7DCEA35F8614E1EDD60C523442E6C2C2397D1E23DBD3EA
SHA-512:	2FBD1C6190743EA9EF86F4CB805508BD5FFE05579519AFAFB55535D27F04F73AA7C980875818778B1178F8B0F7C6F5615FBF250B78E528903950499BBE78AC32
Malicious:	false
Preview:	......JFIF.....H.H......Exif..MM..............................b...........j.(...........1.........r.2...........i....................'.......'.Adobe Photoshop CS2 Windows.2008:07:08 14:20:15........................................8...........................................&.(.........................................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................U.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?...J....X.Z..l.i.........jl....p............\\.I<...=..v.....(..A.%.P.'!."UI.I....z.u...wq..*..hc4kt.6R.7H.Z.[.#O..O

C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	data
Category:	dropped
Size (bytes):	140614
Entropy (8bit):	5.953245138953227
Encrypted:	false
SSDEEP:	3072:7AW0HGl6b158j3GJhQcvQcREH3SgLb/go4d:708Lb4dd
MD5:	9FE51FE6DC9B0DF64AEBA16164A29883
SHA1:	A71E7F1FDF213305FBA39ADC51718AB69138E380
SHA-256:	C1E7A11C4E7F65494E1F7D8B8083A371759A08E244BE93CEC3500F7E6D36CE9E
SHA-512:	B8EB97D93A06E1629453AE5914243031C53D7F8CD35EC723716BEFD92FC94EBF28BBC1ADE08621069C2297027622BFEF2E0167A1D1A49B810259406C52DA5ACA
Malicious:	false
Preview:	........CGlobalIncludeLuaFile.........Constant Definitions..XMB_OK=0;..MB_OKCANCEL=1;..MB_ABORTRETRYIGNORE=2;..MB_YESNOCANCEL=3;..MB_YESNO=4;..MB_RETRYCANCEL=5;..MB_ICONNONE=0;..MB_ICONSTOP=16;..MB_ICONQUESTION=32;..MB_ICONEXCLAMATION=48;..MB_ICONINFORMATION=64;..MB_DEFBUTTON1=0;..MB_DEFBUTTON2=256;..MB_DEFBUTTON3=512;..IDOK=1;..IDCANCEL=2;..IDABORT=3;..IDIGNORE=5;..IDRETRY=4;..IDYES=6;..IDNO=7;..SW_HIDE=0;..SW_SHOWNORMAL=1;..SW_NORMAL=1;..SW_MAXIMIZE=3;..SW_MINIMIZE=6;..HKEY_CLASSES_ROOT=0;..HKEY_CURRENT_CONFIG=1;..HKEY_CURRENT_USER=2;..HKEY_LOCAL_MACHINE=3;..HKEY_USERS=4;..REG_NONE=0;..REG_SZ=1;..REG_EXPAND_SZ=2;..REG_BINARY=3;..REG_DWORD=4;..REG_DWORD_LITTLE_ENDIAN=4;..REG_DWORD_BIG_ENDIAN=5;..REG_LINK=6;..REG_MULTI_SZ=7;..REG_RESOURCE_LIST=8;..REG_FULL_RESOURCE_DESCRIPTOR=9;..REG_RESOURCE_REQUIREMENTS_LIST=10;..DLL_CALL_CDECL=0;..DLL_CALL_STDCALL=1;..DLL_RETURN_TYPE_INTEGER=0;..DLL_RETURN_TYPE_LONG=1;..DLL_RETURN_TYPE_STRING=2;..SUBMITWEB_POST=0;..SUBMITWEB_GET=1;..ACCESS_READ=1310

C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

Download File

Process:	C:\Users\user\Desktop\fNlAH8RgLk.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	1344512
Entropy (8bit):	7.921180289353584
Encrypted:	false
SSDEEP:	24576:8FYGY9+9d/G7P9lkQ/exnzGn4dLsUvqkaT+0BpCCh+PDed:TN26FOnzGn6LJvqkwnpC+m
MD5:	DEC931E86140139380EA0DF57CD132B6
SHA1:	B717FD548382064189C16CB94DDA28B1967A5712
SHA-256:	5FFD4B20DCCFB84C8890ABDB780184A7651E760AEFBA4AB0C6FBA5B2A81F97D9
SHA-512:	14D594E88C4A1F0EC8BC1B4FE2D66E26358F907B1106C047ADA35D500CA9E608F1CE5A57599453CF10F11F4D9F1948CED9056CE8BD944B16ECA7E9B83E8B27AF
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......wC.33".`3".`3".`\T.`B".`:Z/`2".`.l3`2".`:Z(`#".`(.5`.".`\T.`.".`...`1".`:Z8`.".`3".`.!.`(..`.".`(..`O .`(.1`2".`(.6`2".`Rich3".`........PE..L...+..O......................... (..-<..0(..0<...@...........................<...........@.................................D.<......0<.Dz....................................................................................3.@...................UPX0..... (.............................UPX1.........0(.....................@....rsrc........0<.....................@......................................................................................................................................................................................................................................................................................................................................................................3.05.UPX!....

C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll

Download File

Process:	C:\Users\user\Desktop\fNlAH8RgLk.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	325960
Entropy (8bit):	6.876135679379316
Encrypted:	false
SSDEEP:	6144:ukn2LG5bwf92+0HiDhAqUS0aMkvAvBtAOj+JzOghK:r2x2cdUhZuIBt8xc
MD5:	B5FC476C1BF08D5161346CC7DD4CB0BA
SHA1:	280FAC9CF711D93C95F6B80AC97D89CF5853C096
SHA-256:	12CB9B8F59C00EF40EA8F28BFC59A29F12DC28332BF44B1A5D8D6A8823365650
SHA-512:	17FA97F399287B941E958D2D42FE6ADB62700B01D9DBE0C824604E8E06D903B330F9D7D8FFB109BFB7F6742F46E7E9CEDAD6981F0D94D629B8402D0A0174F697
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........)..H...H...H......H...H...H...0 ..H...01..H...0'.GH...06..H...05..H..Rich.H..................PE..L....O`L...........!.....\|..........X........................................0.......o..........................................(.......................H........!.................................. ...@...............x............................text....z.......\|.................. ..`.rdata...'.......(..................@..@.data...$5..........................@....reloc..r&.......(..................@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_ir_tu2_temp_0\IRIMG1.JPG

Download File

Process:	C:\Microsoft\iusb3mon.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 111x63, components 3
Category:	dropped
Size (bytes):	6887
Entropy (8bit):	7.912044261903433
Encrypted:	false
SSDEEP:	192:EqK9OIJV7hREPQEOPdivlu54UovmNqg0aB0kOI:EJIIJVcPQEOEvMJoON/0aBwI
MD5:	E39405E85E09F64CCDE0F59392317DD3
SHA1:	9C76DB4B3D8C7972E7995ECFB1E3C47EE94FD14B
SHA-256:	CFD9677E1C0E10B1507F520C4ECD40F68DB78154C0D4E6563403D540F3BF829F
SHA-512:	6733F330145B48D23C023C664090F4F240E9BBEB8368B486C8EE8682EC6A930B73275E24075648D1AA7E01DB1EC7B7E259286917A006BA9AF8FB7CBA3439070A
Malicious:	false
Preview:	......JFIF.....d.d......Ducky.......d......Adobe.d.................................................................................................................................................?.o........................................................................................u........!.."..1.A2#..QB.a$3.Rq..b.%C...&4r....5'.S6..DTsEF7Gc(UVW......d.t..e.....)8f.u9:HIJXYZghijvwxyz.......................................................................m.....!..1..".AQ.2a.q.B.#..R.b.3..$..Cr...4%.S.cD.&5.T6Ed'.s..Ft....UeuV7........)...............(GWf8v........gw........HXhx........9IYiy........:JZjz....................?...-`....f..#........Y.<....7.2.b......OE....]D/..?N9..mo...<.a...C..}.X....~.."pUd....#.6'......%yKl../J.z....c.4.36.....W..D.~a.VicU..... .aa.......8m{\f0.T}.B..."..$...WKe.eh&..j................RMc....\|...?.D0.}...K\|.........H2..j.k.$.........9....;%.hE.G.@.Qo...x.......~..&)*i.....[.9..-k..m...].j.$>...W..u.M.kS#.q.......H.=.G.=D..T.i.<...

C:\Users\user\AppData\Local\Temp\_ir_tu2_temp_0\IRIMG2.JPG

Download File

Process:	C:\Microsoft\iusb3mon.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 166x312, components 3
Category:	dropped
Size (bytes):	37625
Entropy (8bit):	7.931009836595926
Encrypted:	false
SSDEEP:	768:S0jPDrkTYU5n10PIUcLbnkC59fNaeocQXiWN6hhm4gj0mVWQySgA1:RvqYe0PINLkC5Haeoik6HMHWQySgg
MD5:	F6BF82A293B69AA5B47D4E2DE305D45A
SHA1:	4948716616D4BBE68BE2B4C5BF95350402D3F96F
SHA-256:	6A9368CDD7B3FF9B590E206C3536569BC45C338966D0059784959F73FE6281E0
SHA-512:	EDF0F3EE60A620CF886184C1014F38D0505AAC9E3703D61D7074CFB27D6922F80E570D1A3891593606A09F1296A88C8770445761C11C390A99A5341EE56478AA
Malicious:	false
Preview:	......JFIF.....d.d......Ducky.......d......Adobe.d.................................................................................................................................................8..........................................................................................u........!.."..1.A2#..QB.a$3.Rq..b.%C...&4r....5'.S6..DTsEF7Gc(UVW......d.t..e.....)8f.u9:HIJXYZghijvwxyz.......................................................................m.....!..1..".AQ.2a.q.B.#..R.b.3..$..Cr...4%.S.cD.&5.T6Ed'.s..Ft....UeuV7........)...............(GWf8v........gw........HXhx........9IYiy........:JZjz....................?..&.T..t.q.....i...G.....=b......j4.Kq.A$...$.?..,.u.".?...W........._...7C^....60Z.#.?O.o...m......0V+........2...T...........c.l4eK.w[.h..}$.Qbx...{.(.(..}.G7...M....\...J-...r}....G..._b.~L........... 5V&.o...W......]W.O....A..z~K.(UPt.<.8p.......:....$...8.X._...}.wNG .....o9.ko.z.4R0..E.....#.y'.=..BX...g....C;nk...].......Q}8.-.$

C:\Users\user\AppData\Local\Temp\_ir_tu2_temp_0\IRIMG3.JPG

Download File

Process:	C:\Microsoft\iusb3mon.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 111x63, components 3
Category:	dropped
Size (bytes):	6887
Entropy (8bit):	7.912044261903433
Encrypted:	false
SSDEEP:	192:EqK9OIJV7hREPQEOPdivlu54UovmNqg0aB0kOI:EJIIJVcPQEOEvMJoON/0aBwI
MD5:	E39405E85E09F64CCDE0F59392317DD3
SHA1:	9C76DB4B3D8C7972E7995ECFB1E3C47EE94FD14B
SHA-256:	CFD9677E1C0E10B1507F520C4ECD40F68DB78154C0D4E6563403D540F3BF829F
SHA-512:	6733F330145B48D23C023C664090F4F240E9BBEB8368B486C8EE8682EC6A930B73275E24075648D1AA7E01DB1EC7B7E259286917A006BA9AF8FB7CBA3439070A
Malicious:	false
Preview:	......JFIF.....d.d......Ducky.......d......Adobe.d.................................................................................................................................................?.o........................................................................................u........!.."..1.A2#..QB.a$3.Rq..b.%C...&4r....5'.S6..DTsEF7Gc(UVW......d.t..e.....)8f.u9:HIJXYZghijvwxyz.......................................................................m.....!..1..".AQ.2a.q.B.#..R.b.3..$..Cr...4%.S.cD.&5.T6Ed'.s..Ft....UeuV7........)...............(GWf8v........gw........HXhx........9IYiy........:JZjz....................?...-`....f..#........Y.<....7.2.b......OE....]D/..?N9..mo...<.a...C..}.X....~.."pUd....#.6'......%yKl../J.z....c.4.36.....W..D.~a.VicU..... .aa.......8m{\f0.T}.B..."..$...WKe.eh&..j................RMc....\|...?.D0.}...K\|.........H2..j.k.$.........9....;%.hE.G.@.Qo...x.......~..&)*i.....[.9..-k..m...].j.$>...W..u.M.kS#.q.......H.=.G.=D..T.i.<...

C:\Users\user\AppData\Local\Temp\_ir_tu2_temp_0\IRIMG4.JPG

Download File

Process:	C:\Microsoft\iusb3mon.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 166x312, components 3
Category:	dropped
Size (bytes):	37625
Entropy (8bit):	7.931009836595926
Encrypted:	false
SSDEEP:	768:S0jPDrkTYU5n10PIUcLbnkC59fNaeocQXiWN6hhm4gj0mVWQySgA1:RvqYe0PINLkC5Haeoik6HMHWQySgg
MD5:	F6BF82A293B69AA5B47D4E2DE305D45A
SHA1:	4948716616D4BBE68BE2B4C5BF95350402D3F96F
SHA-256:	6A9368CDD7B3FF9B590E206C3536569BC45C338966D0059784959F73FE6281E0
SHA-512:	EDF0F3EE60A620CF886184C1014F38D0505AAC9E3703D61D7074CFB27D6922F80E570D1A3891593606A09F1296A88C8770445761C11C390A99A5341EE56478AA
Malicious:	false
Preview:	......JFIF.....d.d......Ducky.......d......Adobe.d.................................................................................................................................................8..........................................................................................u........!.."..1.A2#..QB.a$3.Rq..b.%C...&4r....5'.S6..DTsEF7Gc(UVW......d.t..e.....)8f.u9:HIJXYZghijvwxyz.......................................................................m.....!..1..".AQ.2a.q.B.#..R.b.3..$..Cr...4%.S.cD.&5.T6Ed'.s..Ft....UeuV7........)...............(GWf8v........gw........HXhx........9IYiy........:JZjz....................?..&.T..t.q.....i...G.....=b......j4.Kq.A$...$.?..,.u.".?...W........._...7C^....60Z.#.?O.o...m......0V+........2...T...........c.l4eK.w[.h..}$.Qbx...{.(.(..}.G7...M....\...J-...r}....G..._b.~L........... 5V&.o...W......]W.O....A..z~K.(UPt.<.8p.......:....$...8.X._...}.wNG .....o9.ko.z.4R0..E.....#.y'.=..BX...g....C;nk...].......Q}8.-.$

C:\Users\user\AppData\Local\Temp\_ir_tu2_temp_0\_TUProjDT.dat

Download File

Process:	C:\Microsoft\iusb3mon.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	5
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:FQFn:En
MD5:	C5FE25896E49DDFE996DB7508CF00534
SHA1:	69DF79BEF9287D3BCB8F104A408B06DE6A108FD8
SHA-256:	C507A68F3093E885765257ED3F176C757AAF62BB4CBC2EF94B2E7DA3406D9676
SHA-512:	40D306DF4FBFFCE56C38CE96948D6BAC43F8F0EB91A7918E0BB6EBB31E1F6D9FDF9DE33C31F9BC0D79CF9453040B78AB6D24F4893CEF2B4187FFB504635EA906
Malicious:	false
Preview:	55555

C:\WPS_Setup\WPS_Setup_12980.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	3027728
Entropy (8bit):	7.856503406318228
Encrypted:	false
SSDEEP:	49152:sejRVM654Suz/Debm7vpElDBc4uN+C+LHseGi1pm2PfLwUA0EUEiXDSWqf16yag5:sejRVMDhe6yH1ugfHseGKtPDw50E1iTe
MD5:	B52BA2B99108C496389AE5BB81FA6537
SHA1:	9073D8C4A1968BE24357862015519F2AFECD833A
SHA-256:	C6AC7D9ADD40B913112B265D4F366D9EF80BBD711049DB085FC750FCAD4E14D8
SHA-512:	6637506EE80D359E729E0011B97E8D827E14356393193247F502B7FCFBBCA249DC045B8ACFE4B31CE462468F421DC5D9A4E31183BEDB66C45A9AA43C01F81397
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.......q...5...5...5...n.......n........a/.<......&....../...n...4...n...4..........n.......n...6...5... ...........5...V...............4...5...7.......4...Rich5...........PE..L.....dc.........................,..ZW...,..`W...@..........................0Z......s....@.................................T-Z......`W.T.............-..H....Z..............................\W......\W.....................$PD.@...................UPX0......,.............................UPX1.........,....................@....rsrc........`W....................@......................................................................................................................................................................................................................................................................................................................................3.08.UPX!....

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1572864
Entropy (8bit):	4.290409459480862
Encrypted:	false
SSDEEP:	12288:gk3mVqkeY/nF/yqxdF2FbhV/9j9jaK3yj9flS4lPHx+W0sdNFh84m7t:9mVqkeY/nF/yqxiF1
MD5:	62FFE8528EC62113A2062A1999084EF4
SHA1:	5CF57FE4C97B7608F90B993C7A55704E2EF48980
SHA-256:	DAB78AE32A7BF8E25EC70FC05E04A0EBA1FA7AA66A598C40F5CC386F514DAEED
SHA-512:	6D9092358875A1C03F8971D3FB7DF019DE4132CBBB8365AE45BE06EDC126931CD17FA89CE4D12982DDC88EEDB8F7920858CCFD921D5A3DAE82ACA79F8EAA58C9
Malicious:	false
Preview:	regfj...j...p.\..,.................. ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e...4............E.4............E.....5............E.rmtmnESp.................................................................................................................................................................................................................................................................................................................................................Z-........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve.LOG1

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	3.9432418716611988
Encrypted:	false
SSDEEP:	768:zeqRftx1fJ4JwGFAJVZqSZ5GufNanE3gMqCwHvURBpIDEokqQ/SC9gsMY1vcu:dHJt6dM9GC
MD5:	2973D6D76147514F5F80FE6E8FDD6148
SHA1:	36D5C311E9A1A6975734FCA6F321D1E2A944EAA9
SHA-256:	E7FCA0204726B662BBD024B29FFFD14BE4B368D78F028D52AE72CED0E6086837
SHA-512:	1E4F80CAC1B475645BA695CB703546D15B255283F34649A7AD4DD13F5E49817C290CF66D57C88C08041C4C0FB098F89FDB6700975FF4FD27407CF49FDAB84C79
Malicious:	false
Preview:	regfi...i...p.\..,.................. ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e...4............E.4............E.....5............E.rmtmnESp.................................................................................................................................................................................................................................................................................................................................................Z-HvLE........i..............5...h...m..........0...........0.......0..hbin................p.\..,..........nk,..Up.......h........................... ...........................&...{ad79c032-a2ea-f756-e377-72fb9332c3ae}......nk ..Up....... ........................... .......Z.......................Root........lf......Root....nk ..Up....................}.............. ...............*...............DeviceCensus.......................vk..................WritePermissionsCheck...

C:\un.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	330704
Entropy (8bit):	6.260364870918901
Encrypted:	false
SSDEEP:	6144:trgQe2V7oSbhJN9sivnjPaAqvBIqGdI0W6yfcmuLHRFr6QaMpQqMlKNU+:trgWJPvjPJELkWAF+QM+
MD5:	5770866EDBB1A095D7EDC981F37D9D53
SHA1:	E067A008A709459A1732E0AB06DE277501BE076F
SHA-256:	E4E8AC5179F1DFF784E64C0299A9C39917352A06806EBBA2DE15F8D129275367
SHA-512:	B88C6817EF6D4301D0A99866C884627FBEAF20AEE65CBD3AC519CB1E8880147710CDB19E853B2BD8B712A31EFC57040C189D198EF361C4C2E11F377C42DEAED4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......-..yi..i..i.....h..`.....`..e..`..`..i....`.....`..h..`..h..Richi..........PE..d...X.}T.........."..........T......8..........@....................................\.....@.................................................t(..d........L......\|)...........p..P....................................................................................text............................... ..`.rdata..............................@..@.data....u...@......................@....pdata..\|).......*...L..............@..@.rsrc....y.......z...v..............@..@.reloc..,....p......................@..B................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.979862270635502
TrID:	Win32 Executable (generic) a (10002005/4) 99.70% Win32 EXE Yoda's Crypter (26571/9) 0.26% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	fNlAH8RgLk.exe
File size:	7'251'838 bytes
MD5:	9a90e115834ba8339bd0cc43c034ad55
SHA1:	96109e6ba18aa69a359c90e1fe448e78ba6c1c57
SHA256:	583d8351de707ac2b46a2fb9fd9ee31056ad7a83b9fea10df5f3e5e46f890b92
SHA512:	3bb859e350fb7d9c937a92c23f11778d82e6639cdadd59b96363ecd136fd1434389319bc739c1281e24e2c89bd16c4a4d113ccee7e1de0e5314ea900d3528b06
SSDEEP:	196608:DI3F6n80W6uG2UVznZHBMlHVgvnmBir+5qO:oFREHVTrMl16mB/QO
TLSH:	CE763302F7D1C471D8AA00B48066DAF24A757E3153B9D9FB7BD0693A9E316D0DA32B07
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........2...\...\...\..'....\..'....\.......\...]...\..'....\..'....\..'....\.Rich..\.........PE..L...J..O.................X.........

File Icon


Icon Hash:	2f232d67b7934633

Static PE Info

General

Entrypoint:	0x4029e1
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x4FDA0E4A [Thu Jun 14 16:16:10 2012 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	1ff847646487d56f85778df99ff3728a

Entrypoint Preview

Instruction
call 00007F3AD91863ABh
jmp 00007F3AD918448Eh
mov edi, edi
push esi
push edi
xor esi, esi
mov edi, 0040ABC8h
cmp dword ptr [0040A054h+esi*8], 01h
jne 00007F3AD918461Fh
lea eax, dword ptr [0040A050h+esi*8]
mov dword ptr [eax], edi
push 00000FA0h
push dword ptr [eax]
add edi, 18h
call dword ptr [004070C0h]
test eax, eax
je 00007F3AD918460Eh
inc esi
cmp esi, 24h
jl 00007F3AD91845D5h
xor eax, eax
inc eax
pop edi
pop esi
ret
and dword ptr [0040A050h+esi*8], 00000000h
xor eax, eax
jmp 00007F3AD91845F3h
mov edi, edi
push ebx
mov ebx, dword ptr [004070C4h]
push esi
mov esi, 0040A050h
push edi
mov edi, dword ptr [esi]
test edi, edi
je 00007F3AD9184615h
cmp dword ptr [esi+04h], 01h
je 00007F3AD918460Fh
push edi
call ebx
push edi
call 00007F3AD918431Dh
and dword ptr [esi], 00000000h
pop ecx
add esi, 08h
cmp esi, 0040A170h
jl 00007F3AD91845DEh
mov esi, 0040A050h
pop edi
mov eax, dword ptr [esi]
test eax, eax
je 00007F3AD918460Bh
cmp dword ptr [esi+04h], 01h
jne 00007F3AD9184605h
push eax
call ebx
add esi, 08h
cmp esi, 0040A170h
jl 00007F3AD91845E8h
pop esi
pop ebx
ret
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword ptr [ebp+08h]
push dword ptr [0040A050h+eax*8]
call dword ptr [004070C8h]
pop ebp
ret
push 0000000Ch
push 004094D0h

Rich Headers

Programming Language:

[ASM] VS2010 SP1 build 40219
[ C ] VS2010 SP1 build 40219
[IMP] VS2008 SP1 build 30729
[C++] VS2010 SP1 build 40219
[RES] VS2010 SP1 build 40219
[LNK] VS2010 SP1 build 40219

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x963c	0x64	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc000	0x6da4	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x13000	0x7c8	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x9390	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x7000	0x178	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x5718	0x5800	False	0.6103959517045454	data	6.459452000665297	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x7000	0x2e82	0x3000	False	0.3490397135416667	data	4.975333962704712	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xa000	0x1968	0xc00	False	0.23014322916666666	data	2.586625009588695	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xc000	0x6da4	0x6e00	False	0.47095170454545454	data	5.661983139328753	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x13000	0x1092	0x1200	False	0.3784722222222222	data	3.7122019142927596	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xc2b0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192, 16 important colors	English	United States	0.6317567567567568
RT_ICON	0xc3d8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 320, 256 important colors	English	United States	0.5823699421965318
RT_ICON	0xc940	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640, 16 important colors	English	United States	0.5120967741935484
RT_ICON	0xcc28	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	United States	0.5455776173285198
RT_ICON	0xd4d0	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1536	English	United States	0.36341463414634145
RT_ICON	0xdb38	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2688	English	United States	0.42350746268656714
RT_ICON	0xe9e0	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1152	English	United States	0.4097560975609756
RT_ICON	0xf048	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	United States	0.6391257995735607
RT_ICON	0xfef0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.5276970954356847
RT_GROUP_ICON	0x12498	0x5a	data	English	United States	0.7444444444444445
RT_VERSION	0x124f4	0x3e0	data	English	United States	0.42943548387096775
RT_MANIFEST	0x128d4	0x4d0	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.4772727272727273

Imports

DLL	Import
KERNEL32.dll	_lclose, GetModuleFileNameA, _lread, _llseek, _lopen, _lwrite, _lcreat, CreateDirectoryA, SetCurrentDirectoryA, lstrcatA, FreeLibrary, GetProcAddress, LoadLibraryA, GetDiskFreeSpaceA, GetFileAttributesA, RemoveDirectoryA, DeleteFileA, lstrlenA, GetCurrentDirectoryA, CloseHandle, GetExitCodeProcess, GetLastError, LocalFree, GetCurrentProcess, MoveFileExA, Sleep, GetStringTypeW, MultiByteToWideChar, LCMapStringW, HeapReAlloc, RtlUnwind, HeapSize, lstrcpyA, GetTempPathA, CompareStringA, IsValidCodePage, GetOEMCP, GetModuleHandleW, ExitProcess, DecodePointer, HeapFree, HeapAlloc, GetCommandLineA, HeapSetInformation, GetStartupInfoW, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, EncodePointer, LoadLibraryW, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, TerminateProcess, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, InterlockedIncrement, SetLastError, GetCurrentThreadId, InterlockedDecrement, WriteFile, GetStdHandle, GetModuleFileNameW, IsProcessorFeaturePresent, HeapCreate, FreeEnvironmentStringsW, WideCharToMultiByte, GetEnvironmentStringsW, SetHandleCount, GetFileType, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, GetSystemTimeAsFileTime, GetCPInfo, GetACP
USER32.dll	TranslateMessage, DispatchMessageA, PeekMessageA, wsprintfA, LoadCursorA, SetCursor, MessageBoxA, MsgWaitForMultipleObjects
ADVAPI32.dll	GetTokenInformation, OpenProcessToken
SHELL32.dll	ShellExecuteExA

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

⊘No network behavior found

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: fNlAH8RgLk.exePID: 6008, Parent PID: 3452

General

Target ID:	0
Start time:	06:17:41
Start date:	07/07/2023
Path:	C:\Users\user\Desktop\fNlAH8RgLk.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\fNlAH8RgLk.exe
Imagebase:	0x360000
File size:	7'251'838 bytes
MD5 hash:	9A90E115834BA8339BD0CC43C034AD55
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: irsetup.exePID: 5732, Parent PID: 6008

General

Target ID:	1
Start time:	06:17:42
Start date:	07/07/2023
Path:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:1742194 "__IRAFN:C:\Users\user\Desktop\fNlAH8RgLk.exe" "__IRCT:0" "__IRTSS:0" "__IRSID:S-1-5-21-3853321935-2125563209-4053062332-1002
Imagebase:	0x400000
File size:	1'344'512 bytes
MD5 hash:	DEC931E86140139380EA0DF57CD132B6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 4%, ReversingLabs
Reputation:	moderate

Show Windows behavior

Chronological Activities

Analysis Process: un.exePID: 7180, Parent PID: 5732

General

Target ID:	2
Start time:	06:17:47
Start date:	07/07/2023
Path:	C:\un.exe
Wow64 process (32bit):	false
Commandline:	"C:\un.exe" x -o+ -ppoiuytrewq C:\ProgramData\Data\upx.rar ziliao.jpg C:\ProgramData\Microsoft\Program\
Imagebase:	0x7ff623a00000
File size:	330'704 bytes
MD5 hash:	5770866EDBB1A095D7EDC981F37D9D53
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	moderate

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 7188, Parent PID: 7180

General

Target ID:	3
Start time:	06:17:47
Start date:	07/07/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff745070000
File size:	625'664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: un.exePID: 7232, Parent PID: 5732

General

Target ID:	4
Start time:	06:17:48
Start date:	07/07/2023
Path:	C:\un.exe
Wow64 process (32bit):	false
Commandline:	"C:\un.exe" x -o+ -ppoiuytrewq C:\ProgramData\Data\upx.rar iusb3mon.exe iusb3mon.dat Media.xml C:\Microsoft\
Imagebase:	0x7ff623a00000
File size:	330'704 bytes
MD5 hash:	5770866EDBB1A095D7EDC981F37D9D53
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 7240, Parent PID: 7232

General

Target ID:	5
Start time:	06:17:48
Start date:	07/07/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff745070000
File size:	625'664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: iusb3mon.exePID: 7300, Parent PID: 5732

General

Target ID:	6
Start time:	06:17:49
Start date:	07/07/2023
Path:	C:\Microsoft\iusb3mon.exe
Wow64 process (32bit):	true
Commandline:	"C:\Microsoft\iusb3mon.exe"
Imagebase:	0x400000
File size:	486'832 bytes
MD5 hash:	1B9D1C5BDDAFF4DD75A470FA12E35E66
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 5%, ReversingLabs
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: explorer.exePID: 7320, Parent PID: 5732

General

Target ID:	7
Start time:	06:17:49
Start date:	07/07/2023
Path:	C:\Windows\SysWOW64\explorer.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\explorer.exe" C:\WPS_Setup
Imagebase:	0xe40000
File size:	3'611'360 bytes
MD5 hash:	166AB1B9462E5C1D6D18EC5EC0B6A5F7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: explorer.exePID: 7360, Parent PID: 800

General

Target ID:	8
Start time:	06:17:50
Start date:	07/07/2023
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
Imagebase:	0x7ff69fe90000
File size:	3'933'184 bytes
MD5 hash:	AD5296B280E8F522A8A897C96BAB0E1D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: WerFault.exePID: 7536, Parent PID: 7300

General

Target ID:	12
Start time:	06:17:54
Start date:	07/07/2023
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7300 -s 860
Imagebase:	0x820000
File size:	434'592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: fNlAH8RgLk.exePID: 6008, Parent PID: 3452COMMON

Execution Graph

Execution Coverage:	19.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	6.4%
Total number of Nodes:	1132
Total number of Limit Nodes:	86

Executed Functions

Function 0036188B Relevance: 68.5, APIs: 30, Strings: 9, Instructions: 213
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 98%

			E0036188B(CHAR* __ecx) {
				signed int _v8;
				char _v266;
				char _v267;
				char _v268;
				char _v528;
				char _v788;
				char _v1048;
				char _v1049;
				char _v1050;
				char _v1051;
				char _v1052;
				signed int _v1056;
				CHAR* _v1060;
				signed int _v1064;
				long _v1068;
				intOrPtr _v1072;
				long _v1076;
				long _v1080;
				long _v1084;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t77;
				int _t85;
				long _t99;
				int _t112;
				int _t114;
				int _t135;
				signed int _t142;
				signed int _t143;
				CHAR* _t160;
				void* _t161;
				CHAR* _t169;
				void* _t170;
				CHAR* _t172;
				intOrPtr _t174;
				CHAR* _t177;
				signed int _t178;
				void* _t179;
				void* _t180;
				signed int _t189;

				_t77 =  *0x36a020; // 0x1b0f82c9
				_v8 = _t77 ^ _t178;
				_v1056 = _v1056 & 0x00000000;
				_t169 = __ecx;
				_v1060 = __ecx;
				GetCurrentDirectoryA(0x104,  &_v1048);
				E00362320( &_v268, 0, 0x104);
				_t180 = _t179 + 0xc;
				GetTempPathA(0x104,  &_v268);
				_t172 = _t169 + 0x1008;
				_t85 = lstrlenA(_t172);
				_t170 = lstrcpyA;
				if(_t85 > 2 && E00361747(_t172) != 0) {
					lstrcpyA( &_v268, _t172);
				}
				_t174 =  &_v268 - 1;
				_v1072 = _t174;
				if( *((char*)(lstrlenA( &_v268) + _t174)) != 0x5c) {
					lstrcatA( &_v268, "\\");
				}
				_v1064 = _v1064 & 0x00000000;
				wsprintfA( &_v528, "%s%s_%d",  &_v268, "_ir_sf_temp", 0);
				wsprintfA( &_v788, "%s\\irsetup.exe",  &_v528);
				while(1) {
					_t180 = _t180 + 0x20;
					DeleteFileA( &_v788); // executed
					RemoveDirectoryA( &_v528); // executed
					_t99 = GetFileAttributesA( &_v528); // executed
					if(_t99 == 0xffffffff) {
						break;
					}
					_v1064 = _v1064 + 1;
					wsprintfA( &_v528, "%s%s_%d",  &_v268, "_ir_sf_temp", _v1064);
					wsprintfA( &_v788, "%s\\irsetup.exe",  &_v528);
				}
				CreateDirectoryA( &_v528, 0); // executed
				lstrcpyA( &_v268,  &_v528);
				_t112 = SetCurrentDirectoryA( &_v268); // executed
				if(_t112 == 0) {
					lstrcpyA( &_v268, "c:\\temp");
					CreateDirectoryA( &_v268, 0);
				}
				_t114 = SetCurrentDirectoryA( &_v268);
				_t177 = _v1060;
				if(_t114 == 0) {
					lstrcpyA( &(_t177[8]), "Could not determine a temp directory name.  Try running setup.exe /T:<Path>");
					_v1056 = 0x38;
				}
				if( *((char*)(lstrlenA( &_v268) + _v1072)) != 0x5c) {
					lstrcatA( &_v268, "\\");
				}
				_t160 =  &(_t177[0x1224]);
				lstrcpyA(_t160,  &_v268);
				lstrcpyA( &(_t177[0x1328]),  &_v268);
				_t161 = lstrcatA;
				lstrcatA(_t160, "irsetup.exe");
				lstrcpyA( &(_t177[0x142c]),  &_v268);
				lstrcatA( &(_t177[0x142c]), "lua5.1.dll");
				_v1052 = _v268;
				_v1051 = _v267;
				_v1050 = _v266;
				_v1049 = 0;
				_t135 = GetDiskFreeSpaceA( &_v1052,  &_v1080,  &_v1068,  &_v1076,  &_v1084); // executed
				if(_t135 == 0) {
					L18:
					lstrcpyA(_t177, "You must have at least 2MB of free space on your TEMP drive!");
					_v1056 = 0x39;
				} else {
					_t142 = _v1080 * _v1068;
					_t168 = _t142 * _v1076 >> 0x20;
					_t143 = _t142 * _v1076;
					_t189 = _t142 * _v1076 >> 0x20;
					if(_t189 <= 0 && (_t189 < 0 || _t143 < 0x1e8480)) {
						goto L18;
					}
				}
				SetCurrentDirectoryA( &_v1048); // executed
				return E0036239A(_v1056, _t161, _v8 ^ _t178, _t168, _t170, _t177);
			}

0x00361894
0x0036189b
0x0036189e
0x003618af
0x003618b7
0x003618bd
0x003618cd
0x003618d2
0x003618dd
0x003618e9
0x003618f0
0x003618f2
0x003618fb
0x00361915
0x00361915
0x00361923
0x00361925
0x00361931
0x0036193f
0x0036193f
0x0036194b
0x0036196c
0x00361981
0x003619c6
0x003619c6
0x003619d0
0x003619d9
0x003619e6
0x003619ef
0x00000000
0x00000000
0x0036198b
0x003619af
0x003619c4
0x003619c4
0x00361a00
0x00361a10
0x00361a1f
0x00361a23
0x00361a31
0x00361a3c
0x00361a3c
0x00361a45
0x00361a47
0x00361a4f
0x00361a5a
0x00361a5c
0x00361a5c
0x00361a7d
0x00361a8b
0x00361a8b
0x00361a98
0x00361a9f
0x00361aaf
0x00361ab7
0x00361abd
0x00361acd
0x00361adb
0x00361ae3
0x00361aef
0x00361afb
0x00361b24
0x00361b2b
0x00361b33
0x00361b55
0x00361b5e
0x00361b60
0x00361b35
0x00361b3b
0x00361b42
0x00361b42
0x00361b48
0x00361b4a
0x00000000
0x00000000
0x00361b4a
0x00361b71
0x00361b8b

APIs

GetCurrentDirectoryA.KERNEL32(00000104,?,00000000,?,00000000), ref: 003618BD
GetTempPathA.KERNEL32(00000104,?), ref: 003618DD
lstrlenA.KERNEL32(?), ref: 003618F0
lstrcpyA.KERNEL32(?,?,?), ref: 00361915
lstrlenA.KERNEL32(?), ref: 0036192B
lstrcatA.KERNEL32(?,00367380), ref: 0036193F
wsprintfA.USER32 ref: 0036196C
wsprintfA.USER32 ref: 00361981
wsprintfA.USER32 ref: 003619AF
wsprintfA.USER32 ref: 003619C4
DeleteFileA.KERNELBASE(?), ref: 003619D0
RemoveDirectoryA.KERNELBASE(?), ref: 003619D9
GetFileAttributesA.KERNELBASE(?), ref: 003619E6
CreateDirectoryA.KERNELBASE(?,00000000), ref: 00361A00
lstrcpyA.KERNEL32(?,?), ref: 00361A10
SetCurrentDirectoryA.KERNELBASE(?), ref: 00361A1F
lstrcpyA.KERNEL32(?,c:\temp), ref: 00361A31
CreateDirectoryA.KERNEL32(?,00000000), ref: 00361A3C
SetCurrentDirectoryA.KERNEL32(?), ref: 00361A45
lstrcpyA.KERNEL32(?,Could not determine a temp directory name. Try running setup.exe /T:<Path>), ref: 00361A5A
lstrlenA.KERNEL32(?), ref: 00361A6D
lstrcatA.KERNEL32(?,00367380), ref: 00361A8B
lstrcpyA.KERNEL32(?,?), ref: 00361A9F
lstrcpyA.KERNEL32(?,?), ref: 00361AAF

Part of subcall function 00361747: lstrlenA.KERNEL32(00361909,74CF8170,?,74CB6980), ref: 00361771
Part of subcall function 00361747: lstrcatA.KERNEL32(00361909,00367380), ref: 00361780
Part of subcall function 00361747: lstrlenA.KERNEL32(00361909), ref: 00361787
Part of subcall function 00361747: SetCurrentDirectoryA.KERNEL32(?), ref: 003617DF
Part of subcall function 00361747: CreateDirectoryA.KERNEL32(?,00000000), ref: 003617F1

lstrcatA.KERNEL32(?,irsetup.exe), ref: 00361ABD
lstrcpyA.KERNEL32(?,?), ref: 00361ACD
lstrcatA.KERNEL32(?,lua5.1.dll), ref: 00361ADB
GetDiskFreeSpaceA.KERNELBASE(?,?,?,?,?), ref: 00361B2B
lstrcpyA.KERNEL32(?,You must have at least 2MB of free space on your TEMP drive!), ref: 00361B5E
SetCurrentDirectoryA.KERNELBASE(?), ref: 00361B71

Strings

Could not determine a temp directory name. Try running setup.exe /T:<Path>, xrefs: 00361A51
%s%s_%d, xrefs: 00361966, 003619A9
irsetup.exe, xrefs: 00361AB1
9, xrefs: 00361B60
c:\temp, xrefs: 00361A25
You must have at least 2MB of free space on your TEMP drive!, xrefs: 00361B55
_ir_sf_temp, xrefs: 00361954, 0036199D
%s\irsetup.exe, xrefs: 0036197B, 003619BE
lua5.1.dll, xrefs: 00361ACF

Memory Dump Source

Source File: 00000000.00000002.379856807.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.379847164.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.379876018.0000000000367000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.379890531.000000000036A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.379900293.000000000036C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_fNlAH8RgLk.jbxd

Similarity

API ID: Directory$lstrcpy$Currentlstrcatlstrlen$wsprintf$Create$File$AttributesDeleteDiskFreePathRemoveSpaceTemp
String ID: %s%s_%d$%s\irsetup.exe$9$Could not determine a temp directory name. Try running setup.exe /T:<Path>$You must have at least 2MB of free space on your TEMP drive!$_ir_sf_temp$c:\temp$irsetup.exe$lua5.1.dll
API String ID: 597744483-2787291893
Opcode ID: 77d3b7e5ae0ca4bab5993618a0aa429fb537b0ccae4dbaf34d461ebc5731472b
Instruction ID: af658cc9105d031a888644e5dd7cd6086b4ee384d6ba07b556226b45989458c6
Opcode Fuzzy Hash: 77d3b7e5ae0ca4bab5993618a0aa429fb537b0ccae4dbaf34d461ebc5731472b
Instruction Fuzzy Hash: E58105B690421C9ACB22DB65CC84FDAB7BCAF18304F4485D5E649E3145DB74ABC4CF64

Uniqueness

Uniqueness Score: -1.00%

Function 00361000 Relevance: 24.6, APIs: 10, Strings: 4, Instructions: 127
stringwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 97%

			E00361000(void* __edx, void* __eflags, CHAR* _a12) {
				signed int _v8;
				char _v265;
				char _v266;
				intOrPtr _v267;
				char _v268;
				intOrPtr _v1356;
				int _v1360;
				char _v1620;
				char _v3668;
				char _v5716;
				char _v5724;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t28;
				intOrPtr _t45;
				int _t49;
				intOrPtr _t50;
				int _t52;
				void* _t62;
				void* _t68;
				CHAR* _t69;
				signed int _t70;
				signed int _t75;
				void* _t76;
				void* _t77;
				void* _t78;
				void* _t81;
				void* _t90;

				_t68 = __edx;
				E003623B0(0x1658);
				_t28 =  *0x36a020; // 0x1b0f82c9
				_v8 = _t28 ^ _t75;
				_t69 = _a12;
				 *0x36ab80 = 0;
				SetCursor(LoadCursorA(0, 0x7f02));
				E003611A3( &_v5724);
				E00362320( &_v3668, 0, 0x800);
				_t62 = lstrlenA;
				_t77 = _t76 + 0xc;
				if(lstrlenA(_t69) < 0x800) {
					lstrcpyA( &_v3668, _t69);
				}
				_t70 = 0;
				_v1360 = 0;
				E00362320( &_v1620, 0, 0x104);
				_t78 = _t77 + 0xc;
				_t81 =  *0x36ab88 - _t70; // 0x1
				if(_t81 <= 0) {
					L18:
					_t21 = E00361F7A( &_v5724, _t68, _t90) - 0x32; // -50
					if(_t21 <= 0x31 && _v1356 == 0) {
						MessageBoxA(0,  &_v5716, "Launcher Error", 0x10);
					}
					E00361205( &_v5724);
					return E0036239A(_t72, _t62, _v8 ^ _t75, _t68, _t70, _t72);
				} else {
					do {
						_t45 =  *0x36ab8c; // 0x24c1830
						lstrcpyA( &_v268,  *(_t45 + _t70 * 4));
						if(_v268 != 0x2f) {
							goto L15;
						}
						_t50 = _v267;
						if(_t50 == 0x54) {
							L11:
							_t52 = lstrlenA( &_v268);
							__eflags = _t52 - 3;
							if(__eflags > 0) {
								__eflags = _v266 - 0x3a;
								if(__eflags == 0) {
									__eflags = _t52 - 3;
									if(__eflags > 0) {
										__eflags = _t52 + 0xfffffffd;
										E003623E0( &_v1620,  &_v265, _t52 + 0xfffffffd);
										_t78 = _t78 + 0xc;
									}
								}
							}
							goto L15;
						}
						if(_t50 == 0x57) {
							L9:
							if(lstrlenA( &_v268) == 2) {
								_v1360 = 1;
							}
							goto L15;
						}
						if(_t50 == 0x74) {
							goto L11;
						}
						if(_t50 != 0x77) {
							goto L15;
						}
						goto L9;
						L15:
						_t49 = CompareStringA(0x7f, 1,  &_v268, 0xffffffff, "/~DBG", 0xffffffff); // executed
						if(_t49 == 2) {
							 *0x36ab80 = 1;
						}
						_t70 = _t70 + 1;
						_t90 = _t70 -  *0x36ab88; // 0x1
					} while (_t90 < 0);
					goto L18;
				}
			}

0x00361000
0x00361008
0x0036100d
0x00361014
0x0036101a
0x00361025
0x00361032
0x0036103e
0x00361051
0x00361056
0x0036105c
0x00361064
0x0036106e
0x0036106e
0x00361074
0x00361083
0x00361089
0x0036108e
0x00361091
0x00361097
0x00361151
0x0036115e
0x00361164
0x0036117f
0x0036117f
0x0036118b
0x003611a0
0x0036109d
0x003610a0
0x003610a0
0x003610af
0x003610bc
0x00000000
0x00000000
0x003610be
0x003610c6
0x003610ea
0x003610f1
0x003610f3
0x003610f6
0x003610f8
0x003610ff
0x00361101
0x00361104
0x00361106
0x00361118
0x0036111d
0x0036111d
0x00361104
0x003610ff
0x00000000
0x003610f6
0x003610ca
0x003610d4
0x003610e0
0x003610e2
0x003610e2
0x00000000
0x003610e0
0x003610ce
0x00000000
0x00000000
0x003610d2
0x00000000
0x00000000
0x00000000
0x00361120
0x00361133
0x0036113c
0x0036113e
0x0036113e
0x00361144
0x00361145
0x00361145
0x00000000
0x003610a0

APIs

LoadCursorA.USER32 ref: 0036102B
SetCursor.USER32(00000000), ref: 00361032
lstrlenA.KERNEL32(?), ref: 00361060
lstrcpyA.KERNEL32(?,?), ref: 0036106E
lstrcpyA.KERNEL32(?,024C1830), ref: 003610AF
lstrlenA.KERNEL32(0000002F), ref: 003610DB
lstrlenA.KERNEL32(0000002F), ref: 003610F1
_memmove.LIBCMT ref: 00361118
CompareStringA.KERNELBASE(0000007F,00000001,0000002F,000000FF,/~DBG,000000FF), ref: 00361133
MessageBoxA.USER32 ref: 0036117F

Strings

/~DBG, xrefs: 00361122
/, xrefs: 003610B5
Launcher Error, xrefs: 00361171
:, xrefs: 003610F8

Memory Dump Source

Source File: 00000000.00000002.379856807.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.379847164.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.379876018.0000000000367000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.379890531.000000000036A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.379900293.000000000036C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_fNlAH8RgLk.jbxd

Similarity

API ID: lstrlen$Cursorlstrcpy$CompareLoadMessageString_memmove
String ID: /$/~DBG$:$Launcher Error
API String ID: 1772744953-896055402
Opcode ID: 7dc9c6e689b2fffd57f7ea1b1ecfc1fae3bef48698ba2927aae3b654e30e4dee
Instruction ID: e9c860a06abf1790e9fae3081aa48e7f100dd64f150a9207f5099b298a15e9a3
Opcode Fuzzy Hash: 7dc9c6e689b2fffd57f7ea1b1ecfc1fae3bef48698ba2927aae3b654e30e4dee
Instruction Fuzzy Hash: F4410371C04118ABCF22DBA4DC84AEFB77DAB12314F5981A2E145E3195D7B09EC58F61

Uniqueness

Uniqueness Score: -1.00%

Function 00361B8C Relevance: 72.0, APIs: 32, Strings: 9, Instructions: 270
stringwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 91%

			E00361B8C(CHAR* __ecx, void* __edx) {
				signed int _v8;
				char _v300;
				struct HWND__* _v304;
				void* _v308;
				void* _v312;
				long _v316;
				struct _SHELLEXECUTEINFOA _v376;
				struct tagMSG _v404;
				void* _v416;
				char _v420;
				struct HWND__* _v436;
				short _v438;
				struct HWND__* _v444;
				struct HWND__* _v480;
				void* _v484;
				char _v488;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t90;
				int _t103;
				int _t138;
				struct HWND__* _t141;
				void* _t158;
				int _t159;
				CHAR* _t172;
				void* _t181;
				intOrPtr _t183;
				void* _t184;
				CHAR* _t186;
				void* _t188;
				long _t189;
				signed int _t192;
				void* _t193;
				void* _t194;
				void* _t197;
				intOrPtr _t205;

				_t181 = __edx;
				_t90 =  *0x36a020; // 0x1b0f82c9
				_v8 = _t90 ^ _t192;
				_t172 = __ecx;
				_v488 = 0;
				E00362320( &_v484, 0, 0x40);
				_v420 = 0;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_t183 = 0x44;
				E00362320( &_v488, 0, _t183);
				E00362320( &_v420, 0, 0x10);
				_push(_t172[0x153c]);
				_v438 = 0;
				_v488 = _t183;
				_t184 = wsprintfA;
				_v484 = 0;
				_v436 = 0;
				_v480 = 0;
				_v444 = 0;
				wsprintfA( &_v300, "__IRAOFF:%I64u", _t172[0x1538]);
				_t194 = _t193 + 0x34;
				_t103 = lstrlenA( &(_t172[0x808]));
				_t188 = lstrcatA;
				if(_t103 != 0) {
					lstrcatA( &(_t172[0x808]), " ");
				}
				lstrcatA( &(_t172[0x808]),  &_v300);
				wsprintfA( &_v300, "\"__IRAFN:%s\"",  &(_t172[0x1120]));
				lstrcatA( &(_t172[0x808]), " ");
				lstrcatA( &(_t172[0x808]),  &_v300);
				wsprintfA( &_v300, "\"__IRCT:%d\"", _t172[0x1114] & 0x000000ff);
				lstrcatA( &(_t172[0x808]), " ");
				lstrcatA( &(_t172[0x808]),  &_v300);
				_push(_t172[0x111c]);
				wsprintfA( &_v300, "\"__IRTSS:%I64u\"", _t172[0x1118]);
				_t197 = _t194 + 0x28;
				lstrcatA( &(_t172[0x808]), " ");
				lstrcatA( &(_t172[0x808]),  &_v300);
				_v308 = _v308 & 0x00000000;
				if(OpenProcessToken(GetCurrentProcess(), 8,  &_v308) != 0) {
					_v316 = _v316 & 0x00000000;
					_t158 = E003627AC(_t181, _t184, _t188, 0x4000);
					_v312 = _t158;
					if(_t158 != 0) {
						_t159 = GetTokenInformation(_v308, 1, _t158, 0x4000,  &_v316); // executed
						if(_t159 != 0) {
							_v304 = _v304 & 0x00000000;
							if(E00361821( *_v312,  &_v304) != 0 && _v304 != 0) {
								wsprintfA( &_v300, "\"__IRSID:%s\"", _v304);
								_t197 = _t197 + 0xc;
								_t186 =  &(_t172[0x808]);
								lstrcatA(_t186, " ");
								lstrcatA(_t186,  &_v300);
								LocalFree(_v304);
							}
							E00362772(_v312);
						}
					}
				}
				_t205 =  *0x36ab80; // 0x0
				if(_t205 != 0) {
					MessageBoxA(0,  &(_t172[0x808]),  &(_t172[0x1224]), 0);
				}
				_t189 = 0x3c;
				E00362320( &_v376, 0, _t189);
				_v376.lpFile =  &(_t172[0x1224]);
				_v376.cbSize = _t189;
				_v376.lpParameters =  &(_t172[0x808]);
				_v376.fMask = 0x40;
				_v376.hwnd = 0;
				_v376.lpVerb = "open";
				_v376.lpDirectory = 0;
				_v376.nShow = 1;
				_v376.hInstApp = 0;
				_t138 = ShellExecuteExA( &_v376); // executed
				if(_t138 != 0) {
					if(_t172[0x110c] == 0) {
						L22:
						GetExitCodeProcess(_v376.hProcess,  &(_t172[0x1548])); // executed
						_t141 = _t172[0x1548];
						_v304 = _t141;
						_t172[0x1110] = 1;
						if(_t141 == 0x103 && _t172[0x110c] == 0) {
							_v304 = 0;
						}
						CloseHandle(_v376.hProcess);
						goto L26;
					}
					while(MsgWaitForMultipleObjects(1,  &(_v376.hProcess), 0, 0xffffffff, 0xff) == 1) {
						while(PeekMessageA( &_v404, 0, 0, 0, 1) > 0) {
							if(_v404.message == 0xf || _v404.message == 0x200) {
								TranslateMessage( &_v404);
								DispatchMessageA( &_v404);
							}
						}
					}
					goto L22;
				} else {
					if(GetLastError() == 0x4c7) {
						_v304 = 5;
					} else {
						lstrcpyA(_t172, "Could not start the setup");
						_v304 = 0x37;
					}
					L26:
					return E0036239A(_v304, _t172, _v8 ^ _t192, _t181, 0, 1);
				}
			}

0x00361b8c
0x00361b95
0x00361b9c
0x00361bae
0x00361bb0
0x00361bb6
0x00361bbd
0x00361bc9
0x00361bca
0x00361bcd
0x00361bce
0x00361bd8
0x00361be7
0x00361bec
0x00361bfa
0x00361c07
0x00361c0d
0x00361c19
0x00361c1f
0x00361c25
0x00361c2b
0x00361c31
0x00361c33
0x00361c3d
0x00361c43
0x00361c4b
0x00361c59
0x00361c59
0x00361c69
0x00361c7e
0x00361c8f
0x00361c9f
0x00361cb5
0x00361cc6
0x00361cd6
0x00361cd8
0x00361cf0
0x00361cf2
0x00361d01
0x00361d11
0x00361d13
0x00361d32
0x00361d38
0x00361d44
0x00361d4a
0x00361d52
0x00361d6d
0x00361d75
0x00361d77
0x00361d96
0x00361db3
0x00361db5
0x00361dbd
0x00361dc4
0x00361dce
0x00361dd6
0x00361dd6
0x00361de2
0x00361de7
0x00361d75
0x00361d52
0x00361dea
0x00361df0
0x00361e02
0x00361e02
0x00361e0a
0x00361e15
0x00361e20
0x00361e26
0x00361e32
0x00361e47
0x00361e51
0x00361e57
0x00361e61
0x00361e67
0x00361e6d
0x00361e73
0x00361e7b
0x00361ebd
0x00361f1f
0x00361f2c
0x00361f32
0x00361f38
0x00361f3e
0x00361f49
0x00361f53
0x00361f53
0x00361f5f
0x00000000
0x00361f5f
0x00361f05
0x00361ef0
0x00361ec8
0x00361edd
0x00361eea
0x00361eea
0x00361ec8
0x00361ef0
0x00000000
0x00361e7d
0x00361e88
0x00361ea8
0x00361e8a
0x00361e93
0x00361e99
0x00361e99
0x00361f65
0x00361f79
0x00361f79

APIs

wsprintfA.USER32 ref: 00361C31
lstrlenA.KERNEL32(?), ref: 00361C3D
lstrcatA.KERNEL32(?,003674E0), ref: 00361C59
lstrcatA.KERNEL32(?,?), ref: 00361C69
wsprintfA.USER32 ref: 00361C7E
lstrcatA.KERNEL32(?,003674E0), ref: 00361C8F
lstrcatA.KERNEL32(?,?), ref: 00361C9F
wsprintfA.USER32 ref: 00361CB5
lstrcatA.KERNEL32(?,003674E0), ref: 00361CC6
lstrcatA.KERNEL32(?,?), ref: 00361CD6
wsprintfA.USER32 ref: 00361CF0
lstrcatA.KERNEL32(?,003674E0), ref: 00361D01
lstrcatA.KERNEL32(?,?), ref: 00361D11
GetCurrentProcess.KERNEL32(00000008,00000000), ref: 00361D23
OpenProcessToken.ADVAPI32(00000000), ref: 00361D2A
_malloc.LIBCMT ref: 00361D44
GetTokenInformation.KERNELBASE(00000000,00000001(TokenIntegrityLevel),00000000,00004000,00000000), ref: 00361D6D
wsprintfA.USER32 ref: 00361DB3
lstrcatA.KERNEL32(?,003674E0), ref: 00361DC4
lstrcatA.KERNEL32(?,?), ref: 00361DCE
LocalFree.KERNEL32(00000000), ref: 00361DD6
_free.LIBCMT ref: 00361DE2

Part of subcall function 00362772: RtlFreeHeap.NTDLL(00000000,00000000,?,00363178,00000000), ref: 00362788
Part of subcall function 00362772: GetLastError.KERNEL32(00000000,?,00363178,00000000), ref: 0036279A

MessageBoxA.USER32 ref: 00361E02
ShellExecuteExA.SHELL32(?), ref: 00361E73
GetLastError.KERNEL32 ref: 00361E7D
lstrcpyA.KERNEL32(?,Could not start the setup), ref: 00361E93

Strings

"__IRCT:%d", xrefs: 00361CAF
"__IRTSS:%I64u", xrefs: 00361CEA
Could not start the setup, xrefs: 00361E8A
open, xrefs: 00361E57
"__IRAFN:%s", xrefs: 00361C78
@, xrefs: 00361E47
7, xrefs: 00361E99
__IRAOFF:%I64u, xrefs: 00361C13
"__IRSID:%s", xrefs: 00361DAD

Memory Dump Source

Source File: 00000000.00000002.379856807.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.379847164.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.379876018.0000000000367000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.379890531.000000000036A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.379900293.000000000036C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_fNlAH8RgLk.jbxd

Similarity

API ID: lstrcat$wsprintf$ErrorFreeLastProcessToken$CurrentExecuteHeapInformationLocalMessageOpenShell_free_malloclstrcpylstrlen
String ID: "__IRAFN:%s"$"__IRCT:%d"$"__IRSID:%s"$"__IRTSS:%I64u"$7$@$Could not start the setup$__IRAOFF:%I64u$open
API String ID: 2145089835-2339310841
Opcode ID: ae4bc3bae0cec0c1ff3d8d8d6c0635f9f87391a49ec946e51bd47eb9b54ae3d9
Instruction ID: feca666a725c62742a22027a4d5ac69f9c2ea3dfb0f5d29af52a9691e7cf7e39
Opcode Fuzzy Hash: ae4bc3bae0cec0c1ff3d8d8d6c0635f9f87391a49ec946e51bd47eb9b54ae3d9
Instruction Fuzzy Hash: BCB16171910218ABCB22DF61DC48BDE7BBCFF09314F4480E6EA49E6155DB749A84CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 00361233 Relevance: 43.9, APIs: 17, Strings: 8, Instructions: 184
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 77%

			E00361233(void* __ecx) {
				void _v5;
				int _v12;
				long _v16;
				void* __edi;
				void* __esi;
				int _t81;
				void* _t82;
				int _t87;
				int _t91;
				int _t103;
				intOrPtr* _t104;
				void* _t107;
				void* _t108;
				void* _t113;
				long _t114;
				void* _t115;
				void* _t116;
				void* _t118;

				_t118 = __ecx;
				_t117 = 0;
				_v12 = 0;
				_v16 = 0x7d00;
				_t81 = _lopen(__ecx + 0x1120, 0); // executed
				_t103 = _t81;
				 *(_t118 + 0x1530) = _t103;
				if(_t103 != 0xffffffff) {
					_t82 = E003627AC(_t115, 0, _t118, 0x1f400); // executed
					_t117 = _t82;
					if(_t117 != 0) {
						_t104 = _llseek; // executed
						_llseek(_t103, 0x7d00, 0); // executed
						while(_v16 < 0xa00000) {
							_t87 = _lread( *(_t118 + 0x1530), _t117, 0x1f400); // executed
							_t113 = 0;
							if(_t87 == 0) {
								L25:
								_v16 = _v16 + _t87;
								continue;
							} else {
								goto L7;
							}
							while(1) {
								L7:
								_t9 = _t113 + 0xf; // 0xf
								_t116 = _t9;
								if( *((char*)(_t117 + _t116 - 0xf)) == 0xe0 && _t116 < _t87 &&  *((char*)(_t113 + _t117 + 1)) == 0xe0 &&  *((char*)(_t113 + _t117 + 2)) == 0xe1 &&  *((char*)(_t113 + _t117 + 3)) == 0xe1 &&  *((char*)(_t113 + _t117 + 4)) == 0xe2 &&  *((char*)(_t113 + _t117 + 5)) == 0xe2 &&  *((char*)(_t113 + _t117 + 6)) == 0xe3 &&  *((char*)(_t113 + _t117 + 7)) == 0xe3 &&  *((char*)(_t113 + _t117 + 8)) == 0xe4 &&  *((char*)(_t113 + _t117 + 9)) == 0xe4 &&  *((char*)(_t113 + _t117 + 0xa)) == 0xe5 &&  *((char*)(_t113 + _t117 + 0xb)) == 0xe5 &&  *((char*)(_t113 + _t117 + 0xc)) == 0xe6 &&  *((char*)(_t113 + _t117 + 0xd)) == 0xe6 &&  *((char*)(_t113 + _t117 + 0xe)) == 0xe7 &&  *((char*)(_t113 + _t117 + 0xf)) == 0xe7) {
									break;
								}
								_t113 = _t113 + 1;
								if(_t113 < _t87) {
									continue;
								}
								goto L25;
							}
							 *(_t118 + 0x153c) =  *(_t118 + 0x153c) & 0x00000000;
							_t48 = _t113 + 0x10; // 0xa00010
							_t114 = _v16 + _t48;
							 *(_t118 + 0x1538) = _t114;
							_v5 = 0;
							 *_t104( *(_t118 + 0x1530), _t114, 0); // executed
							_t91 = _lread( *(_t118 + 0x1530),  &_v5, 1); // executed
							if(_t91 == 1) {
								 *(_t118 + 0x1538) =  *(_t118 + 0x1538) + 1;
								asm("adc dword [esi+0x153c], 0x0");
								if(_v5 == 0) {
									 *((intOrPtr*)(_t118 + 0x110c)) = 1;
								}
								_t107 = _t118 + 0x1114;
								 *_t107 = 0; // executed
								_llseek( *(_t118 + 0x1530),  *(_t118 + 0x1538), 0); // executed
								if(_lread( *(_t118 + 0x1530), _t107, 1) == 1) {
									 *(_t118 + 0x1538) =  *(_t118 + 0x1538) + 1;
									_t108 = _t118 + 0x1118;
									asm("adc dword [esi+0x153c], 0x0");
									 *_t108 = 0;
									 *((intOrPtr*)(_t108 + 4)) = 0;
									_llseek( *(_t118 + 0x1530),  *(_t118 + 0x1538), 0); // executed
									if(_lread( *(_t118 + 0x1530), _t108, 8) == 8) {
										 *(_t118 + 0x1538) =  *(_t118 + 0x1538) + 8;
										asm("adc dword [esi+0x153c], 0x0");
										_llseek( *(_t118 + 0x1530),  *(_t118 + 0x1538), 0); // executed
										if(_lread( *(_t118 + 0x1530), _t118 + 0x1540, 8) == 8) {
											 *(_t118 + 0x1538) =  *(_t118 + 0x1538) + 8;
											asm("adc dword [esi+0x153c], 0x0");
										} else {
											lstrcpyA(_t118 + 8, "Could not find setup size");
											_v12 = 0x35;
										}
										goto L39;
									}
									_push("Could not find total size indicator");
									goto L29;
								} else {
									_push("Could not find compression type indicator");
									L29:
									lstrcpyA(_t118 + 8, ??);
									_v12 = 0x34;
									L39:
									E00362772(_t117);
									return _v12;
								}
							}
							_push("Could not find multi-segment indicator");
							goto L29;
						}
						_push("Could not find data segment");
						goto L29;
					}
					lstrcpyA(_t118 + 8, "Unable to allocate memory buffer");
					_v12 = 0x33;
					goto L39;
				}
				lstrcpyA(_t118 + 8, "Unable to open archive file");
				_v12 = 0x32;
				goto L39;
			}

0x0036123c
0x0036123e
0x00361248
0x0036124b
0x00361252
0x00361258
0x0036125a
0x00361263
0x00361285
0x0036128a
0x0036128f
0x003612b4
0x003612ba
0x003612bc
0x003612d5
0x003612db
0x003612df
0x0036135d
0x0036135d
0x00000000
0x00000000
0x00000000
0x00000000
0x003612e1
0x003612e1
0x003612e1
0x003612e1
0x003612e9
0x00000000
0x00000000
0x00361358
0x0036135b
0x00000000
0x00000000
0x00000000
0x0036135b
0x00361368
0x0036136f
0x0036136f
0x0036137c
0x00361382
0x00361386
0x00361396
0x0036139e
0x003613c2
0x003613c8
0x003613d3
0x003613d5
0x003613d5
0x003613e3
0x003613ef
0x003613f2
0x0036140a
0x00361413
0x0036141a
0x00361420
0x00361430
0x00361438
0x0036143b
0x00361455
0x00361461
0x0036146a
0x0036147d
0x00361497
0x003614b1
0x003614b8
0x00361499
0x003614a2
0x003614a8
0x003614a8
0x00000000
0x00361497
0x00361457
0x00000000
0x0036140c
0x0036140c
0x003613ac
0x003613b0
0x003613b6
0x003614bf
0x003614c0
0x003614cd
0x003614cd
0x0036140a
0x003613a0
0x00000000
0x003613a0
0x003613a7
0x00000000
0x003613a7
0x0036129a
0x003612a0
0x00000000
0x003612a0
0x0036126e
0x00361274
0x00000000

APIs

_lopen.KERNEL32(?,00000000), ref: 00361252
lstrcpyA.KERNEL32(?,Unable to open archive file), ref: 0036126E
_malloc.LIBCMT ref: 00361285
lstrcpyA.KERNEL32(?,Unable to allocate memory buffer), ref: 0036129A
_free.LIBCMT ref: 003614C0

Strings

Could not find setup size, xrefs: 00361499
5, xrefs: 003614A8
Could not find multi-segment indicator, xrefs: 003613A0
Unable to open archive file, xrefs: 00361265
Could not find data segment, xrefs: 003613A7
Could not find compression type indicator, xrefs: 0036140C
Unable to allocate memory buffer, xrefs: 00361291
Could not find total size indicator, xrefs: 00361457

Memory Dump Source

Source File: 00000000.00000002.379856807.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.379847164.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.379876018.0000000000367000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.379890531.000000000036A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.379900293.000000000036C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_fNlAH8RgLk.jbxd

Similarity

API ID: lstrcpy$_free_lopen_malloc
String ID: 5$Could not find compression type indicator$Could not find data segment$Could not find multi-segment indicator$Could not find setup size$Could not find total size indicator$Unable to allocate memory buffer$Unable to open archive file
API String ID: 3261646874-2242580901
Opcode ID: 5c2ca087dc199ee16657bf5526e13189e325548923bed1b72e625298e9dd2ff3
Instruction ID: 99799ded0587869ba41e2f2f2a0e4a04c046e49c273810522b5ccee9cda498b3
Opcode Fuzzy Hash: 5c2ca087dc199ee16657bf5526e13189e325548923bed1b72e625298e9dd2ff3
Instruction Fuzzy Hash: 15715534818B41FEDF338B708C84BD6BAB4AB51369F28C79DE0BB865D9D37059468B10

Uniqueness

Uniqueness Score: -1.00%

Function 003615E0 Relevance: 35.1, APIs: 14, Strings: 6, Instructions: 107
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 66%

			E003615E0(void* __ecx) {
				int _v8;
				CHAR* _v12;
				int _v16;
				void _v20;
				void* __edi;
				void* __esi;
				int _t42;
				CHAR* _t43;
				int _t53;
				int _t54;
				intOrPtr* _t62;
				void* _t68;
				intOrPtr* _t69;
				int _t70;
				void* _t71;

				_t69 = _llseek;
				_t71 = __ecx;
				_v8 = 0;
				_v20 = 0;
				_v16 = 0;
				_llseek( *(__ecx + 0x1530),  *(__ecx + 0x1538), 0); // executed
				_t62 = _lread;
				_t42 = _lread( *(_t71 + 0x1530),  &_v20, 8); // executed
				if(_t42 == 8) {
					 *((intOrPtr*)(_t71 + 0x1538)) =  *((intOrPtr*)(_t71 + 0x1538)) + 8;
					asm("adc dword [esi+0x153c], 0x0");
				} else {
					lstrcpyA(_t71 + 8, "Could not find Lua DLL file size");
					_v8 = 0x3a;
				}
				_t43 = E003627AC(_t68, _t69, _t71, _v20); // executed
				_v12 = _t43;
				if(_t43 == 0) {
					lstrcpyA(_t71 + 8, "Failed to alloc memory.");
					_v8 = 0x36;
				} else {
					 *_t69( *(_t71 + 0x1530),  *((intOrPtr*)(_t71 + 0x1538)), 0); // executed
					_push(_v20);
					_push(_v12);
					_push( *(_t71 + 0x1530));
					if( *_t62() != _v20 || 0 != _v16) {
						lstrcpyA(_t71 + 8, "Failed to read Lua DLL");
						_v8 = 0x36;
					} else {
						if(_v8 == 0) {
							_t53 = _lcreat(_t71 + 0x142c, 0); // executed
							_t70 = _t53;
							if(_t70 != 0xffffffff) {
								_t54 = _lwrite(_t70, _v12, _v20); // executed
								if(_t54 != _v20 || 0 != _v16) {
									lstrcpyA(_t71 + 8, "Unable to write to Lua file.");
									_v8 = 0x37;
								}
								_lclose(_t70); // executed
							} else {
								lstrcpyA(_t71 + 8, "Unable to open Lua DLL file");
								_v8 = 0x37;
							}
						}
						 *((intOrPtr*)(_t71 + 0x1538)) =  *((intOrPtr*)(_t71 + 0x1538)) + _v20;
						asm("adc [esi+0x153c], eax");
					}
					E00362772(_v12);
				}
				return _v8;
			}

0x003615e9
0x003615f1
0x003615fa
0x00361603
0x00361606
0x00361609
0x0036160b
0x0036161d
0x00361622
0x0036163c
0x00361643
0x00361624
0x0036162d
0x00361633
0x00361633
0x0036164d
0x00361653
0x00361658
0x00361732
0x00361738
0x0036165e
0x0036166c
0x0036166e
0x00361671
0x00361674
0x00361681
0x00361711
0x00361717
0x0036168c
0x0036168f
0x00361699
0x0036169f
0x003616a4
0x003616c5
0x003616d0
0x003616e0
0x003616e6
0x003616e6
0x003616ee
0x003616a6
0x003616af
0x003616b5
0x003616b5
0x003616a4
0x003616f7
0x00361700
0x00361700
0x00361721
0x00361726
0x00361746

APIs

_llseek.KERNEL32(?,?,00000000), ref: 00361609
_lread.KERNEL32(?,?,00000008), ref: 0036161D
lstrcpyA.KERNEL32(?,Could not find Lua DLL file size), ref: 0036162D
_malloc.LIBCMT ref: 0036164D
_llseek.KERNEL32(?,?,00000000), ref: 0036166C
_lread.KERNEL32(?,?,?), ref: 0036167A
_lcreat.KERNEL32(?,?), ref: 00361699
lstrcpyA.KERNEL32(?,Unable to open Lua DLL file), ref: 003616AF
_lwrite.KERNEL32(00000000,?,?), ref: 003616C5
lstrcpyA.KERNEL32(?,Unable to write to Lua file.), ref: 003616E0
_lclose.KERNEL32(00000000), ref: 003616EE
lstrcpyA.KERNEL32(?,Failed to read Lua DLL), ref: 00361711
_free.LIBCMT ref: 00361721
lstrcpyA.KERNEL32(?,Failed to alloc memory.), ref: 00361732

Strings

Failed to read Lua DLL, xrefs: 00361708
6, xrefs: 00361738
Unable to write to Lua file., xrefs: 003616D7
Failed to alloc memory., xrefs: 00361729
Could not find Lua DLL file size, xrefs: 00361624
Unable to open Lua DLL file, xrefs: 003616A6

Memory Dump Source

Source File: 00000000.00000002.379856807.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.379847164.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.379876018.0000000000367000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.379890531.000000000036A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.379900293.000000000036C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_fNlAH8RgLk.jbxd

Similarity

API ID: lstrcpy$_llseek_lread$_free_lclose_lcreat_lwrite_malloc
String ID: 6$Could not find Lua DLL file size$Failed to alloc memory.$Failed to read Lua DLL$Unable to open Lua DLL file$Unable to write to Lua file.
API String ID: 4172578098-1978040295
Opcode ID: c25f5e1b4071c4a1e8f1be33b41fea2c99c2e711ad8dac6e93390914ca59eced
Instruction ID: c120a799954924448f3c0011ce864cca562ab8d1a08ceb42d262f020f98dc501
Opcode Fuzzy Hash: c25f5e1b4071c4a1e8f1be33b41fea2c99c2e711ad8dac6e93390914ca59eced
Instruction Fuzzy Hash: 5D414E75904604EFCF229BA4DC849EEBBB8FF44359F55895AF826A3160D7706A04DF20

Uniqueness

Uniqueness Score: -1.00%

Function 003614CE Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 82
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 87%

			E003614CE(void* __edx, void* __edi, void* __eflags) {
				signed int _v8;
				signed int _v12;
				void* __esi;
				CHAR* _t27;
				int _t30;
				int _t35;
				void* _t36;
				CHAR* _t43;
				void* _t45;
				void* _t49;
				void* _t50;
				int _t52;
				void* _t55;
				CHAR* _t57;

				_t50 = __edx;
				_push(_t45);
				_push(_t45);
				_v8 = _v8 & 0x00000000;
				_t55 = _t45;
				_t27 = E003627AC(__edx, __edi, _t55,  *(_t55 + 0x1540)); // executed
				_v12 = _v12 | 0xffffffff;
				_t43 = _t27;
				if(_t43 != 0) {
					_push(__edi);
					_llseek( *(_t55 + 0x1530),  *(_t55 + 0x1538), 0); // executed
					_t30 = _lread( *(_t55 + 0x1530), _t43,  *(_t55 + 0x1540)); // executed
					if(_t30 !=  *(_t55 + 0x1540) || 0 !=  *((intOrPtr*)(_t55 + 0x1544))) {
						_t57 = _t55 + 8;
						__eflags = _t57;
						lstrcpyA(_t57, "Failed to read setup engine");
						_t52 = _v12;
						_v8 = 0x36;
					} else {
						_t35 = _lcreat(_t55 + 0x1224, 0); // executed
						_t52 = _t35;
						if(_t52 != 0xffffffff) {
							_t49 = 0;
							__eflags = 0;
							while(1) {
								_t36 = _t49;
								asm("cdq");
								__eflags = _t50 -  *((intOrPtr*)(_t55 + 0x1544));
								if(__eflags > 0) {
									break;
								}
								if(__eflags < 0) {
									L9:
									 *(_t49 + _t43) =  *(_t49 + _t43) ^ 0x00000007;
									_t49 = _t49 + 1;
									__eflags = _t49 - 0x7d0;
									if(_t49 < 0x7d0) {
										continue;
									}
								} else {
									__eflags = _t36 -  *(_t55 + 0x1540);
									if(_t36 <  *(_t55 + 0x1540)) {
										goto L9;
									}
								}
								break;
							}
							_lwrite(_t52, _t43,  *(_t55 + 0x1540)); // executed
						} else {
							lstrcpyA(_t55 + 8, "Unable to open setup file");
							_v8 = 0x37;
						}
						 *(_t55 + 0x1538) =  *(_t55 + 0x1538) +  *(_t55 + 0x1540);
						asm("adc [esi+0x153c], eax");
					}
					E00362772(_t43); // executed
					if(_t52 != 0xffffffff) {
						_lclose(_t52); // executed
					}
				}
				return _v8;
			}

0x003614ce
0x003614d1
0x003614d2
0x003614d3
0x003614d9
0x003614e1
0x003614e6
0x003614ea
0x003614ef
0x003614f5
0x00361504
0x00361517
0x00361525
0x003615b1
0x003615b1
0x003615b5
0x003615bb
0x003615be
0x00361533
0x0036153b
0x00361541
0x00361546
0x00361560
0x00361560
0x00361562
0x00361562
0x00361564
0x00361565
0x0036156b
0x00000000
0x00000000
0x0036156d
0x00361577
0x00361577
0x0036157b
0x0036157c
0x00361582
0x00000000
0x00000000
0x0036156f
0x0036156f
0x00361575
0x00000000
0x00000000
0x00361575
0x00000000
0x0036156d
0x0036158c
0x00361548
0x00361551
0x00361557
0x00361557
0x00361598
0x003615a4
0x003615a4
0x003615c6
0x003615cf
0x003615d2
0x003615d2
0x003615d8
0x003615df

APIs

_malloc.LIBCMT ref: 003614E1

Part of subcall function 003627AC: __FF_MSGBANNER.LIBCMT ref: 003627C5
Part of subcall function 003627AC: __NMSG_WRITE.LIBCMT ref: 003627CC
Part of subcall function 003627AC: RtlAllocateHeap.NTDLL(00000000,00000001,00000000,?,00000000,?,0036128A,0001F400), ref: 003627F1

_llseek.KERNEL32(?,?,00000000), ref: 00361504
_lread.KERNEL32(?,00000000,?,?,00361FA7,00000000,00000800), ref: 00361517
_lcreat.KERNEL32(?,?), ref: 0036153B
lstrcpyA.KERNEL32(?,Unable to open setup file,?,00361FA7,00000000,00000800), ref: 00361551
_lwrite.KERNEL32(00000000,00000000,?,?,00361FA7,00000000,00000800), ref: 0036158C
lstrcpyA.KERNEL32(?,Failed to read setup engine,?,00361FA7,00000000,00000800), ref: 003615B5
_free.LIBCMT ref: 003615C6
_lclose.KERNEL32(000000FF), ref: 003615D2

Strings

Failed to read setup engine, xrefs: 003615AC
Unable to open setup file, xrefs: 00361548
6, xrefs: 003615BE

Memory Dump Source

Source File: 00000000.00000002.379856807.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.379847164.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.379876018.0000000000367000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.379890531.000000000036A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.379900293.000000000036C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_fNlAH8RgLk.jbxd

Similarity

API ID: lstrcpy$AllocateHeap_free_lclose_lcreat_llseek_lread_lwrite_malloc
String ID: 6$Failed to read setup engine$Unable to open setup file
API String ID: 694386576-1523045757
Opcode ID: 21132294fad7d9c6eea2d196387a933af1378e83bad861c8f55045a4defbf9a5
Instruction ID: 0834930282c9169bfbcd942b3e8b1cfc1e3eb8f9cdf16c505789e63b911c4486
Opcode Fuzzy Hash: 21132294fad7d9c6eea2d196387a933af1378e83bad861c8f55045a4defbf9a5
Instruction Fuzzy Hash: 13319371514A00EFC7269B74DC88ADBB7F8EF85369F24891DF667D6090D77069408B20

Uniqueness

Uniqueness Score: -1.00%

Function 00361F7A Relevance: 10.6, APIs: 7, Instructions: 66
filesleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00361F7A(CHAR* __ecx, void* __edx, void* __eflags) {
				void* __edi;
				void* _t6;
				CHAR* _t8;
				void* _t17;
				void* _t18;
				void* _t19;
				void* _t20;
				void* _t21;
				void* _t28;
				CHAR* _t32;
				CHAR* _t33;
				intOrPtr _t40;

				_t28 = __edx;
				_t32 = __ecx;
				E0036121E(__ecx);
				_t6 = E00361233(__ecx); // executed
				_t21 = _t6;
				if(_t21 == 0) {
					_t17 = E0036188B(__ecx); // executed
					_t21 = _t17;
					_t37 = _t21;
					if(_t21 == 0) {
						_t18 = E003614CE(_t28, 0, _t37); // executed
						_t21 = _t18;
						if(_t21 == 0) {
							_t19 = E003615E0(__ecx); // executed
							_t21 = _t19;
							if(_t21 == 0) {
								_t20 = E00361B8C(__ecx, _t28); // executed
								_t21 = _t20;
							}
						}
					}
				}
				_t40 =  *0x36ab80; // 0x0
				if(_t40 == 0) {
					Sleep(0xa); // executed
					_t8 = _t32 + 0x1224;
					if( *((intOrPtr*)(_t32 + 0x110c)) == 0) {
						MoveFileExA(_t8, 0, 5);
						MoveFileExA(_t32 + 0x142c, 0, 5);
						_t33 = _t32 + 0x1328;
						__eflags = _t33;
						MoveFileExA(_t33, 0, 5);
					} else {
						DeleteFileA(_t8); // executed
						DeleteFileA(_t32 + 0x142c); // executed
						RemoveDirectoryA(_t32 + 0x1328); // executed
					}
				}
				return _t21;
			}

0x00361f7a
0x00361f7d
0x00361f7f
0x00361f86
0x00361f8b
0x00361f91
0x00361f95
0x00361f9a
0x00361f9c
0x00361f9e
0x00361fa2
0x00361fa7
0x00361fab
0x00361faf
0x00361fb4
0x00361fb8
0x00361fbc
0x00361fc1
0x00361fc1
0x00361fb8
0x00361fab
0x00361f9e
0x00361fc3
0x00361fc9
0x00361fcd
0x00361fd3
0x00361fdf
0x0036200c
0x00362019
0x0036201f
0x0036201f
0x00362026
0x00361fe1
0x00361fe8
0x00361ff1
0x00361ffa
0x00361ffa
0x00361fdf
0x0036202d

APIs

Part of subcall function 0036121E: GetModuleFileNameA.KERNEL32(00000000,?,00000104,00361F84,00000000,00000800,74CB6980,0036115C), ref: 0036122C

Part of subcall function 00361233: _lopen.KERNEL32(?,00000000), ref: 00361252
Part of subcall function 00361233: lstrcpyA.KERNEL32(?,Unable to open archive file), ref: 0036126E
Part of subcall function 00361233: _free.LIBCMT ref: 003614C0

Sleep.KERNELBASE(0000000A,00000000,00000800,74CB6980,0036115C), ref: 00361FCD
DeleteFileA.KERNELBASE(?), ref: 00361FE8
DeleteFileA.KERNELBASE(?), ref: 00361FF1
RemoveDirectoryA.KERNELBASE(?), ref: 00361FFA

Part of subcall function 0036188B: GetCurrentDirectoryA.KERNEL32(00000104,?,00000000,?,00000000), ref: 003618BD
Part of subcall function 0036188B: GetTempPathA.KERNEL32(00000104,?), ref: 003618DD
Part of subcall function 0036188B: lstrlenA.KERNEL32(?), ref: 003618F0
Part of subcall function 0036188B: lstrcpyA.KERNEL32(?,?,?), ref: 00361915
Part of subcall function 0036188B: lstrlenA.KERNEL32(?), ref: 0036192B
Part of subcall function 0036188B: lstrcatA.KERNEL32(?,00367380), ref: 0036193F
Part of subcall function 0036188B: wsprintfA.USER32 ref: 0036196C
Part of subcall function 0036188B: wsprintfA.USER32 ref: 00361981
Part of subcall function 0036188B: DeleteFileA.KERNELBASE(?), ref: 003619D0
Part of subcall function 0036188B: RemoveDirectoryA.KERNELBASE(?), ref: 003619D9
Part of subcall function 0036188B: GetFileAttributesA.KERNELBASE(?), ref: 003619E6
Part of subcall function 0036188B: CreateDirectoryA.KERNELBASE(?,00000000), ref: 00361A00
Part of subcall function 0036188B: lstrcpyA.KERNEL32(?,?), ref: 00361A10
Part of subcall function 0036188B: SetCurrentDirectoryA.KERNELBASE(?), ref: 00361A1F

MoveFileExA.KERNEL32 ref: 0036200C
MoveFileExA.KERNEL32 ref: 00362019
MoveFileExA.KERNEL32 ref: 00362026

Part of subcall function 003614CE: _malloc.LIBCMT ref: 003614E1
Part of subcall function 003614CE: _llseek.KERNEL32(?,?,00000000), ref: 00361504
Part of subcall function 003614CE: _lread.KERNEL32(?,00000000,?,?,00361FA7,00000000,00000800), ref: 00361517
Part of subcall function 003614CE: _lcreat.KERNEL32(?,?), ref: 0036153B
Part of subcall function 003614CE: lstrcpyA.KERNEL32(?,Unable to open setup file,?,00361FA7,00000000,00000800), ref: 00361551
Part of subcall function 003614CE: _free.LIBCMT ref: 003615C6
Part of subcall function 003614CE: _lclose.KERNEL32(000000FF), ref: 003615D2

Part of subcall function 003615E0: _llseek.KERNEL32(?,?,00000000), ref: 00361609
Part of subcall function 003615E0: _lread.KERNEL32(?,?,00000008), ref: 0036161D
Part of subcall function 003615E0: lstrcpyA.KERNEL32(?,Could not find Lua DLL file size), ref: 0036162D
Part of subcall function 003615E0: _malloc.LIBCMT ref: 0036164D
Part of subcall function 003615E0: _llseek.KERNEL32(?,?,00000000), ref: 0036166C
Part of subcall function 003615E0: _lread.KERNEL32(?,?,?), ref: 0036167A
Part of subcall function 003615E0: _lcreat.KERNEL32(?,?), ref: 00361699
Part of subcall function 003615E0: lstrcpyA.KERNEL32(?,Unable to open Lua DLL file), ref: 003616AF
Part of subcall function 003615E0: _free.LIBCMT ref: 00361721

Part of subcall function 00361B8C: wsprintfA.USER32 ref: 00361C31
Part of subcall function 00361B8C: lstrlenA.KERNEL32(?), ref: 00361C3D
Part of subcall function 00361B8C: lstrcatA.KERNEL32(?,003674E0), ref: 00361C59
Part of subcall function 00361B8C: lstrcatA.KERNEL32(?,?), ref: 00361C69
Part of subcall function 00361B8C: wsprintfA.USER32 ref: 00361C7E
Part of subcall function 00361B8C: lstrcatA.KERNEL32(?,003674E0), ref: 00361C8F
Part of subcall function 00361B8C: lstrcatA.KERNEL32(?,?), ref: 00361C9F
Part of subcall function 00361B8C: wsprintfA.USER32 ref: 00361CB5
Part of subcall function 00361B8C: lstrcatA.KERNEL32(?,003674E0), ref: 00361CC6
Part of subcall function 00361B8C: lstrcatA.KERNEL32(?,?), ref: 00361CD6

Memory Dump Source

Source File: 00000000.00000002.379856807.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.379847164.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.379876018.0000000000367000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.379890531.000000000036A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.379900293.000000000036C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_fNlAH8RgLk.jbxd

Similarity

API ID: File$lstrcat$lstrcpy$Directorywsprintf$DeleteMove_free_llseek_lreadlstrlen$CurrentRemove_lcreat_malloc$AttributesCreateModuleNamePathSleepTemp_lclose_lopen
String ID:
API String ID: 3481004031-0
Opcode ID: cbf50fc356f6f5995e35e94adfed63a956408ec8b70140f76344b5e367e54f12
Instruction ID: f77306be3e9a5668b03a557dfe8612ba0a0a327ae775ec9d69978fc6daa0c9d7
Opcode Fuzzy Hash: cbf50fc356f6f5995e35e94adfed63a956408ec8b70140f76344b5e367e54f12
Instruction Fuzzy Hash: DB11E131B40F1057C623B3B04C89B9F22DD9BD9751F1A8925F206DF188EBE44D018BA0

Uniqueness

Uniqueness Score: -1.00%

Function 00362059 Relevance: 3.0, APIs: 2, Instructions: 8
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00362059(int _a4) {

				E0036202E(_a4);
				ExitProcess(_a4);
			}

0x00362061
0x0036206a

APIs

___crtCorExitProcess.LIBCMT ref: 00362061

Part of subcall function 0036202E: GetModuleHandleW.KERNEL32(mscoree.dll,?,00362066,0036128A,?,00362AD5,000000FF,0000001E,003694D0,0000000C,00362B80,0036128A,0036128A,?,003630A4,0000000D), ref: 00362038
Part of subcall function 0036202E: GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00362048

ExitProcess.KERNEL32 ref: 0036206A

Memory Dump Source

Source File: 00000000.00000002.379856807.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.379847164.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.379876018.0000000000367000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.379890531.000000000036A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.379900293.000000000036C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_fNlAH8RgLk.jbxd

Similarity

API ID: ExitProcess$AddressHandleModuleProc___crt
String ID:
API String ID: 2427264223-0
Opcode ID: 90137123baaaf5cac55a592fe65bd885e66b584518cacbc814ceb6a99e5657a5
Instruction ID: 27720bb2d9486375c29f599e1c2d76bc15d3b0838fc9915ecb79971a564a3207
Opcode Fuzzy Hash: 90137123baaaf5cac55a592fe65bd885e66b584518cacbc814ceb6a99e5657a5
Instruction Fuzzy Hash: 3FB09235004108BFCB132F26DD0A84A3F2AEF803A0F518021F9080E032DFF2AD92DA94

Uniqueness

Uniqueness Score: -1.00%

Function 00365A70 Relevance: 1.6, APIs: 1, Instructions: 52
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 86%

			E00365A70(signed int _a4, signed int _a8, long _a12) {
				void* _t10;
				long _t11;
				long _t12;
				signed int _t13;
				signed int _t17;
				long _t19;
				long _t24;

				_t17 = _a4;
				if(_t17 == 0) {
					L3:
					_t24 = _t17 * _a8;
					__eflags = _t24;
					if(_t24 == 0) {
						_t24 = _t24 + 1;
						__eflags = _t24;
					}
					goto L5;
					L6:
					_t10 = RtlAllocateHeap( *0x36b6a4, 8, _t24); // executed
					__eflags = 0;
					if(0 == 0) {
						goto L7;
					}
					L14:
					return _t10;
					goto L15;
					L7:
					__eflags =  *0x36b6a8;
					if( *0x36b6a8 == 0) {
						_t19 = _a12;
						__eflags = _t19;
						if(_t19 != 0) {
							 *_t19 = 0xc;
						}
					} else {
						_t11 = E00362FAE(_t10, _t24);
						__eflags = _t11;
						if(_t11 != 0) {
							L5:
							_t10 = 0;
							__eflags = _t24 - 0xffffffe0;
							if(_t24 > 0xffffffe0) {
								goto L7;
							} else {
								goto L6;
							}
						} else {
							_t12 = _a12;
							__eflags = _t12;
							if(_t12 != 0) {
								 *_t12 = 0xc;
							}
							_t10 = 0;
						}
					}
					goto L14;
				} else {
					_t13 = 0xffffffe0;
					_t27 = _t13 / _t17 - _a8;
					if(_t13 / _t17 >= _a8) {
						goto L3;
					} else {
						 *((intOrPtr*)(E0036348D(_t27))) = 0xc;
						return 0;
					}
				}
				L15:
			}

0x00365a75
0x00365a7a
0x00365a97
0x00365a9c
0x00365a9e
0x00365aa0
0x00365aa2
0x00365aa2
0x00365aa2
0x00000000
0x00365aaa
0x00365ab3
0x00365ab9
0x00365abb
0x00000000
0x00000000
0x00365aef
0x00365af1
0x00000000
0x00365abd
0x00365abd
0x00365ac4
0x00365ae2
0x00365ae5
0x00365ae7
0x00365ae9
0x00365ae9
0x00365ac6
0x00365ac7
0x00365acd
0x00365acf
0x00365aa3
0x00365aa3
0x00365aa5
0x00365aa8
0x00000000
0x00000000
0x00000000
0x00000000
0x00365ad1
0x00365ad1
0x00365ad4
0x00365ad6
0x00365ad8
0x00365ad8
0x00365ade
0x00365ade
0x00365acf
0x00000000
0x00365a7c
0x00365a80
0x00365a83
0x00365a86
0x00000000
0x00365a88
0x00365a8d
0x00365a96
0x00365a96
0x00365a86
0x00000000

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,00364882,0036128A,?,00000000,00000000,00000000,?,00363139,00000001,00000214,?,0036128A), ref: 00365AB3

Part of subcall function 0036348D: __getptd_noexit.LIBCMT ref: 0036348D

Memory Dump Source

Source File: 00000000.00000002.379856807.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.379847164.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.379876018.0000000000367000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.379890531.000000000036A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.379900293.000000000036C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_fNlAH8RgLk.jbxd

Similarity

API ID: AllocateHeap__getptd_noexit
String ID:
API String ID: 328603210-0
Opcode ID: 9d11f00ce94bf66deb9eb967ed395d8407fc9ca4ad289869adb850ae634de538
Instruction ID: 11d677465c2fb300b9a0c47f168b2dadbffe2d6cb33d75b1dee230e57b88c1f7
Opcode Fuzzy Hash: 9d11f00ce94bf66deb9eb967ed395d8407fc9ca4ad289869adb850ae634de538
Instruction Fuzzy Hash: 5901B131251A169AEB279FA5DC84B6B3759EF81760F12C739E816CB198DBB0CC00C650

Uniqueness

Uniqueness Score: -1.00%

Function 003622B1 Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 25%

			E003622B1(intOrPtr _a4) {
				void* __ebp;
				void* _t2;
				void* _t3;
				void* _t4;
				void* _t5;
				void* _t8;

				_push(0);
				_push(0);
				_push(_a4);
				_t2 = E00362171(_t3, _t4, _t5, _t8); // executed
				return _t2;
			}

0x003622b6
0x003622b8
0x003622ba
0x003622bd
0x003622c6

APIs

_doexit.LIBCMT ref: 003622BD

Part of subcall function 00362171: __lock.LIBCMT ref: 0036217F
Part of subcall function 00362171: RtlDecodePointer.NTDLL(00369490,00000020,003622D8,0036128A,00000001,00000000,?,00362318,000000FF,?,00362B8C,00000011,0036128A,?,003630A4,0000000D), ref: 003621BB
Part of subcall function 00362171: DecodePointer.KERNEL32(?,00362318,000000FF,?,00362B8C,00000011,0036128A,?,003630A4,0000000D), ref: 003621CC
Part of subcall function 00362171: DecodePointer.KERNEL32(-00000004,?,00362318,000000FF,?,00362B8C,00000011,0036128A,?,003630A4,0000000D), ref: 003621F2
Part of subcall function 00362171: DecodePointer.KERNEL32(?,00362318,000000FF,?,00362B8C,00000011,0036128A,?,003630A4,0000000D), ref: 00362205
Part of subcall function 00362171: DecodePointer.KERNEL32(?,00362318,000000FF,?,00362B8C,00000011,0036128A,?,003630A4,0000000D), ref: 0036220F

Memory Dump Source

Source File: 00000000.00000002.379856807.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.379847164.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.379876018.0000000000367000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.379890531.000000000036A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.379900293.000000000036C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_fNlAH8RgLk.jbxd

Similarity

API ID: DecodePointer$__lock_doexit
String ID:
API String ID: 3343572566-0
Opcode ID: b7f9ddcf0c01e83a82a0f1c6c29853ea6c7db7599a0eb0d3eddd439c3244ce42
Instruction ID: 12777fa4a790eb226773ebc088d5d9a319cd90629fa7c96441e10c1a68b17a75
Opcode Fuzzy Hash: b7f9ddcf0c01e83a82a0f1c6c29853ea6c7db7599a0eb0d3eddd439c3244ce42
Instruction Fuzzy Hash: 04B0123268470C33DA212642EC07F073F1D87C2B60F654020FF0C1D1E1B9A3B96180C9

Uniqueness

Uniqueness Score: -1.00%

Function 00362FD6 Relevance: 1.5, APIs: 1, Instructions: 3
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlEncodePointer.NTDLL(00000000,00365661,0036AD50,00000314,00000000,?,?,?,?,?,00363AF2,0036AD50,Microsoft Visual C++ Runtime Library,00012010), ref: 00362FD8

Memory Dump Source

Source File: 00000000.00000002.379856807.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.379847164.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.379876018.0000000000367000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.379890531.000000000036A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.379900293.000000000036C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_fNlAH8RgLk.jbxd

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: 88cc0df7fb6b1bebf84cacbdb0e54117d7772d987a47f70ac946656c28052bc4
Instruction ID: c787162767f195ef39183f71b050292a38e6d0a9628d8c8c77277e0dad3e8cdb
Opcode Fuzzy Hash: 88cc0df7fb6b1bebf84cacbdb0e54117d7772d987a47f70ac946656c28052bc4
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0036239A Relevance: 7.6, APIs: 5, Instructions: 58
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 85%

			E0036239A(intOrPtr __eax, intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr __edi, intOrPtr __esi, char _a4) {
				intOrPtr _v0;
				void* _v804;
				intOrPtr _v808;
				intOrPtr _v812;
				intOrPtr _t6;
				intOrPtr _t12;
				intOrPtr _t13;
				long _t17;
				intOrPtr _t21;
				intOrPtr _t22;
				intOrPtr _t25;
				intOrPtr _t26;
				intOrPtr _t27;
				intOrPtr* _t31;
				void* _t34;

				_t27 = __esi;
				_t26 = __edi;
				_t25 = __edx;
				_t22 = __ecx;
				_t21 = __ebx;
				_t6 = __eax;
				_t34 = _t22 -  *0x36a020; // 0x1b0f82c9
				if(_t34 == 0) {
					asm("repe ret");
				}
				 *0x36b480 = _t6;
				 *0x36b47c = _t22;
				 *0x36b478 = _t25;
				 *0x36b474 = _t21;
				 *0x36b470 = _t27;
				 *0x36b46c = _t26;
				 *0x36b498 = ss;
				 *0x36b48c = cs;
				 *0x36b468 = ds;
				 *0x36b464 = es;
				 *0x36b460 = fs;
				 *0x36b45c = gs;
				asm("pushfd");
				_pop( *0x36b490);
				 *0x36b484 =  *_t31;
				 *0x36b488 = _v0;
				 *0x36b494 =  &_a4;
				 *0x36b3d0 = 0x10001;
				 *0x36b384 =  *0x36b488;
				 *0x36b378 = 0xc0000409;
				 *0x36b37c = 1;
				_t12 =  *0x36a020; // 0x1b0f82c9
				_v812 = _t12;
				_t13 =  *0x36a024; // 0xe4f07d36
				_v808 = _t13;
				 *0x36b3c8 = IsDebuggerPresent();
				_push(1);
				E003649E0(_t14);
				SetUnhandledExceptionFilter(0);
				_t17 = UnhandledExceptionFilter(0x367f60);
				if( *0x36b3c8 == 0) {
					_push(1);
					E003649E0(_t17);
				}
				return TerminateProcess(GetCurrentProcess(), 0xc0000409);
			}

0x0036239a
0x0036239a
0x0036239a
0x0036239a
0x0036239a
0x0036239a
0x0036239a
0x003623a0
0x003623a2
0x003623a2
0x00363c72
0x00363c77
0x00363c7d
0x00363c83
0x00363c89
0x00363c8f
0x00363c95
0x00363c9c
0x00363ca3
0x00363caa
0x00363cb1
0x00363cb8
0x00363cbf
0x00363cc0
0x00363cc9
0x00363cd1
0x00363cd9
0x00363ce4
0x00363cf3
0x00363cf8
0x00363d02
0x00363d0c
0x00363d11
0x00363d17
0x00363d1c
0x00363d28
0x00363d2d
0x00363d2f
0x00363d37
0x00363d42
0x00363d4f
0x00363d51
0x00363d53
0x00363d58
0x00363d6c

APIs

IsDebuggerPresent.KERNEL32 ref: 00363D22
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00363D37
UnhandledExceptionFilter.KERNEL32(00367F60), ref: 00363D42
GetCurrentProcess.KERNEL32(C0000409), ref: 00363D5E
TerminateProcess.KERNEL32(00000000), ref: 00363D65

Memory Dump Source

Source File: 00000000.00000002.379856807.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.379847164.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.379876018.0000000000367000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.379890531.000000000036A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.379900293.000000000036C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_fNlAH8RgLk.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 50551297cee26f04a47de103eb54d657601ef38f7e2650509666c6f1888d5d5b
Instruction ID: 2551d51230de8deccadcf639d7f9457893df378beb224d72dedf71c746dd7c83
Opcode Fuzzy Hash: 50551297cee26f04a47de103eb54d657601ef38f7e2650509666c6f1888d5d5b
Instruction Fuzzy Hash: 97216BB8915304DBD7039F6AE849654BBACBB08748F60D02AE509D7362EBF059C4CF15

Uniqueness

Uniqueness Score: -1.00%

Function 00363FC8 Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00363FC8() {

				SetUnhandledExceptionFilter(E00363F86);
				return 0;
			}

0x00363fcd
0x00363fd5

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00003F86), ref: 00363FCD

Memory Dump Source

Source File: 00000000.00000002.379856807.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.379847164.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.379876018.0000000000367000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.379890531.000000000036A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.379900293.000000000036C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_fNlAH8RgLk.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 75e8c6b2fcd998127233e0ff6bf26d78481009b4e64300f7b7df4df0b0493fa3
Instruction ID: 80b9030223fca9933d5ecc4890847d78753a4b2b8d631e9a4e20e71d828cc8d2
Opcode Fuzzy Hash: 75e8c6b2fcd998127233e0ff6bf26d78481009b4e64300f7b7df4df0b0493fa3
Instruction Fuzzy Hash: E89002606692408E861617B05C0D44A65B59B48726F81C554F201C8058DEB041109531

Uniqueness

Uniqueness Score: -1.00%

Function 003632D0 Relevance: 42.1, APIs: 19, Strings: 5, Instructions: 109
libraryloadermemoryCOMMON

Download Yara Rule

C-Code - Quality: 62%

			E003632D0(void* __ebx) {
				void* __edi;
				void* __esi;
				_Unknown_base(*)()* _t7;
				long _t10;
				void* _t11;
				int _t12;
				void* _t14;
				void* _t15;
				void* _t16;
				void* _t18;
				intOrPtr _t21;
				long _t26;
				void* _t30;
				struct HINSTANCE__* _t35;
				intOrPtr* _t36;
				void* _t39;
				intOrPtr* _t41;
				void* _t42;

				_t30 = __ebx;
				_t35 = GetModuleHandleW(L"KERNEL32.DLL");
				if(_t35 != 0) {
					 *0x36ad40 = GetProcAddress(_t35, "FlsAlloc");
					 *0x36ad44 = GetProcAddress(_t35, "FlsGetValue");
					 *0x36ad48 = GetProcAddress(_t35, "FlsSetValue");
					_t7 = GetProcAddress(_t35, "FlsFree");
					__eflags =  *0x36ad40;
					_t39 = TlsSetValue;
					 *0x36ad4c = _t7;
					if( *0x36ad40 == 0) {
						L6:
						 *0x36ad44 = TlsGetValue;
						 *0x36ad40 = 0x362fdf;
						 *0x36ad48 = _t39;
						 *0x36ad4c = TlsFree;
					} else {
						__eflags =  *0x36ad44;
						if( *0x36ad44 == 0) {
							goto L6;
						} else {
							__eflags =  *0x36ad48;
							if( *0x36ad48 == 0) {
								goto L6;
							} else {
								__eflags = _t7;
								if(_t7 == 0) {
									goto L6;
								}
							}
						}
					}
					_t10 = TlsAlloc();
					 *0x36a174 = _t10;
					__eflags = _t10 - 0xffffffff;
					if(_t10 == 0xffffffff) {
						L15:
						_t11 = 0;
						__eflags = 0;
					} else {
						_t12 = TlsSetValue(_t10,  *0x36ad44);
						__eflags = _t12;
						if(_t12 == 0) {
							goto L15;
						} else {
							E00362083();
							_t41 = __imp__EncodePointer;
							_t14 =  *_t41( *0x36ad40);
							 *0x36ad40 = _t14;
							_t15 =  *_t41( *0x36ad44);
							 *0x36ad44 = _t15;
							_t16 =  *_t41( *0x36ad48);
							 *0x36ad48 = _t16;
							 *0x36ad4c =  *_t41( *0x36ad4c);
							_t18 = E003629EB();
							__eflags = _t18;
							if(_t18 == 0) {
								L14:
								E0036301D();
								goto L15;
							} else {
								_t36 = __imp__DecodePointer;
								_t21 =  *((intOrPtr*)( *_t36()))( *0x36ad40, E003631A1);
								 *0x36a170 = _t21;
								__eflags = _t21 - 0xffffffff;
								if(_t21 == 0xffffffff) {
									goto L14;
								} else {
									_t42 = E0036486C(1, 0x214);
									__eflags = _t42;
									if(_t42 == 0) {
										goto L14;
									} else {
										__eflags =  *((intOrPtr*)( *_t36()))( *0x36ad48,  *0x36a170, _t42);
										if(__eflags == 0) {
											goto L14;
										} else {
											_push(0);
											_push(_t42);
											E0036305A(_t30, _t36, _t42, __eflags);
											_t26 = GetCurrentThreadId();
											 *(_t42 + 4) =  *(_t42 + 4) | 0xffffffff;
											 *_t42 = _t26;
											_t11 = 1;
										}
									}
								}
							}
						}
					}
					return _t11;
				} else {
					E0036301D();
					return 0;
				}
			}

0x003632d0
0x003632de
0x003632e2
0x00363302
0x0036330f
0x0036331c
0x00363321
0x00363323
0x0036332a
0x00363330
0x00363335
0x0036334d
0x00363352
0x0036335c
0x00363366
0x0036336c
0x00363337
0x00363337
0x0036333e
0x00000000
0x00363340
0x00363340
0x00363347
0x00000000
0x00363349
0x00363349
0x0036334b
0x00000000
0x00000000
0x0036334b
0x00363347
0x0036333e
0x00363371
0x00363377
0x0036337c
0x0036337f
0x00363446
0x00363446
0x00363446
0x00363385
0x0036338c
0x0036338e
0x00363390
0x00000000
0x00363396
0x00363396
0x003633a1
0x003633a7
0x003633af
0x003633b4
0x003633bc
0x003633c1
0x003633c9
0x003633d0
0x003633d5
0x003633da
0x003633dc
0x00363441
0x00363441
0x00000000
0x003633de
0x003633de
0x003633f1
0x003633f3
0x003633f8
0x003633fb
0x00000000
0x003633fd
0x00363409
0x0036340d
0x0036340f
0x00000000
0x00363411
0x00363422
0x00363424
0x00000000
0x00363426
0x00363426
0x00363428
0x00363429
0x00363430
0x00363436
0x0036343a
0x0036343e
0x0036343e
0x00363424
0x0036340f
0x003633fb
0x003633dc
0x00363390
0x0036344a
0x003632e4
0x003632e4
0x003632ec
0x003632ec

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,003628FE), ref: 003632D8
__mtterm.LIBCMT ref: 003632E4

Part of subcall function 0036301D: DecodePointer.KERNEL32(00000005,00363446,?,003628FE), ref: 0036302E
Part of subcall function 0036301D: TlsFree.KERNEL32(00000019,00363446,?,003628FE), ref: 00363048

GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 003632FA
GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 00363307
GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 00363314
GetProcAddress.KERNEL32(00000000,FlsFree), ref: 00363321
TlsAlloc.KERNEL32(?,003628FE), ref: 00363371
TlsSetValue.KERNEL32(00000000,?,003628FE), ref: 0036338C
__init_pointers.LIBCMT ref: 00363396
EncodePointer.KERNEL32(?,003628FE), ref: 003633A7
EncodePointer.KERNEL32(?,003628FE), ref: 003633B4
EncodePointer.KERNEL32(?,003628FE), ref: 003633C1
EncodePointer.KERNEL32(?,003628FE), ref: 003633CE
DecodePointer.KERNEL32(003631A1,?,003628FE), ref: 003633EF
__calloc_crt.LIBCMT ref: 00363404
DecodePointer.KERNEL32(00000000,?,003628FE), ref: 0036341E
__initptd.LIBCMT ref: 00363429
GetCurrentThreadId.KERNEL32 ref: 00363430

Strings

KERNEL32.DLL, xrefs: 003632D3
FlsGetValue, xrefs: 003632FC
FlsFree, xrefs: 00363316
FlsSetValue, xrefs: 00363309
FlsAlloc, xrefs: 003632F4

Memory Dump Source

Source File: 00000000.00000002.379856807.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.379847164.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.379876018.0000000000367000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.379890531.000000000036A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.379900293.000000000036C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_fNlAH8RgLk.jbxd

Similarity

API ID: Pointer$AddressEncodeProc$Decode$AllocCurrentFreeHandleModuleThreadValue__calloc_crt__init_pointers__initptd__mtterm
String ID: FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$KERNEL32.DLL
API String ID: 3732613303-3819984048
Opcode ID: 71bf00814b671ad3434f8d71d5711db34e84bf56e53161e1974f6ae1adc55077
Instruction ID: c758554dd671723135e82ebc0961d9d88e6f23b82b2234326eb3194e5b510037
Opcode Fuzzy Hash: 71bf00814b671ad3434f8d71d5711db34e84bf56e53161e1974f6ae1adc55077
Instruction Fuzzy Hash: A831D230804B109BCB236F75EC18619BEACEB41766F11C126E404ABAB4DBF48440CF72

Uniqueness

Uniqueness Score: -1.00%

Function 00364F44 Relevance: 9.0, APIs: 6, Instructions: 47
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 92%

			E00364F44(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _t15;
				LONG* _t21;
				void* _t31;
				LONG* _t33;
				void* _t34;
				void* _t35;

				_t35 = __eflags;
				_t29 = __edx;
				_t25 = __ebx;
				_push(0xc);
				_push(0x369600);
				E003637A0(__ebx, __edi, __esi);
				_t31 = E00363187(__ebx, __edx, __edi, _t35);
				_t15 =  *0x36aac0; // 0xfffffffe
				if(( *(_t31 + 0x70) & _t15) == 0 ||  *((intOrPtr*)(_t31 + 0x6c)) == 0) {
					E00362B65(_t25, 0xd);
					 *(_t34 - 4) =  *(_t34 - 4) & 0x00000000;
					_t33 =  *(_t31 + 0x68);
					 *(_t34 - 0x1c) = _t33;
					__eflags = _t33 -  *0x36a9c8; // 0x24c1608
					if(__eflags != 0) {
						__eflags = _t33;
						if(__eflags != 0) {
							__eflags = InterlockedDecrement(_t33);
							if(__eflags == 0) {
								__eflags = _t33 - 0x36a5a0;
								if(__eflags != 0) {
									E00362772(_t33);
								}
							}
						}
						_t21 =  *0x36a9c8; // 0x24c1608
						 *(_t31 + 0x68) = _t21;
						_t33 =  *0x36a9c8; // 0x24c1608
						 *(_t34 - 0x1c) = _t33;
						InterlockedIncrement(_t33);
					}
					 *(_t34 - 4) = 0xfffffffe;
					E00364FDF();
				} else {
					_t33 =  *(_t31 + 0x68);
				}
				_t38 = _t33;
				if(_t33 == 0) {
					E003622FB(_t29, _t31, _t38, 0x20);
				}
				return E003637E5(_t33);
			}

0x00364f44
0x00364f44
0x00364f44
0x00364f44
0x00364f46
0x00364f4b
0x00364f55
0x00364f57
0x00364f5f
0x00364f80
0x00364f86
0x00364f8a
0x00364f8d
0x00364f90
0x00364f96
0x00364f98
0x00364f9a
0x00364fa3
0x00364fa5
0x00364fa7
0x00364fad
0x00364fb0
0x00364fb5
0x00364fad
0x00364fa5
0x00364fb6
0x00364fbb
0x00364fbe
0x00364fc4
0x00364fc8
0x00364fc8
0x00364fce
0x00364fd5
0x00364f67
0x00364f67
0x00364f67
0x00364f6a
0x00364f6c
0x00364f70
0x00364f75
0x00364f7d

APIs

__getptd.LIBCMT ref: 00364F50

Part of subcall function 00363187: __getptd_noexit.LIBCMT ref: 0036318A
Part of subcall function 00363187: __amsg_exit.LIBCMT ref: 00363197

__amsg_exit.LIBCMT ref: 00364F70
__lock.LIBCMT ref: 00364F80
InterlockedDecrement.KERNEL32(?), ref: 00364F9D
_free.LIBCMT ref: 00364FB0
InterlockedIncrement.KERNEL32(024C1608), ref: 00364FC8

Memory Dump Source

Source File: 00000000.00000002.379856807.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.379847164.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.379876018.0000000000367000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.379890531.000000000036A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.379900293.000000000036C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_fNlAH8RgLk.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock_free
String ID:
API String ID: 3470314060-0
Opcode ID: 4a62cd28591a9a38c73812142923fdcfc52b4d03b6cd011c394e7f66efda2911
Instruction ID: ede41d6f269688bafb3ebedda7eb22f650578c8c877fe3ffa36ada614d5f83bc
Opcode Fuzzy Hash: 4a62cd28591a9a38c73812142923fdcfc52b4d03b6cd011c394e7f66efda2911
Instruction Fuzzy Hash: 1C018431D01A2197D723EF64944575A77B4AB06720F16C006F8006F599CB746941CFD2

Uniqueness

Uniqueness Score: -1.00%

Function 00361821 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 30
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E00361821(intOrPtr _a4, intOrPtr _a8) {
				_Unknown_base(*)()* _t7;
				void* _t10;
				struct HINSTANCE__* _t11;

				_t10 = 0;
				_t11 = LoadLibraryA("Advapi32.dll");
				if(_t11 != 0 && _a8 != 0 && _a4 != 0) {
					_t7 = GetProcAddress(_t11, "ConvertSidToStringSidA");
					if(_t7 != 0) {
						_t10 =  *_t7(_a4, _a8);
					}
					FreeLibrary(_t11);
				}
				return _t10;
			}

0x0036182b
0x00361833
0x00361837
0x00361849
0x00361851
0x0036185b
0x0036185b
0x0036185e
0x0036185e
0x00361869

APIs

LoadLibraryA.KERNEL32(Advapi32.dll,7491C740,74CF81D0,?,00361D94,?,00000000), ref: 0036182D
GetProcAddress.KERNEL32(00000000,ConvertSidToStringSidA), ref: 00361849
FreeLibrary.KERNEL32(00000000,?,00361D94,?,00000000), ref: 0036185E

Strings

Advapi32.dll, xrefs: 00361826
ConvertSidToStringSidA, xrefs: 00361843

Memory Dump Source

Source File: 00000000.00000002.379856807.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.379847164.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.379876018.0000000000367000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.379890531.000000000036A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.379900293.000000000036C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_fNlAH8RgLk.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: Advapi32.dll$ConvertSidToStringSidA
API String ID: 145871493-1798845326
Opcode ID: 07869633a667fdfbce92dbad000ad79a98846f2857d55f861d0d32138fb993ea
Instruction ID: fe35094ce839226f348deeed2f2d364f77a68bb3656f9f088a1d0dd16c614cda
Opcode Fuzzy Hash: 07869633a667fdfbce92dbad000ad79a98846f2857d55f861d0d32138fb993ea
Instruction Fuzzy Hash: D3E09B36205618BB87232B1A9C04CEE7B69EAC17B5759C221FD18C3118D6714D51D6F1

Uniqueness

Uniqueness Score: -1.00%

Function 00361747 Relevance: 7.6, APIs: 5, Instructions: 70
stringCOMMON

Download Yara Rule

C-Code - Quality: 92%

			E00361747(CHAR* _a4) {
				signed int _v8;
				char _v268;
				int _v272;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t19;
				char* _t28;
				struct _SECURITY_ATTRIBUTES* _t30;
				int _t34;
				char _t37;
				void* _t38;
				intOrPtr _t40;
				CHAR* _t41;
				signed int _t42;

				_t19 =  *0x36a020; // 0x1b0f82c9
				_v8 = _t19 ^ _t42;
				_t41 = _a4;
				_v272 = 1;
				if(_t41[lstrlenA(_t41) - 1] != 0x5c) {
					lstrcatA(_t41, "\\");
				}
				_t34 = lstrlenA(_t41);
				_t40 = 0;
				E00362320( &_v268, 0, 0x104);
				if(_t34 <= 2 || _t41[1] != 0x3a) {
					_v272 = _t40;
				} else {
					if(_t34 <= 0) {
						L14:
						return E0036239A(_v272, _t34, _v8 ^ _t42, _t38, _t40, _t41);
					}
					_t41 = _t41 -  &_v268;
					while(_v272 != 0) {
						_t28 = _t42 + _t40 - 0x108;
						_t37 = _t41[_t28];
						 *_t28 = _t37;
						if(_t37 == 0x5c && _t40 != 2) {
							_t30 = SetCurrentDirectoryA( &_v268);
							if(_t30 == 0) {
								_v272 = CreateDirectoryA( &_v268, _t30);
							}
						}
						_t40 = _t40 + 1;
						if(_t40 < _t34) {
							continue;
						} else {
							goto L14;
						}
					}
				}
			}

0x00361750
0x00361757
0x0036175c
0x00361767
0x00361778
0x00361780
0x00361780
0x0036178e
0x00361790
0x0036179a
0x003617a5
0x00361804
0x003617ad
0x003617af
0x0036180a
0x0036181e
0x0036181e
0x003617b7
0x003617b9
0x003617c2
0x003617c9
0x003617cc
0x003617d1
0x003617df
0x003617e7
0x003617f7
0x003617f7
0x003617e7
0x003617fd
0x00361800
0x00000000
0x00361802
0x00000000
0x00361802
0x00361800
0x003617b9

APIs

lstrlenA.KERNEL32(00361909,74CF8170,?,74CB6980), ref: 00361771
lstrcatA.KERNEL32(00361909,00367380), ref: 00361780
lstrlenA.KERNEL32(00361909), ref: 00361787
SetCurrentDirectoryA.KERNEL32(?), ref: 003617DF
CreateDirectoryA.KERNEL32(?,00000000), ref: 003617F1

Memory Dump Source

Source File: 00000000.00000002.379856807.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.379847164.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.379876018.0000000000367000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.379890531.000000000036A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.379900293.000000000036C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_fNlAH8RgLk.jbxd

Similarity

API ID: Directorylstrlen$CreateCurrentlstrcat
String ID:
API String ID: 279805598-0
Opcode ID: 629e7d7b96742f411394744d9855c4d6f2253adff0a9e62d38ffa506509e5724
Instruction ID: 411cb9fb2ae721acb09a66278de4bbac598f8faa00b15fd1207988fb658a958a
Opcode Fuzzy Hash: 629e7d7b96742f411394744d9855c4d6f2253adff0a9e62d38ffa506509e5724
Instruction Fuzzy Hash: E121CF76E043189ADB22DB65CC48BEBB7ECAB66305F09C1A9D58593104CAB49EC4CF91

Uniqueness

Uniqueness Score: -1.00%

Function 00365AF2 Relevance: 7.6, APIs: 5, Instructions: 68
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 94%

			E00365AF2(void* __edx, void* __edi, void* __esi, void* _a4, long _a8) {
				void* _t7;
				long _t8;
				intOrPtr* _t9;
				intOrPtr* _t12;
				long _t27;
				long _t30;

				if(_a4 != 0) {
					_push(__esi);
					_t30 = _a8;
					__eflags = _t30;
					if(_t30 != 0) {
						_push(__edi);
						while(1) {
							__eflags = _t30 - 0xffffffe0;
							if(_t30 > 0xffffffe0) {
								break;
							}
							__eflags = _t30;
							if(_t30 == 0) {
								_t30 = _t30 + 1;
								__eflags = _t30;
							}
							_t7 = HeapReAlloc( *0x36b6a4, 0, _a4, _t30);
							_t27 = _t7;
							__eflags = _t27;
							if(_t27 != 0) {
								L17:
								_t8 = _t27;
							} else {
								__eflags =  *0x36b6a8 - _t7;
								if(__eflags == 0) {
									_t9 = E0036348D(__eflags);
									 *_t9 = E0036344B(GetLastError());
									goto L17;
								} else {
									__eflags = E00362FAE(_t7, _t30);
									if(__eflags == 0) {
										_t12 = E0036348D(__eflags);
										 *_t12 = E0036344B(GetLastError());
										L12:
										_t8 = 0;
										__eflags = 0;
									} else {
										continue;
									}
								}
							}
							goto L14;
						}
						E00362FAE(_t6, _t30);
						 *((intOrPtr*)(E0036348D(__eflags))) = 0xc;
						goto L12;
					} else {
						E00362772(_a4);
						_t8 = 0;
					}
					L14:
					return _t8;
				} else {
					return E003627AC(__edx, __edi, __esi, _a8);
				}
			}

0x00365afb
0x00365b08
0x00365b09
0x00365b0c
0x00365b0e
0x00365b1d
0x00365b50
0x00365b50
0x00365b53
0x00000000
0x00000000
0x00365b20
0x00365b22
0x00365b24
0x00365b24
0x00365b24
0x00365b31
0x00365b37
0x00365b39
0x00365b3b
0x00365b9b
0x00365b9b
0x00365b3d
0x00365b3d
0x00365b43
0x00365b85
0x00365b99
0x00000000
0x00365b45
0x00365b4c
0x00365b4e
0x00365b6d
0x00365b81
0x00365b67
0x00365b67
0x00365b67
0x00000000
0x00000000
0x00000000
0x00365b4e
0x00365b43
0x00000000
0x00365b69
0x00365b56
0x00365b61
0x00000000
0x00365b10
0x00365b13
0x00365b19
0x00365b19
0x00365b6a
0x00365b6c
0x00365afd
0x00365b07
0x00365b07

APIs

_malloc.LIBCMT ref: 00365B00

Part of subcall function 003627AC: __FF_MSGBANNER.LIBCMT ref: 003627C5
Part of subcall function 003627AC: __NMSG_WRITE.LIBCMT ref: 003627CC
Part of subcall function 003627AC: RtlAllocateHeap.NTDLL(00000000,00000001,00000000,?,00000000,?,0036128A,0001F400), ref: 003627F1

_free.LIBCMT ref: 00365B13

Memory Dump Source

Source File: 00000000.00000002.379856807.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.379847164.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.379876018.0000000000367000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.379890531.000000000036A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.379900293.000000000036C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_fNlAH8RgLk.jbxd

Similarity

API ID: AllocateHeap_free_malloc
String ID:
API String ID: 1020059152-0
Opcode ID: 31b26d7fcb5cc2cc3a0c726d56add870dad4fd5187f28f6c25ff39a12f756fdc
Instruction ID: ea175e697854c5da804b4cf4863e42a6d515bcffd742ade73f2802af133fe440
Opcode Fuzzy Hash: 31b26d7fcb5cc2cc3a0c726d56add870dad4fd5187f28f6c25ff39a12f756fdc
Instruction Fuzzy Hash: 3B11A332509A15ABCF232F74AC05A6A3B98EF51760F26C039F8459F199EF74C95086A4

Uniqueness

Uniqueness Score: -1.00%

Function 00364CA8 Relevance: 7.5, APIs: 5, Instructions: 34
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 90%

			E00364CA8(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _t12;
				void* _t28;
				intOrPtr _t29;
				void* _t30;
				void* _t31;

				_t31 = __eflags;
				_t26 = __edi;
				_t25 = __edx;
				_t20 = __ebx;
				_push(0xc);
				_push(0x3695e0);
				E003637A0(__ebx, __edi, __esi);
				_t28 = E00363187(__ebx, __edx, __edi, _t31);
				_t12 =  *0x36aac0; // 0xfffffffe
				if(( *(_t28 + 0x70) & _t12) == 0) {
					L6:
					E00362B65(_t20, 0xc);
					 *(_t30 - 4) =  *(_t30 - 4) & 0x00000000;
					_t29 = _t28 + 0x6c;
					 *((intOrPtr*)(_t30 - 0x1c)) = E00364C5B(_t29,  *0x36a598);
					 *(_t30 - 4) = 0xfffffffe;
					E00364D15();
				} else {
					_t33 =  *((intOrPtr*)(_t28 + 0x6c));
					if( *((intOrPtr*)(_t28 + 0x6c)) == 0) {
						goto L6;
					} else {
						_t29 =  *((intOrPtr*)(E00363187(_t20, __edx, _t26, _t33) + 0x6c));
					}
				}
				_t34 = _t29;
				if(_t29 == 0) {
					E003622FB(_t25, _t26, _t34, 0x20);
				}
				return E003637E5(_t29);
			}

0x00364ca8
0x00364ca8
0x00364ca8
0x00364ca8
0x00364ca8
0x00364caa
0x00364caf
0x00364cb9
0x00364cbb
0x00364cc3
0x00364ce7
0x00364ce9
0x00364cef
0x00364cf9
0x00364d04
0x00364d07
0x00364d0e
0x00364cc5
0x00364cc5
0x00364cc9
0x00000000
0x00364ccb
0x00364cd0
0x00364cd0
0x00364cc9
0x00364cd3
0x00364cd5
0x00364cd9
0x00364cde
0x00364ce6

APIs

__getptd.LIBCMT ref: 00364CB4

Part of subcall function 00363187: __getptd_noexit.LIBCMT ref: 0036318A
Part of subcall function 00363187: __amsg_exit.LIBCMT ref: 00363197

__getptd.LIBCMT ref: 00364CCB
__amsg_exit.LIBCMT ref: 00364CD9
__lock.LIBCMT ref: 00364CE9
__updatetlocinfoEx_nolock.LIBCMT ref: 00364CFD

Memory Dump Source

Source File: 00000000.00000002.379856807.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.379847164.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.379876018.0000000000367000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.379890531.000000000036A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.379900293.000000000036C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_fNlAH8RgLk.jbxd

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: 6c9041b3f645ca81784965cd614f1b994451ceb27f1e8301ac7baa6099f2a439
Instruction ID: 08ff3826635198e1550c741c7f3e6b5bf7559eb9fea9b679ad6525382b0efbfd
Opcode Fuzzy Hash: 6c9041b3f645ca81784965cd614f1b994451ceb27f1e8301ac7baa6099f2a439
Instruction Fuzzy Hash: A6F0B472D06B00AAD723BB789803B4D37A0AF00724F11C10AF405AF6DFCB785911DA5A

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: irsetup.exePID: 5732, Parent PID: 6008COMMON

Execution Graph

Execution Coverage:	11.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	3.8%
Total number of Nodes:	2000
Total number of Limit Nodes:	108

Executed Functions

Function 0044416C Relevance: 40.4, APIs: 13, Strings: 10, Instructions: 100
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(PSAPI.DLL), ref: 00444192
GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 004441B1
GetProcAddress.KERNEL32(EnumProcessModules), ref: 004441C3
GetProcAddress.KERNEL32(GetModuleFileNameExA), ref: 004441D5
FreeLibrary.KERNEL32 ref: 004441FA

Strings

Module32First, xrefs: 00444260
EnumProcesses, xrefs: 004441AB
GetModuleFileNameExA, xrefs: 004441C5
EnumProcessModules, xrefs: 004441B3
KERNEL32.DLL, xrefs: 0044420B, 00444210, 00444224
Module32Next, xrefs: 0044426D
CreateToolhelp32Snapshot, xrefs: 0044423E
PSAPI.DLL, xrefs: 0044418D
Process32Next, xrefs: 00444253
Process32First, xrefs: 00444246

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: AddressProc$Library$FreeLoad
String ID: CreateToolhelp32Snapshot$EnumProcessModules$EnumProcesses$GetModuleFileNameExA$KERNEL32.DLL$Module32First$Module32Next$PSAPI.DLL$Process32First$Process32Next
API String ID: 2449869053-2136592061
Opcode ID: de6bc20ce13dd26b1a37fd1544623143aa8ab3c7a79226b8d9d0c61516e5153c
Instruction ID: 16f59a1005e3f932de00098af5eb0272050f104e5185e9194a7d997368246a6a
Opcode Fuzzy Hash: de6bc20ce13dd26b1a37fd1544623143aa8ab3c7a79226b8d9d0c61516e5153c
Instruction Fuzzy Hash: D7316E7A910260ABFB10AFB1AC8951A3EEAF7877A1305847BE50593220D7FD4840DF5D

Uniqueness

Uniqueness Score: -1.00%

Function 00458FC6 Relevance: 25.7, APIs: 17, Instructions: 156
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExA.KERNEL32(?,00000000), ref: 00458FF3
GetCurrentThread.KERNEL32 ref: 0045904E
OpenThreadToken.ADVAPI32(00000000), ref: 00459055
GetLastError.KERNEL32 ref: 00459065
GetCurrentProcess.KERNEL32(00000008,?), ref: 00459077
OpenProcessToken.ADVAPI32(00000000), ref: 0045907E

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: CurrentOpenProcessThreadToken$ErrorLastVersion
String ID:
API String ID: 1157636217-0
Opcode ID: 2c0d7614f97d7bbbf8b7e768c7ca6c654a8f7c70b9d3473640f55911c4aad1f1
Instruction ID: 28f345c65202ad85ea081bbbffd35357cc0aecedf770b5ae172ec68553497311
Opcode Fuzzy Hash: 2c0d7614f97d7bbbf8b7e768c7ca6c654a8f7c70b9d3473640f55911c4aad1f1
Instruction Fuzzy Hash: 4D518271A10329EFEF209F60CC48BAF77BAEF45701F144097E949A6142DB745E888F56

Uniqueness

Uniqueness Score: -1.00%

Function 004359A7 Relevance: 23.2, APIs: 5, Strings: 8, Instructions: 426windowCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 004359B1
GetLogicalDriveStringsA.KERNEL32(00000400,?), ref: 00435A30
MessageBoxA.USER32(?,00000000), ref: 00435BEA
GetDriveTypeA.KERNEL32(00000000), ref: 00435C42
MessageBoxA.USER32(?,?,00000000,?), ref: 00435EE4

Part of subcall function 0043A00F: __EH_prolog3.LIBCMT ref: 0043A016

Strings

MSG_REQUIRED_DRIVE, xrefs: 00435DF0
:, xrefs: 00435BB1
Free space check on drive: , xrefs: 00435F20, 00435F83, 00435FF9
ERR_DRIVE_NOTENOUGHSPACE, xrefs: 00435C64, 00435D12, 00435E21
ERR_DRIVE_NOTEXIST, xrefs: 00435AFB, 00435B00, 00435B91
MSG_AVAILABLE_DRIVE, xrefs: 00435DA5
%s:%s%s %s%s %s, xrefs: 00435E51
MSG_ERROR, xrefs: 00435B60, 00435EB4

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: DriveMessage$H_prolog3H_prolog3_LogicalStringsType
String ID: %s:%s%s %s%s %s$:$ERR_DRIVE_NOTENOUGHSPACE$ERR_DRIVE_NOTEXIST$Free space check on drive: $MSG_AVAILABLE_DRIVE$MSG_ERROR$MSG_REQUIRED_DRIVE
API String ID: 1866183364-2056702564
Opcode ID: 148437870819e588428fd45cafacc5f6775580e0fc557f3f52eff7a95da50807
Instruction ID: 917801a5341abf3f24af672a2e2339547ac124f9b2bc70237aa367d561b7d71f
Opcode Fuzzy Hash: 148437870819e588428fd45cafacc5f6775580e0fc557f3f52eff7a95da50807
Instruction Fuzzy Hash: 960280B19001189BCB24EBA4CD51BED7779AF55318F4041EEF209A72D2DB385A84CF6D

Uniqueness

Uniqueness Score: -1.00%

Function 004C2293 Relevance: 15.1, APIs: 10, Instructions: 131filestringCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 004C229D
GetFullPathNameA.KERNEL32(00000000,00000104,?,?,00000158,004C2516,?,00000000,?,?,00008DD8,00000000), ref: 004C22DB
__cftof.LIBCMT ref: 004C22EF

Part of subcall function 004B4C5C: __CxxThrowException@8.LIBCMT ref: 004B4C72
Part of subcall function 004B4C5C: __EH_prolog3.LIBCMT ref: 004B4C7F

PathIsUNCA.SHLWAPI(?,?,?,00000000,?,00008DD8,00000000), ref: 004C2357
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,?,?,00000000,00000000,?,00008DD8,00000000), ref: 004C237E
CharUpperA.USER32(?), ref: 004C23B1
FindFirstFileA.KERNEL32(?,?), ref: 004C23CD
FindClose.KERNEL32(00000000), ref: 004C23D9
lstrlen.KERNEL32(00000000), ref: 004C23F7
_strcpy_s.LIBCMT ref: 004C241B

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: FindPath$CharCloseException@8FileFirstFullH_prolog3H_prolog3_InformationNameThrowUpperVolume__cftof_strcpy_slstrlen
String ID:
API String ID: 1696414672-0
Opcode ID: 7934e5c1a1a8fe40e26f0004d8797a068d9f9dfade76b9f029e4047937372db0
Instruction ID: d28ed3da59c2e841b17ce778635d605d1f5dafbb7deae3fa1d248f3b5fe50481
Opcode Fuzzy Hash: 7934e5c1a1a8fe40e26f0004d8797a068d9f9dfade76b9f029e4047937372db0
Instruction Fuzzy Hash: A041C375800659DBDF65AFA0CD48FFF7738AF50315F00019EB809A52A1DBB89E84CE68

Uniqueness

Uniqueness Score: -1.00%

Function 0044A753 Relevance: 12.1, APIs: 8, Instructions: 85filestringCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0044A75D
GetFullPathNameA.KERNEL32(?,00000104,?,?,00000158,0044A8C1,?,?,0000014C,0042ACB8,?,?,006985B8,00000000,00000000,00000000), ref: 0044A77D
lstrcpyn.KERNEL32(?,?,00000104,?,000000A8,?,00000020,0042D4B5,00000000,?,00000000,00000000,?,?,00000004,00000000), ref: 0044A78A
_strlen.LIBCMT ref: 0044A7CF
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,?,?,00000000,00000000,00698DAC,00000000,00000000,?,000000A8,?,00000020,0042D4B5), ref: 0044A7FC
CharUpperA.USER32(?), ref: 0044A81C
FindFirstFileA.KERNEL32(?,?), ref: 0044A838
FindClose.KERNEL32(00000000), ref: 0044A844

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: Find$CharCloseFileFirstFullH_prolog3_InformationNamePathUpperVolume_strlenlstrcpyn
String ID:
API String ID: 1402569657-0
Opcode ID: 4792e090452097429a4122506f4b797b77648ced3a3e471d60e5698ff8b801c6
Instruction ID: 8dbaea6bf57266fc7c01749efa83c41ddafa5eedf3300377e1474c0166a389cb
Opcode Fuzzy Hash: 4792e090452097429a4122506f4b797b77648ced3a3e471d60e5698ff8b801c6
Instruction Fuzzy Hash: 7A219571804558ABEB21AF61CC89EEF7B7CEFC5315F0004AAF409A6151DA385E85CF64

Uniqueness

Uniqueness Score: -1.00%

Function 0044A8A2 Relevance: 7.6, APIs: 5, Instructions: 117fileCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0044A8AC

Part of subcall function 0044A753: __EH_prolog3_GS.LIBCMT ref: 0044A75D
Part of subcall function 0044A753: GetFullPathNameA.KERNEL32(?,00000104,?,?,00000158,0044A8C1,?,?,0000014C,0042ACB8,?,?,006985B8,00000000,00000000,00000000), ref: 0044A77D
Part of subcall function 0044A753: lstrcpyn.KERNEL32(?,?,00000104,?,000000A8,?,00000020,0042D4B5,00000000,?,00000000,00000000,?,?,00000004,00000000), ref: 0044A78A

GetFileAttributesA.KERNEL32(?,0000014C,0042ACB8,?,?,006985B8,00000000,00000000,00000000,000003CC,?,000000A8,?,00000020,0042D4B5,00000000), ref: 0044A8D3
_strlen.LIBCMT ref: 0044A94A
FindFirstFileA.KERNEL32(?,?,?,00000000,?,00000104,?,?,000000A8,?,00000020,0042D4B5,00000000,?,00000000,00000000), ref: 0044A96A
FindClose.KERNEL32(00000000,?,000000A8,?,00000020,0042D4B5,00000000,?,00000000,00000000,?,?,00000004,00000000,00000000,00000000), ref: 0044A999

Part of subcall function 00449EEE: __time64.LIBCMT ref: 00449F08
Part of subcall function 00449EEE: FileTimeToLocalFileTime.KERNEL32(00000001,?,?), ref: 00449F18
Part of subcall function 00449EEE: FileTimeToSystemTime.KERNEL32(?,?), ref: 00449F2E

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: File$Time$FindH_prolog3_$AttributesCloseFirstFullLocalNamePathSystem__time64_strlenlstrcpyn
String ID:
API String ID: 1443709101-0
Opcode ID: bb1f59f4a2ce2df39f976b3940a659704abf967065a412d95eeb99e17433bd1c
Instruction ID: 547087156e1b8dbc7c1312de2c0fcb0f0398db75342f1282b9abed4c34935f12
Opcode Fuzzy Hash: bb1f59f4a2ce2df39f976b3940a659704abf967065a412d95eeb99e17433bd1c
Instruction Fuzzy Hash: 3741AF71800605DFDB20EF64CC85ADAB7B8EF45318F1045AEE059EB291DB38AE85CF55

Uniqueness

Uniqueness Score: -1.00%

Function 004BF1C9 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 94COMMON

Download Yara Rule

APIs

__snwprintf_s.LIBCMT ref: 004BF214
__snwprintf_s.LIBCMT ref: 004BF246

Part of subcall function 005B7892: __getptd_noexit.LIBCMT ref: 005B7892

Strings

Afx:%p:%x:%p:%p:%p, xrefs: 004BF23C
Afx:%p:%x, xrefs: 004BF20A

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: __snwprintf_s$__getptd_noexit
String ID: Afx:%p:%x$Afx:%p:%x:%p:%p:%p
API String ID: 101746997-2801496823
Opcode ID: 8ab1980e1faa770b2e25fc3759f160d2460d8413688122b0cfedb032503283e0
Instruction ID: 26e43f7b2731a622e856ffe933de0c2eb32330e20df79e707b62788f216c88f8
Opcode Fuzzy Hash: 8ab1980e1faa770b2e25fc3759f160d2460d8413688122b0cfedb032503283e0
Instruction Fuzzy Hash: 92311975904209AFCB11EFA9CC459DE7BF4FF89310F0080A6F908AB212E775AE15DB65

Uniqueness

Uniqueness Score: -1.00%

Function 0044A06A Relevance: 4.5, APIs: 3, Instructions: 35fileCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0044A074
FindFirstFileA.KERNEL32(?,?,00000148,0041F1AF,?,?,?,?,00000104,?,00000000), ref: 0044A089

Part of subcall function 00449FCA: __EH_prolog3.LIBCMT ref: 00449FD1

FindClose.KERNEL32(00000000,?,?,00000001,?,?,?,?,?,?,00000104,?,00000000), ref: 0044A0C6

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: Find$CloseFileFirstH_prolog3H_prolog3_
String ID:
API String ID: 681597840-0
Opcode ID: 4a2f8fec65b44455310301669a2b02166963b59768817b5c6cfaf28988d38d44
Instruction ID: d5eeee8bf188be13c2627145fae7f78397d92feb1d62001dd3b4fb4c16845359
Opcode Fuzzy Hash: 4a2f8fec65b44455310301669a2b02166963b59768817b5c6cfaf28988d38d44
Instruction Fuzzy Hash: ECF0A431510408ABD719BF54CC45AFE7B29BF44329F04425AB825A62D1CF346E458B65

Uniqueness

Uniqueness Score: -1.00%

Function 004D5333 Relevance: 1.3, Strings: 1, Instructions: 35COMMON

Download Yara Rule

Strings

Button, xrefs: 004D533F

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: Activate
String ID: Button
API String ID: 1326475003-1034594571
Opcode ID: 238597f8646f9b22b27098f98683ef4a9de0b14335c0e3b73af4d6c6f98a71d2
Instruction ID: d57b847bfd3ac7269c7f149f3e769002f634bc7c7c63fce177c4daf3222b22e9
Opcode Fuzzy Hash: 238597f8646f9b22b27098f98683ef4a9de0b14335c0e3b73af4d6c6f98a71d2
Instruction Fuzzy Hash: 0BF09072D00208EBCF00DF96D845ADEBBF8EF48324F14406BE904F7200E674AA49CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00473280 Relevance: 205.7, APIs: 90, Strings: 27, Instructions: 935
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_GS.LIBCMT ref: 0047328A

Part of subcall function 00459443: lua_getfield.LUA5.1(?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459455
Part of subcall function 00459443: lua_pushstring.LUA5.1(?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459460
Part of subcall function 00459443: lua_gettable.LUA5.1(?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459468
Part of subcall function 00459443: lua_remove.LUA5.1(?,000000FE,?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459470
Part of subcall function 00459443: lua_type.LUA5.1(?,000000FF,?,000000FE,?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459478
Part of subcall function 00459443: lua_pcall.LUA5.1(?,00000000,00000000,00000000), ref: 0045948B
Part of subcall function 00459443: lua_remove.LUA5.1(?,000000FF), ref: 0045949A

Part of subcall function 004597A0: __EH_prolog3.LIBCMT ref: 004597A7
Part of subcall function 004597A0: lua_gettop.LUA5.1(?,00000000,00000000,00000008,004076D1,?,00000002,?), ref: 004597D3

Part of subcall function 00401BAB: __EH_prolog3.LIBCMT ref: 00401BB2

Part of subcall function 0045237E: __EH_prolog3_GS.LIBCMT ref: 00452388
Part of subcall function 0045237E: SHGetSpecialFolderLocation.SHELL32 ref: 004523C6
Part of subcall function 0045237E: SHGetPathFromIDList.SHELL32(?,?), ref: 004523DD
Part of subcall function 0045237E: SHGetMalloc.SHELL32(?), ref: 004523EE
Part of subcall function 0045237E: lstrlen.KERNEL32(?), ref: 00452421
Part of subcall function 0045237E: lstrlen.KERNEL32(?), ref: 0045242D

_strlen.LIBCMT ref: 00473401
_strlen.LIBCMT ref: 00473415
_strlen.LIBCMT ref: 0047342D

Part of subcall function 004593D3: lua_getfield.LUA5.1(?,FFFFD8EE,Application,?,?,00407717,?,00000000), ref: 004593E5
Part of subcall function 004593D3: lua_pushstring.LUA5.1(?,SetLastError,?,FFFFD8EE,Application,?,?,00407717,?,00000000), ref: 004593F0
Part of subcall function 004593D3: lua_gettable.LUA5.1(?,000000FE,?,SetLastError,?,FFFFD8EE,Application,?,?,00407717,?,00000000), ref: 004593F8
Part of subcall function 004593D3: lua_remove.LUA5.1(?,000000FE,?,000000FE,?,SetLastError,?,FFFFD8EE,Application,?,?,00407717,?,00000000), ref: 00459400
Part of subcall function 004593D3: lua_type.LUA5.1(?,000000FF,?,000000FE,?,000000FE,?,SetLastError,?,FFFFD8EE,Application,?,?,00407717,?,00000000), ref: 00459408
Part of subcall function 004593D3: lua_pushnumber.LUA5.1(?,?,?,?,?,?,?,?,?,?,?,00407717,?,00000000), ref: 0045941E
Part of subcall function 004593D3: lua_pcall.LUA5.1(?,00000001,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00407717), ref: 0045942A
Part of subcall function 004593D3: lua_remove.LUA5.1(?,000000FF,?,?,?,?,?,?,?,?,00407717,?,00000000), ref: 00459439

lua_pushstring.LUA5.1(?,?,?,?), ref: 00473F13

Strings

Common Startup, xrefs: 004735C8, 004735D4
My Video, xrefs: 0047355E, 0047356A, 00473BDD
Common Programs, xrefs: 0047360E, 0047361A
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders, xrefs: 004733AA, 00473414, 0047341C, 0047354A, 00473552, 004735B4, 004735BC, 004735FA, 00473602, 00473640, 00473648, 00473702, 0047370A, 00473775, 0047377D, 00473940, 00473948, 00473986, 0047398E, 004739CC, 004739D4, 00473A0F, 00473A17, 00473B9A, 00473BA2, 00473BC9, 00473BD1, 00473D25, 00473D2D
Software\Microsoft\Windows\CurrentVersion, xrefs: 004737BB, 004737C7, 004738CB, 004738D7, 00473DC0, 00473DC5, 00473DCD
Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders, xrefs: 004733B4, 00473452, 0047345A, 00473490, 00473498, 004734CE, 004734D6, 0047350C, 00473514, 0047367E, 00473686, 004736BC, 004736C4, 00473809, 00473811, 00473847, 0047384F, 00473885, 0047388D, 00473C2F, 00473C37, 00473C5E, 00473C66, 00473C90, 00473C98, 00473CC2, 00473CCA, 00473D57, 00473D5F, 00473D89, 00473D91
Personal, xrefs: 004734E2, 004734EE
Startup, xrefs: 004734A4, 004734B0, 00473C43
Common AppData, xrefs: 0047381D, 00473829
Desktop, xrefs: 004736D0, 004736DC, 00473BE2, 00473BEA, 00473CD6
My Music, xrefs: 00473428, 00473434, 00473BAE
Common Start Menu, xrefs: 00473654, 00473660
LocalMachine, xrefs: 00473598, 004735A4, 004735DE, 004735EA, 00473624, 00473630, 004736E6, 004736F2, 0047379F, 004737AB, 004737ED, 004737F9, 004738AF, 004738BB, 00473924, 00473930, 0047396A, 00473976, 004739B0, 004739BC, 004739F3, 004739FF, 00473DA7, 00473DAC, 00473DB4
Programs, xrefs: 00473520, 0047352C, 00473C72
Start Menu, xrefs: 00473466, 00473472, 00473CA4
CommonFilesDir, xrefs: 004738E7, 004738F3
Fonts, xrefs: 00473692, 0047369E
AppData, xrefs: 00473899, 004738A5, 00473D6B
Common Desktop, xrefs: 00473716, 00473722
CommonPictures, xrefs: 0047399A, 004739A6
CommonMusic, xrefs: 004739E0, 004739EC
CurrentUser, xrefs: 004733AF, 00473400, 00473408, 0047343E, 00473446, 0047347C, 00473484, 004734BA, 004734C2, 004734F8, 00473500, 00473536, 0047353E, 0047366A, 00473672, 004736A8, 004736B0, 00473761, 00473769, 00473833, 0047383B, 00473871, 00473879, 00473B86, 00473B8E, 00473BB5, 00473BBD, 00473C1B, 00473C23, 00473C4A, 00473C52, 00473C7C, 00473C84, 00473CAE, 00473CB6, 00473D11, 00473D19, 00473D43, 00473D4B, 00473D75, 00473D7D
Common Documents, xrefs: 00473A23, 00473A2F
My Pictures, xrefs: 00473789, 00473795, 00473D39
ProgramFilesDir, xrefs: 004737D7, 004737E3, 00473DD9
Local AppData, xrefs: 0047385B, 00473867, 00473D9D
CommonVideo, xrefs: 00473954, 00473960

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: lua_remove.$_strlenlua_pushstring.$H_prolog3H_prolog3_lstrlenlua_getfield.lua_gettable.lua_pcall.lua_type.$FolderFromListLocationMallocPathSpeciallua_gettop.lua_pushnumber.
String ID: AppData$Common AppData$Common Desktop$Common Documents$Common Programs$Common Start Menu$Common Startup$CommonFilesDir$CommonMusic$CommonPictures$CommonVideo$CurrentUser$Desktop$Fonts$Local AppData$LocalMachine$My Music$My Pictures$My Video$Personal$ProgramFilesDir$Programs$SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders$Software\Microsoft\Windows\CurrentVersion$Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders$Start Menu$Startup
API String ID: 565944079-2480596902
Opcode ID: f1164faa057dd2656b83bac0a1b432808a60f44b90e705be719fad21e1d5dbf5
Instruction ID: df3980fa5d7cc877e0828f4ae111cec05e55fd3cadfa10da577760ea6d30b593
Opcode Fuzzy Hash: f1164faa057dd2656b83bac0a1b432808a60f44b90e705be719fad21e1d5dbf5
Instruction Fuzzy Hash: 7352E762501119AEEB25BB20DC4BFFE772DEF41705F1080AEF509650D3DE782F89992A

Uniqueness

Uniqueness Score: -1.00%

Function 0041AD87 Relevance: 157.2, APIs: 13, Strings: 76, Instructions: 1403
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_GS.LIBCMT ref: 0041AD91

Part of subcall function 00401BAB: __EH_prolog3.LIBCMT ref: 00401BB2

Part of subcall function 0040D56A: __EH_prolog3.LIBCMT ref: 0040D571
Part of subcall function 0040D56A: lua_getfield.LUA5.1(?,FFFFD8EE,?,?,?,?,?,00000004), ref: 0040D59D
Part of subcall function 0040D56A: lua_isstring.LUA5.1(?,000000FF,?,FFFFD8EE,?,?,?,?,?,00000004), ref: 0040D5A7
Part of subcall function 0040D56A: lua_tolstring.LUA5.1(?,000000FF,00000000), ref: 0040D5BA
Part of subcall function 0040D56A: lua_remove.LUA5.1(?,000000FF), ref: 0040D5D0

_strlen.LIBCMT ref: 0041ADE3

Part of subcall function 00403C07: _strnlen.LIBCMT ref: 00403C37
Part of subcall function 00403C07: _memcpy_s.LIBCMT ref: 00403C6B

Part of subcall function 0040C505: lua_pushstring.LUA5.1(?,?), ref: 0040C511
Part of subcall function 0040C505: lua_setfield.LUA5.1(?,FFFFD8EE,?,?,?), ref: 0040C521

Part of subcall function 0041AC26: __EH_prolog3.LIBCMT ref: 0041AC2D

Part of subcall function 0041DD58: __EH_prolog3_GS.LIBCMT ref: 0041DD62

Part of subcall function 0041AC26: lua_getfield.LUA5.1(00000000,FFFFD8EE,Shell,?,00000000,00000008), ref: 0041ACBA
Part of subcall function 0041AC26: lua_type.LUA5.1(00000000,?,00000000,FFFFD8EE,Shell,?,00000000,00000008), ref: 0041ACC4
Part of subcall function 0041AC26: lua_pushstring.LUA5.1(00000000,GetFolder), ref: 0041ACD7
Part of subcall function 0041AC26: lua_gettable.LUA5.1(00000000,000000FE,00000000,GetFolder), ref: 0041ACDF
Part of subcall function 0041AC26: lua_remove.LUA5.1(00000000,000000FE,00000000,000000FE,00000000,GetFolder), ref: 0041ACE7
Part of subcall function 0041AC26: lua_type.LUA5.1(00000000,?,00000000,000000FE,00000000,000000FE,00000000,GetFolder), ref: 0041ACEE
Part of subcall function 0041AC26: lua_pushnumber.LUA5.1(00000000), ref: 0041AD04
Part of subcall function 0041AC26: lua_pcall.LUA5.1(00000000,00000001,00000001,00000000,00000000), ref: 0041AD0F
Part of subcall function 0041AC26: lua_isstring.LUA5.1(00000000), ref: 0041AD1D
Part of subcall function 0041AC26: lua_tolstring.LUA5.1(00000000,?,00000000), ref: 0041AD2B
Part of subcall function 0041AC26: lua_settop.LUA5.1(00000000,00000000), ref: 0041AD4F

Part of subcall function 0041DD58: __splitpath_s.LIBCMT ref: 0041DEB0
Part of subcall function 0041DD58: _strlen.LIBCMT ref: 0041DEBC

Part of subcall function 0041AC26: lua_remove.LUA5.1(00000000), ref: 0041AD46

Part of subcall function 0041DC12: __EH_prolog3.LIBCMT ref: 0041DC19

Part of subcall function 00458416: GetModuleHandleA.KERNEL32(kernel32.dll,0074DE40,?,0041B446,?,?,00000000,?,?,00000000,?,?,00000000,?,?,00000000), ref: 00458423
Part of subcall function 00458416: GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 00458434
Part of subcall function 00458416: GetCurrentProcess.KERNEL32(00000000,?,?,0041B446,?,?,00000000,?,?,00000000,?,?,00000000,?,?,00000000), ref: 00458444

ExpandEnvironmentStringsA.KERNEL32(%ProgramW6432%,?,00000400,?,?,00000000,?,?,00000000,?,?,00000000,?,?,00000000), ref: 0041B460
_strlen.LIBCMT ref: 0041B46D
ExpandEnvironmentStringsA.KERNEL32(%CommonProgramW6432%,?,00000400,?,?,00000000,%ProgramW6432%,?,00000000,?,?,00000000,?,?,00000000), ref: 0041B588
_strlen.LIBCMT ref: 0041B595
GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0041B89E
_strlen.LIBCMT ref: 0041B8AB

Part of subcall function 0040181F: _memmove_s.LIBCMT ref: 00401866

Part of subcall function 00405AB7: __mbsinc.LIBCMT ref: 00405AF2

Part of subcall function 004014A6: _memcpy_s.LIBCMT ref: 004014F6

GetWindowsDirectoryA.KERNEL32(?,00000104,?,?,?,?,00000000,?,00000000,?,?,00000000), ref: 0041B978
_strlen.LIBCMT ref: 0041B98E

Part of subcall function 0040181F: _memcpy_s.LIBCMT ref: 00401876

Part of subcall function 0044FF3B: __EH_prolog3_GS.LIBCMT ref: 0044FF45
Part of subcall function 0044FF3B: GetVersionExA.KERNEL32 ref: 0044FFAD

Part of subcall function 00445632: __EH_prolog3.LIBCMT ref: 00445639

Part of subcall function 00445F5E: __EH_prolog3.LIBCMT ref: 00445F65

Part of subcall function 0041A0B2: __EH_prolog3.LIBCMT ref: 0041A0B9

_strlen.LIBCMT ref: 0041B9BA
GetTempPathA.KERNEL32(00000104,?,?,?,?,?,?,?,00000000,006985B8,00000000,?,?,?,?,00000000), ref: 0041BAF6
_strlen.LIBCMT ref: 0041BB07

Strings

SHF_MYMUSIC_COMMON, xrefs: 0041B2E5
%StartupFolder%, xrefs: 0041B1E4
RegisteredOrganization, xrefs: 0041BE22, 0041BF66
%StartupFolderCommon%, xrefs: 0041B22B
SHF_APPLICATIONDATA_COMMON, xrefs: 0041AE98
%TempLaunchFolder%, xrefs: 0041BC41, 0041BC46, 0041BC6D
Software\Microsoft\Windows\CurrentVersion, xrefs: 0041BD65, 0041BE12
SHF_MYMUSIC, xrefs: 0041B29E
%CommonDocumentsFolder%, xrefs: 0041B272
SHF_DESKTOP_COMMON, xrefs: 0041AF7F
%CommonFilesFolder%, xrefs: 0041B879
SHF_APPLICATIONDATA, xrefs: 0041AE51
SHF_STARTMENUPROGRAMS_COMMON, xrefs: 0041B182
Software\Microsoft\Windows NT\CurrentVersion, xrefs: 0041BEA4, 0041BF56
SUF9, xrefs: 0041C127
SHF_FONTS, xrefs: 0041B01F
SHF_PROGRAMFILES, xrefs: 0041B492, 0041B4A4, 0041B63F, 0041B644, 0041B7B6
%AppFolder%, xrefs: 0041BFF1
SHF_COMMON_DOCUMENTS, xrefs: 0041B257
SHF_STARTMENUPROGRAMS, xrefs: 0041B13B
SUF80, xrefs: 0041C0E7
%StartFolder%, xrefs: 0041B0CC
%MyDocumentsFolder%, xrefs: 0041B081
;?;?.lua, xrefs: 0041ADD9, 0041ADDE, 0041ADEA
_SystemFolder, xrefs: 0041B949
SHF_STARTMENU_COMMON, xrefs: 0041B0F4
%MyPicturesFolder%, xrefs: 0041B347
LUA_PATH, xrefs: 0041ADB4, 0041AE1B
%ProgramFilesFolder64%, xrefs: 0041B510, 0041B6B0
%FontsFolder%, xrefs: 0041B03A
_ProgramFilesFolder, xrefs: 0041B828
%SystemDrive%, xrefs: 0041BAD1
_DesktopFolderCommon, xrefs: 0041AFE9
SHF_MYVIDEOS_COMMON, xrefs: 0041B401
%DesktopFolder%, xrefs: 0041AEFA, 0041AEFF, 0041AF26
%ApplicationDataFolderCommon%, xrefs: 0041AEB3
%TempFolder%, xrefs: 0041BB86, 0041BB8B, 0041BBAE
_ProgramFilesFolder64, xrefs: 0041B554, 0041B6F4
%WindowsFolder%, xrefs: 0041B9F3, 0041B9F8, 0041BA1F, 0041BA6E
%SystemFolder%, xrefs: 0041B8FA, 0041B8FF, 0041B926
%MyVideosFolder%, xrefs: 0041B3D9
%DesktopFolderCommon%, xrefs: 0041AF9A, 0041AF9F, 0041AFC6
%SourceFolder%, xrefs: 0041BB67
%StartProgramsFolderCommon%, xrefs: 0041B19D
SHF_STARTMENU, xrefs: 0041B0AD
%AppDrive%, xrefs: 0041C091
_TempLaunchFolder, xrefs: 0041BC90
%ApplicationDataFolder%, xrefs: 0041AE6C
%MyPicturesFolderCommon%, xrefs: 0041B38E
LocalMachine, xrefs: 0041BD55, 0041BE02, 0041BE94, 0041BF46
_IR_ProductID, xrefs: 0041C0F2, 0041C103, 0041C13A
%RegOwner%, xrefs: 0041BCF1, 0041BDDE, 0041BF1D
%CommonProgramW6432%, xrefs: 0041B583, 0041B5AE
SHF_MYPICTURES_COMMON, xrefs: 0041B373
SHF_COMMONFILES, xrefs: 0041B5CB, 0041B720, 0041B85E
_WindowsFolder, xrefs: 0041BA42
SHF_MYPICTURES, xrefs: 0041B32C
0, xrefs: 0041C166
SHF_STARTUP_COMMON, xrefs: 0041B210
SHF_DESKTOP, xrefs: 0041AEDF
%DAOPath%, xrefs: 0041C0C5
%MyMusicFolderCommon%, xrefs: 0041B300
%StartFolderCommon%, xrefs: 0041B10F
SHF_MYDOCUMENTS, xrefs: 0041B066
RegisteredOwner, xrefs: 0041BD75, 0041BEB4
%StartProgramsFolder%, xrefs: 0041B156
_TempFolder, xrefs: 0041BBD1
%MyMusicFolder%, xrefs: 0041B2B9
_DesktopFolder, xrefs: 0041AF49
%ProgramW6432%, xrefs: 0041B45A, 0041B45F, 0041B486
%RegOrganization%, xrefs: 0041BD24, 0041BFD3
SHF_STARTUP, xrefs: 0041B1C9
%MyVideosFolderCommon%, xrefs: 0041B41C
SHF_MYVIDEOS, xrefs: 0041B3BA
%ProgramFilesFolder%, xrefs: 0041B7D9, 0041B7DE, 0041B805
%CommonFilesFolder64%, xrefs: 0041B78E

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: _strlen$H_prolog3$H_prolog3__memcpy_slua_remove.$DirectoryEnvironmentExpandStringslua_getfield.lua_isstring.lua_pushstring.lua_tolstring.lua_type.$AddressCurrentHandleModulePathProcProcessSystemTempVersionWindows__mbsinc__splitpath_s_memmove_s_strnlenlua_gettable.lua_pcall.lua_pushnumber.lua_setfield.lua_settop.
String ID: %AppDrive%$%AppFolder%$%ApplicationDataFolder%$%ApplicationDataFolderCommon%$%CommonDocumentsFolder%$%CommonFilesFolder%$%CommonFilesFolder64%$%CommonProgramW6432%$%DAOPath%$%DesktopFolder%$%DesktopFolderCommon%$%FontsFolder%$%MyDocumentsFolder%$%MyMusicFolder%$%MyMusicFolderCommon%$%MyPicturesFolder%$%MyPicturesFolderCommon%$%MyVideosFolder%$%MyVideosFolderCommon%$%ProgramFilesFolder%$%ProgramFilesFolder64%$%ProgramW6432%$%RegOrganization%$%RegOwner%$%SourceFolder%$%StartFolder%$%StartFolderCommon%$%StartProgramsFolder%$%StartProgramsFolderCommon%$%StartupFolder%$%StartupFolderCommon%$%SystemDrive%$%SystemFolder%$%TempFolder%$%TempLaunchFolder%$%WindowsFolder%$0$;?;?.lua$LUA_PATH$LocalMachine$RegisteredOrganization$RegisteredOwner$SHF_APPLICATIONDATA$SHF_APPLICATIONDATA_COMMON$SHF_COMMONFILES$SHF_COMMON_DOCUMENTS$SHF_DESKTOP$SHF_DESKTOP_COMMON$SHF_FONTS$SHF_MYDOCUMENTS$SHF_MYMUSIC$SHF_MYMUSIC_COMMON$SHF_MYPICTURES$SHF_MYPICTURES_COMMON$SHF_MYVIDEOS$SHF_MYVIDEOS_COMMON$SHF_PROGRAMFILES$SHF_STARTMENU$SHF_STARTMENUPROGRAMS$SHF_STARTMENUPROGRAMS_COMMON$SHF_STARTMENU_COMMON$SHF_STARTUP$SHF_STARTUP_COMMON$SUF80$SUF9$Software\Microsoft\Windows NT\CurrentVersion$Software\Microsoft\Windows\CurrentVersion$_DesktopFolder$_DesktopFolderCommon$_IR_ProductID$_ProgramFilesFolder$_ProgramFilesFolder64$_SystemFolder$_TempFolder$_TempLaunchFolder$_WindowsFolder
API String ID: 3182814728-2820401366
Opcode ID: 12acaab1bb8452d3fa9e2b264f78b7cffc45a6ee502d98dc25e319b1acc67ff8
Instruction ID: 0b4b13973a95d18aa85d715952d4abcb100da8110f6399218f55ead5f45302fe
Opcode Fuzzy Hash: 12acaab1bb8452d3fa9e2b264f78b7cffc45a6ee502d98dc25e319b1acc67ff8
Instruction Fuzzy Hash: 6CB257B0E10658ABCB149B59CD57BDE7BB99F49715F0001DEB009732C2DA781B848FEA

Uniqueness

Uniqueness Score: -1.00%

Function 00427EB5 Relevance: 111.4, APIs: 19, Strings: 44, Instructions: 1144
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_GS.LIBCMT ref: 00427EBF

Part of subcall function 00401BAB: __EH_prolog3.LIBCMT ref: 00401BB2

Part of subcall function 0043C227: __EH_prolog3.LIBCMT ref: 0043C22E

_strlen.LIBCMT ref: 00427F33

Part of subcall function 00403C07: _strnlen.LIBCMT ref: 00403C37
Part of subcall function 00403C07: _memcpy_s.LIBCMT ref: 00403C6B

Part of subcall function 00418E87: __EH_prolog3.LIBCMT ref: 00418E8E

Part of subcall function 00417A93: _memset.LIBCMT ref: 00417ABE
Part of subcall function 00417A93: GetVersionExA.KERNEL32(?,00000000,?), ref: 00417AD9
Part of subcall function 00417A93: GetVersionExA.KERNEL32(?), ref: 00417AF0

_strlen.LIBCMT ref: 00428679
_memset.LIBCMT ref: 004286CE
GlobalMemoryStatusEx.KERNEL32(?), ref: 004286DD
_strlen.LIBCMT ref: 004287F2

Part of subcall function 0043C227: __EH_prolog3.LIBCMT ref: 0043C2C6

Part of subcall function 0043C227: __EH_prolog3.LIBCMT ref: 0043C33E
Part of subcall function 0043C227: lua_settop.LUA5.1(00000000,00000000,00000000,00000000,00000000,00000008,00404284,?,?,00000010,00000000,00000000,00000000,00000000,000000B8), ref: 0043C35B
Part of subcall function 0043C227: lua_getfield.LUA5.1(00000000,FFFFD8EE,_tblErrorMessages,00000000,00000000,00000000,00000000,00000000,00000008,00404284,?,?,00000010,00000000,00000000,00000000), ref: 0043C36B
Part of subcall function 0043C227: lua_pushnumber.LUA5.1(00000000), ref: 0043C37A
Part of subcall function 0043C227: lua_pushstring.LUA5.1(00000000,00000000), ref: 0043C3A6
Part of subcall function 0043C227: lua_settable.LUA5.1(00000000,000000FD), ref: 0043C3BB
Part of subcall function 0043C227: lua_settop.LUA5.1(00000000,000000FE,00000000,000000FD), ref: 0043C3C3

Part of subcall function 00418503: __EH_prolog3.LIBCMT ref: 0041853B

Part of subcall function 0040C75B: __EH_prolog3.LIBCMT ref: 0040C762

Part of subcall function 00405B76: __EH_prolog3.LIBCMT ref: 00405B7D

Part of subcall function 0040C75B: _strlen.LIBCMT ref: 0040C79F

Part of subcall function 00418EC5: __EH_prolog3.LIBCMT ref: 00418ECC

GetSystemMetrics.USER32(00000000), ref: 00428814
_strlen.LIBCMT ref: 004288D1

Part of subcall function 004B4C5C: __CxxThrowException@8.LIBCMT ref: 004B4C72
Part of subcall function 004B4C5C: __EH_prolog3.LIBCMT ref: 004B4C7F

GetSystemMetrics.USER32(00000001), ref: 004288F2
_strlen.LIBCMT ref: 004289AB
GetDesktopWindow.USER32 ref: 004289D9
GetDC.USER32(?), ref: 004289E4
GetDeviceCaps.GDI32(?,0000000C), ref: 004289F8
GetDesktopWindow.USER32 ref: 00428A01
_strlen.LIBCMT ref: 00428C10

Part of subcall function 0040181F: _memcpy_s.LIBCMT ref: 00401876

_strlen.LIBCMT ref: 00428B05

Part of subcall function 0040181F: _memmove_s.LIBCMT ref: 00401866

Part of subcall function 00458FC6: GetVersionExA.KERNEL32(?,00000000), ref: 00458FF3

ReleaseDC.USER32(?,00000001), ref: 00428A12

Part of subcall function 00405B76: _strlen.LIBCMT ref: 00405BB5

MessageBoxA.USER32(?,?,00000000,?), ref: 00428D66
MessageBoxA.USER32(?,?,00000000,?), ref: 00428E2F

Strings

, xrefs: 00427F2D, 00427F32, 00427F3A
MSG_SYSREQ_USERPERMISSION, xrefs: 00428B85
;, xrefs: 00428E20
System requirements check (, xrefs: 00428C53
MSG_SYSREQ_ABORT, xrefs: 00428CD1
System requirements check, xrefs: 00428D85
MSG_OS_PART_ORNEWER, xrefs: 004284E8
MSG_SYSREQ_RAM, xrefs: 00428767
%s: %s, xrefs: 00428BA9
MSG_OS_WVISTA, xrefs: 00428083
Operating System, xrefs: 00428673, 00428678, 00428680
%s: %d, xrefs: 00428820, 00428878, 00428951
MSG_OS_ALL, xrefs: 0042829E
MSG_SYSREQ_OS, xrefs: 004285DC
MSG_OS_NONE, xrefs: 00428258
MSG_OS_W8, xrefs: 0042819B
MSG_SYSREQ_NOTMET, xrefs: 00427EEE
Screen Height, xrefs: 004289A0, 004289A7, 004289B2
MSG_OS_PART_SERVPACK, xrefs: 00428401
Screen Width, xrefs: 004288CB, 004288D0, 004288D8
MSG_OS_PART_NOSERVPACK, xrefs: 00428485
%s: %d %s, xrefs: 0042878B, 00428A9E
MSG_SYSREQ_SYSTEMADMIN, xrefs: 00428B56
MSG_OS_WSRV2008_R2, xrefs: 00428155
RAM, xrefs: 004287E9, 004287EE, 004287F9
MSG_OS_WXP, xrefs: 00427FF7
MSG_OS_W7, xrefs: 0042810F
MSG_OS_PART_C, xrefs: 00428370
MSG_OS_PART_SE, xrefs: 004283B6
Color Depth, xrefs: 00428AFC, 00428B01, 00428B0C
MSG_SYSREQ_SCREENWIDTH, xrefs: 00428854
MSG_BITSPERPIXEL, xrefs: 00428A40
MSG_OS_UNKNOWN, xrefs: 00427FAE
MSG_OS_PART_B, xrefs: 0042832A
MSG_SYSREQ_SCREENHEIGHT, xrefs: 0042892D
MSG_OS_WSRV2003, xrefs: 0042803D
MSG_SYSREQ_COLORDEPTH, xrefs: 00428A7A
MSG_SYSREQ_WARN, xrefs: 00428D9A
MSG_SIZE_MEGABYTES, xrefs: 0042872D
MSG_OS_WSRV2012, xrefs: 004281E1
Administrator, xrefs: 00428C07, 00428C0C, 00428C17
MSG_OS_PART_A, xrefs: 004282E4
MSG_NOTICE, xrefs: 00428D36, 00428DFF
MSG_OS_WSRV2008, xrefs: 004280C9

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: H_prolog3$_strlen$Version$DesktopMessageMetricsSystemWindow_memcpy_s_memsetlua_settop.$CapsDeviceException@8GlobalH_prolog3_MemoryReleaseStatusThrow_memmove_s_strnlenlua_getfield.lua_pushnumber.lua_pushstring.lua_settable.
String ID: $%s: %d$%s: %d %s$%s: %s$;$Administrator$Color Depth$MSG_BITSPERPIXEL$MSG_NOTICE$MSG_OS_ALL$MSG_OS_NONE$MSG_OS_PART_A$MSG_OS_PART_B$MSG_OS_PART_C$MSG_OS_PART_NOSERVPACK$MSG_OS_PART_ORNEWER$MSG_OS_PART_SE$MSG_OS_PART_SERVPACK$MSG_OS_UNKNOWN$MSG_OS_W7$MSG_OS_W8$MSG_OS_WSRV2003$MSG_OS_WSRV2008$MSG_OS_WSRV2008_R2$MSG_OS_WSRV2012$MSG_OS_WVISTA$MSG_OS_WXP$MSG_SIZE_MEGABYTES$MSG_SYSREQ_ABORT$MSG_SYSREQ_COLORDEPTH$MSG_SYSREQ_NOTMET$MSG_SYSREQ_OS$MSG_SYSREQ_RAM$MSG_SYSREQ_SCREENHEIGHT$MSG_SYSREQ_SCREENWIDTH$MSG_SYSREQ_SYSTEMADMIN$MSG_SYSREQ_USERPERMISSION$MSG_SYSREQ_WARN$Operating System$RAM$Screen Height$Screen Width$System requirements check$System requirements check (
API String ID: 2515474635-2171012533
Opcode ID: 6d591495275eeb0fa1b1ecc800a1be675e2e5f79365b45e657152c7f14d656b6
Instruction ID: 4226f85bc195d0106a14c5e3ff12855e4264d12d1b42efd4ece696740f155b80
Opcode Fuzzy Hash: 6d591495275eeb0fa1b1ecc800a1be675e2e5f79365b45e657152c7f14d656b6
Instruction Fuzzy Hash: 4FA26170D00188AFDB04EBE9CD51AED7B79AF15328F14415EF116BB2D2DB781A04CB6A

Uniqueness

Uniqueness Score: -1.00%

Function 0042DBAE Relevance: 88.9, APIs: 23, Strings: 27, Instructions: 1383
windowfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileA.KERNEL32(?,?,006985B8,00000000,?,00000001,00000000,?,?,?,?,00000000,00000000,00000000,00000000,00000000), ref: 0042F218

Part of subcall function 00440C8A: __EH_prolog3.LIBCMT ref: 00440C91

_strlen.LIBCMT ref: 0042DE10

Part of subcall function 00403C07: _strnlen.LIBCMT ref: 00403C37
Part of subcall function 00403C07: _memcpy_s.LIBCMT ref: 00403C6B

MessageBoxA.USER32(00000000,?,00000000,?), ref: 0042E08D
DeleteFileA.KERNEL32(?,?,?,?,?,?,00000000,00000000,?,?), ref: 0042E1CC

Part of subcall function 00401BAB: __EH_prolog3.LIBCMT ref: 00401BB2

Part of subcall function 0043C227: __EH_prolog3.LIBCMT ref: 0043C22E

_strlen.LIBCMT ref: 0042E270

Part of subcall function 0043C227: __EH_prolog3.LIBCMT ref: 0043C2C6

Part of subcall function 0040C75B: __EH_prolog3.LIBCMT ref: 0040C762

Part of subcall function 0043A00F: __EH_prolog3.LIBCMT ref: 0043A016

_strlen.LIBCMT ref: 0042E2D7
_strlen.LIBCMT ref: 0042E33E
_strlen.LIBCMT ref: 0042E3A5
_strlen.LIBCMT ref: 0042E409
MessageBoxA.USER32(?,?,00000000,?), ref: 0042E4DC
MessageBoxA.USER32(?,?,00000000,?), ref: 0042E65B
SetFileAttributesA.KERNEL32(?,00000080,?,?,?,?,?,00000000,00000000,?,?), ref: 0042E773
CopyFileA.KERNEL32(?,?), ref: 0042E784
MoveFileExA.KERNEL32(?,?,00000005(MOVEFILE_REPLACE_EXISTING|MOVEFILE_DELAY_UNTIL_REBOOT)), ref: 0042E79E
WritePrivateProfileStringA.KERNEL32(Rename,?,?,?), ref: 0042E844
DeleteFileA.KERNEL32(?,?), ref: 0042E948
__time64.LIBCMT ref: 0042E99F

Part of subcall function 005B5F5F: GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,00439F6A,00000000,00000010,00404C11,** [END] ProcessInBuffer !ReadFromDisk,00000001), ref: 005B5F6A
Part of subcall function 005B5F5F: __aulldiv.LIBCMT ref: 005B5F8A

Part of subcall function 0040C75B: _strlen.LIBCMT ref: 0040C79F

Part of subcall function 00420480: __EH_prolog3.LIBCMT ref: 00420487

Part of subcall function 0043C227: __EH_prolog3.LIBCMT ref: 0043C33E
Part of subcall function 0043C227: lua_settop.LUA5.1(00000000,00000000,00000000,00000000,00000000,00000008,00404284,?,?,00000010,00000000,00000000,00000000,00000000,000000B8), ref: 0043C35B
Part of subcall function 0043C227: lua_getfield.LUA5.1(00000000,FFFFD8EE,_tblErrorMessages,00000000,00000000,00000000,00000000,00000000,00000008,00404284,?,?,00000010,00000000,00000000,00000000), ref: 0043C36B
Part of subcall function 0043C227: lua_pushnumber.LUA5.1(00000000), ref: 0043C37A
Part of subcall function 0043C227: lua_pushstring.LUA5.1(00000000,00000000), ref: 0043C3A6
Part of subcall function 0043C227: lua_settable.LUA5.1(00000000,000000FD), ref: 0043C3BB
Part of subcall function 0043C227: lua_settop.LUA5.1(00000000,000000FE,00000000,000000FD), ref: 0043C3C3

__time64.LIBCMT ref: 0042E9CB
__time64.LIBCMT ref: 0042E9F7
SetFileAttributesA.KERNEL32(?,?,?,?,?,?,?,00000000,00000000,?,?), ref: 0042EA3D
MessageBoxA.USER32(?,?,00000000,?), ref: 0042EC95
MessageBoxA.USER32(?,?,00000000,?), ref: 0042EEE7

Part of subcall function 0040C578: lua_getfield.LUA5.1(0000C259,FFFFD8EE,?,80000000,?,?,00403F08,?), ref: 0040C58C
Part of subcall function 0040C578: lua_isnumber.LUA5.1(0000C259,000000FF,0000C259,FFFFD8EE,?,80000000,?,?,00403F08,?), ref: 0040C596
Part of subcall function 0040C578: lua_tonumber.LUA5.1(0000C259,000000FF), ref: 0040C5A7
Part of subcall function 0040C578: lua_remove.LUA5.1(0000C259,000000FF), ref: 0040C5BA

Part of subcall function 004278AD: __EH_prolog3.LIBCMT ref: 004278B4

__EH_prolog3_GS.LIBCMT ref: 0042F357

Strings

%WindowsFolder%, xrefs: 0042E7C5
Skip archive file: , xrefs: 0042EF83
Archive file: , xrefs: 0042EFE9
_NeedsReboot, xrefs: 0042E891
ERR_DECOMPRESS_UNKNOWN, xrefs: 0042E26B, 0042E277, 0042E290
2, xrefs: 0042F04E
%sArc: %sFN: %s, xrefs: 0042E5FC, 0042EE88
ERR_DECOMPRESS_CRC, xrefs: 0042E339, 0042E345, 0042E35E
Rename, xrefs: 0042E83F
\WININIT.INI, xrefs: 0042E7B7
ERR_DECOMPRESS_DETECTED, xrefs: 0042E1F5
%s (%d):%s, xrefs: 0042EC2D
Change file attributes: , xrefs: 0042EA4C
MSG_ERROR, xrefs: 0042E05D, 0042E4AC, 0042E62B, 0042EC65, 0042EEB7
(Reason: , xrefs: 0042EFF4
ERR_DECOMPRESS_RW, xrefs: 0042E3A0, 0042E3AC, 0042E3C5
Protected archive file install on reboot: , xrefs: 0042E8BD
ERR_CREATE_UNINSTALL_ENTRY, xrefs: 0042EB94, 0042EB99, 0042EC07
%s%s (#%d), xrefs: 0042E229
INSTALL_STAGE_INSTALLING_FILES, xrefs: 0042DB5F, 0042F154
Install archive file: , xrefs: 0042DF22, 0042E907, 0042ECD8
ERR_DECOMPRESS_DISKFULL, xrefs: 0042E2D2, 0042E2DE, 0042E2F7
MSG_SEEKING, xrefs: 0042F185
ERR_OPEN_OUTPUT, xrefs: 0042E404, 0042E410, 0042E429
%s%s, xrefs: 0042E02E
ERR_ARCHIVE_SKIPPING_FILE, xrefs: 0042E575, 0042E5D2, 0042EDE9, 0042EE5E
ERR_CREATE_FOLDER, xrefs: 0042DFA0, 0042E004

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: H_prolog3$File$_strlen$Message$Delete__time64$AttributesTimelua_getfield.lua_settop.$CopyH_prolog3_MovePrivateProfileStringSystemWrite__aulldiv_memcpy_s_strnlenlua_isnumber.lua_pushnumber.lua_pushstring.lua_remove.lua_settable.lua_tonumber.
String ID: (Reason: $%WindowsFolder%$%s%s$%sArc: %sFN: %s$%s%s (#%d)$%s (%d):%s$2$Archive file: $Change file attributes: $ERR_ARCHIVE_SKIPPING_FILE$ERR_CREATE_FOLDER$ERR_CREATE_UNINSTALL_ENTRY$ERR_DECOMPRESS_CRC$ERR_DECOMPRESS_DETECTED$ERR_DECOMPRESS_DISKFULL$ERR_DECOMPRESS_RW$ERR_DECOMPRESS_UNKNOWN$ERR_OPEN_OUTPUT$INSTALL_STAGE_INSTALLING_FILES$Install archive file: $MSG_ERROR$MSG_SEEKING$Protected archive file install on reboot: $Rename$Skip archive file: $\WININIT.INI$_NeedsReboot
API String ID: 3390730035-3150782931
Opcode ID: e327ddea02fd00c2b4687df090e967da394aee4382bb96065904e0c5718ecea9
Instruction ID: be67d2dbf6f1b0989acd2558e84744010022f519b1aeefa7328327c6d6abd82d
Opcode Fuzzy Hash: e327ddea02fd00c2b4687df090e967da394aee4382bb96065904e0c5718ecea9
Instruction Fuzzy Hash: 64D28F70A00519DFDB24DB65CD91DEAB7BAAF49318F0001EEF189A7292DBB41AD0CF15

Uniqueness

Uniqueness Score: -1.00%

Function 0041EAE7 Relevance: 87.1, APIs: 15, Strings: 34, Instructions: 1339
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00401BAB: __EH_prolog3.LIBCMT ref: 00401BB2

Part of subcall function 0041E284: __EH_prolog3.LIBCMT ref: 0041E28B

Part of subcall function 0040C544: lua_pushboolean.LUA5.1(?,?), ref: 0040C550
Part of subcall function 0040C544: lua_setfield.LUA5.1(?,FFFFD8EE,?,?,?), ref: 0040C560

GetFileAttributesA.KERNEL32(026282D8), ref: 0041EC05
__wcstoui64.LIBCMT ref: 0041EDF9

Part of subcall function 005B8A7E: strtoxq.LIBCMT ref: 005B8AA0

__wcstoui64.LIBCMT ref: 0041F029
GetModuleFileNameA.KERNEL32(?,?,00000104), ref: 0041ECF2

Part of subcall function 00405AB7: __mbsinc.LIBCMT ref: 00405AF2

GetModuleFileNameA.KERNEL32(?,?,00000104), ref: 0041F0D7
GetModuleFileNameA.KERNEL32(?,?,00000104,?,00000000), ref: 0041F179
__splitpath_s.LIBCMT ref: 0041F1F8

Strings

__IRSID:, xrefs: 0041EE30
%, xrefs: 0041FFAA
__IRCT:, xrefs: 0041EEC4
Invalid archive filename:%s, xrefs: 0041EC3B
Invalid module name., xrefs: 0041F0BF, 0041FFB5
/NOINIT, xrefs: 0041F2DD
%SourceFolder%, xrefs: 0041F65E, 0041F663, 0041F694
%SourceDrive%, xrefs: 0041F843, 0041F848, 0041F879
lua5.1.dll, xrefs: 0041F23C
Invalid start mode: compression type, xrefs: 0041EEF1
_SourceFolder, xrefs: 0041F6B5
__IRTSS:, xrefs: 0041EF98
%SourceFilename%, xrefs: 0041F703, 0041F708, 0041F739
Invalid start mode: archive filename, xrefs: 0041EB92
_DoingUninstall, xrefs: 0041EB36
setup, xrefs: 0041F34B, 0041F350, 0041F358
Failed to find , xrefs: 0041FF7C
Invalid start mode: archive offset, xrefs: 0041EDB3
Failed self extraction, xrefs: 0041F43C
Invalid uninstall control file: , xrefs: 0041F5F3
__IRAOFF:, xrefs: 0041ED84
Failed to load , xrefs: 0041F94D
_SilentInstall, xrefs: 0041F3D0, 0041F9C5, 0041FA83, 0041FAAE, 0041FAD2
Invalid start mode: total setup size, xrefs: 0041EFC5
Invalid silent install INI file: , xrefs: 0041FBE6
data file, xrefs: 0041F962, 0041FF91
Invalid uninstall command line option, xrefs: 0041F544
_SourceDrive, xrefs: 0041F8A6
_SourceFilename, xrefs: 0041F75E
/U:, xrefs: 0041EAF1
Failed to create debug window., xrefs: 0041FE40
__IRAFN:, xrefs: 0041EB69
uninstall, xrefs: 0041F51B, 0041F520, 0041F528
\irsetup.dat, xrefs: 0041F4D4

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: File$ModuleName$H_prolog3__wcstoui64$Attributes__mbsinc__splitpath_slua_pushboolean.lua_setfield.strtoxq
String ID: data file$%$%SourceDrive%$%SourceFilename%$%SourceFolder%$/NOINIT$/U:$Failed self extraction$Failed to create debug window.$Failed to find $Failed to load $Invalid archive filename:%s$Invalid module name.$Invalid silent install INI file: $Invalid start mode: archive filename$Invalid start mode: archive offset$Invalid start mode: compression type$Invalid start mode: total setup size$Invalid uninstall command line option$Invalid uninstall control file: $\irsetup.dat$_DoingUninstall$_SilentInstall$_SourceDrive$_SourceFilename$_SourceFolder$__IRAFN:$__IRAOFF:$__IRCT:$__IRSID:$__IRTSS:$lua5.1.dll$setup$uninstall
API String ID: 177417289-1994103235
Opcode ID: dc288f7a2336766facf79945055fdb89966d8686703062756b31738f359e0a8c
Instruction ID: a99f083a8b83a8050169faedbcc45fe2e92807e0d520c38b856cede29d7271bf
Opcode Fuzzy Hash: dc288f7a2336766facf79945055fdb89966d8686703062756b31738f359e0a8c
Instruction Fuzzy Hash: 5DC276B09001489FDB14EB69CD91BAD77B9AF45328F4441EEF115A72D2CB385E84CB2E

Uniqueness

Uniqueness Score: -1.00%

Function 0042AB68 Relevance: 81.5, APIs: 20, Strings: 26, Instructions: 957
windowfilestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_GS.LIBCMT ref: 0042AB72

Part of subcall function 004019B2: _strlen.LIBCMT ref: 004019C2

Part of subcall function 0044DE68: LoadLibraryA.KERNEL32(Sfc.dll,?,?), ref: 0044DE8D
Part of subcall function 0044DE68: GetProcAddress.KERNEL32(00000000,SfcIsFileProtected), ref: 0044DEA4
Part of subcall function 0044DE68: _memset.LIBCMT ref: 0044DEC6
Part of subcall function 0044DE68: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000104,?,?,?), ref: 0044DEE1
Part of subcall function 0044DE68: FreeLibrary.KERNEL32(?,?,?), ref: 0044DF01

lstrcpy.KERNEL32(?,?), ref: 0042AD77
_malloc.LIBCMT ref: 0042AD9F
73EE1500.VERSION(?,00698DAC,?,?,?,?,?,00000000,?,?,?,000000A8,?,00000020,0042D4B5,00000000), ref: 0042ADE5
_memmove.LIBCMT ref: 0042ADFD
_free.LIBCMT ref: 0042AE45
MessageBoxA.USER32(00000000,?,00000000,?), ref: 0042B028
MessageBoxA.USER32(00000000,?,00000000,?), ref: 0042B243
GetFileAttributesA.KERNEL32(?,?,000003CC,?,?,?,?,00000000,00000000,00000000,00000001,006985B8,00000000,00000000,00000000,000003CC), ref: 0042B347
GetFileAttributesA.KERNEL32(?,?,000000A8,?,00000020,0042D4B5,00000000,?,00000000,00000000,?,?,00000004,00000000,00000000,00000000), ref: 0042B386
_strlen.LIBCMT ref: 0042B3C8

Part of subcall function 004014A6: _memcpy_s.LIBCMT ref: 004014F6

Part of subcall function 0044BAF2: __EH_prolog3_GS.LIBCMT ref: 0044BAFC
Part of subcall function 0044BAF2: GetCurrentDirectoryA.KERNEL32(00000104,?,0000005C,0000005C), ref: 0044BB48
Part of subcall function 0044BAF2: _memset.LIBCMT ref: 0044BB64
Part of subcall function 0044BAF2: SetCurrentDirectoryA.KERNEL32(?), ref: 0044BBC9
Part of subcall function 0044BAF2: CreateDirectoryA.KERNEL32(?,00000000), ref: 0044BBDB
Part of subcall function 0044BAF2: SetCurrentDirectoryA.KERNEL32(?), ref: 0044BCBD

Part of subcall function 0043C227: __EH_prolog3.LIBCMT ref: 0043C22E

GetTempFileNameA.KERNEL32(?,suf,00000000,?,?,?,?,?,00000000,00000000,00000000,00000001,006985B8,00000000,00000000,00000000), ref: 0042B5D3
SetFileAttributesA.KERNEL32(00000000,00000080,?,00000000,00000000,00000000,?,00000020,0042D4B5,00000000,?,00000000,00000000,?,?,00000004), ref: 0042B6C1
DeleteFileA.KERNEL32(?,?,00000020,0042D4B5,00000000,?,00000000,00000000,?,?,00000004,00000000,00000000,00000000,00000000), ref: 0042B6C9

Part of subcall function 004248B9: __EH_prolog3.LIBCMT ref: 004248C0
Part of subcall function 004248B9: _strlen.LIBCMT ref: 00424925

Part of subcall function 00401BAB: __EH_prolog3.LIBCMT ref: 00401BB2

Part of subcall function 0040D56A: __EH_prolog3.LIBCMT ref: 0040D571
Part of subcall function 0040D56A: lua_getfield.LUA5.1(?,FFFFD8EE,?,?,?,?,?,00000004), ref: 0040D59D
Part of subcall function 0040D56A: lua_isstring.LUA5.1(?,000000FF,?,FFFFD8EE,?,?,?,?,?,00000004), ref: 0040D5A7
Part of subcall function 0040D56A: lua_tolstring.LUA5.1(?,000000FF,00000000), ref: 0040D5BA
Part of subcall function 0040D56A: lua_remove.LUA5.1(?,000000FF), ref: 0040D5D0

SetFileAttributesA.KERNEL32(?,00000080,?,?,?,?,00000000,00000000,00000000,00000001,006985B8,00000000,00000000,00000000,000003CC), ref: 0042B6DC
MessageBoxA.USER32(00000000,?,00000000,?), ref: 0042B82F

Part of subcall function 00405B76: __EH_prolog3.LIBCMT ref: 00405B7D

Part of subcall function 0043A00F: __EH_prolog3.LIBCMT ref: 0043A016

Part of subcall function 0040C544: lua_pushboolean.LUA5.1(?,?), ref: 0040C550
Part of subcall function 0040C544: lua_setfield.LUA5.1(?,FFFFD8EE,?,?,?), ref: 0040C560

Part of subcall function 0043C227: __EH_prolog3.LIBCMT ref: 0043C33E
Part of subcall function 0043C227: lua_settop.LUA5.1(00000000,00000000,00000000,00000000,00000000,00000008,00404284,?,?,00000010,00000000,00000000,00000000,00000000,000000B8), ref: 0043C35B
Part of subcall function 0043C227: lua_getfield.LUA5.1(00000000,FFFFD8EE,_tblErrorMessages,00000000,00000000,00000000,00000000,00000000,00000008,00404284,?,?,00000010,00000000,00000000,00000000), ref: 0043C36B
Part of subcall function 0043C227: lua_pushnumber.LUA5.1(00000000), ref: 0043C37A
Part of subcall function 0043C227: lua_pushstring.LUA5.1(00000000,00000000), ref: 0043C3A6
Part of subcall function 0043C227: lua_settable.LUA5.1(00000000,000000FD), ref: 0043C3BB
Part of subcall function 0043C227: lua_settop.LUA5.1(00000000,000000FE,00000000,000000FD), ref: 0043C3C3

GetTempFileNameA.KERNEL32(?,suf,00000000,?), ref: 0042B87F
MoveFileExA.KERNEL32(?,00000000,00000005(MOVEFILE_REPLACE_EXISTING|MOVEFILE_DELAY_UNTIL_REBOOT)), ref: 0042B891
WritePrivateProfileStringA.KERNEL32(Rename,?,?,?), ref: 0042B937

Part of subcall function 0043C227: __EH_prolog3.LIBCMT ref: 0043C2C6

DeleteFileA.KERNEL32(?,00000000,0000B011,00000000,?,000000A8,?,00000020,0042D4B5,00000000,?,00000000,00000000,?,?,00000004), ref: 0042BA79

Strings

(Source = , xrefs: 0042B98B
%WindowsFolder%, xrefs: 0042B8B8
MSG_FILE_OVERWRITE_CONFIRM, xrefs: 0042AF53, 0042B16E
File Backup, xrefs: 0042B462
suf, xrefs: 0042B5C8, 0042B86A
_NeedsReboot, xrefs: 0042BA48
Rename, xrefs: 0042B932
\WININIT.INI, xrefs: 0042B8AA
_BackupFolder, xrefs: 0042B311
%s%s%s, xrefs: 0042AFAE, 0042B1C9
Backup existing file: , xrefs: 0042B48E, 0042B51F
MSG_FILE_EXISTS_INUSE, xrefs: 0042B78F
MSG_FILE_EXISTS_ANY, xrefs: 0042B19F
Conditions not met, xrefs: 0042AC55
File in use: , xrefs: 0042B705
MSG_FILE_EXISTS_RETRY, xrefs: 0042B75C
Archive file rollback: , xrefs: 0042B61A
%s%s%s, xrefs: 0042B7B9
-> , xrefs: 0042B499, 0042B52A
Existing file protected, xrefs: 0042ACEA
Install archive file on reboot: , xrefs: 0042B980
Existing file overwrite setting, xrefs: 0042B132
, xrefs: 0042B9E4
(Temporary filename = , xrefs: 0042B625
MSG_FILE_EXISTS_NEWER, xrefs: 0042AF84
MSG_NOTICE, xrefs: 0042AFF8, 0042B213, 0042B7FF

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: File$H_prolog3$AttributesDirectory$CurrentMessage_strlen$DeleteH_prolog3_LibraryNameTemp_memsetlua_getfield.lua_settop.$AddressByteCharCreateE1500FreeLoadMoveMultiPrivateProcProfileStringWideWrite_free_malloc_memcpy_s_memmovelstrcpylua_isstring.lua_pushboolean.lua_pushnumber.lua_pushstring.lua_remove.lua_setfield.lua_settable.lua_tolstring.
String ID: $ (Source = $ (Temporary filename = $ -> $%WindowsFolder%$%s%s%s$%s%s%s$Archive file rollback: $Backup existing file: $Conditions not met$Existing file overwrite setting$Existing file protected$File Backup$File in use: $Install archive file on reboot: $MSG_FILE_EXISTS_ANY$MSG_FILE_EXISTS_INUSE$MSG_FILE_EXISTS_NEWER$MSG_FILE_EXISTS_RETRY$MSG_FILE_OVERWRITE_CONFIRM$MSG_NOTICE$Rename$\WININIT.INI$_BackupFolder$_NeedsReboot$suf
API String ID: 2557053154-113856596
Opcode ID: 48647e8b7170630651c0aa81596e7be06ffa89b39cf9db55876972c8941b1872
Instruction ID: 48a4e17a3933be2d80fa469476d7b5e5f718224a2ecb3c2eb4efe231d4973dd2
Opcode Fuzzy Hash: 48647e8b7170630651c0aa81596e7be06ffa89b39cf9db55876972c8941b1872
Instruction Fuzzy Hash: F9925D70A002189FDB26EBA5CC51AADB7BDAF05318F4041DEF159A7292CB785F80CF65

Uniqueness

Uniqueness Score: -1.00%

Function 004D720B Relevance: 64.8, APIs: 43, Instructions: 304
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3.LIBCMT ref: 004D7212
GetSysColor.USER32(00000016), ref: 004D7221
GetSysColor.USER32(0000000F), ref: 004D722E
GetSysColor.USER32(00000015), ref: 004D7241
GetSysColor.USER32(0000000F), ref: 004D7249
GetDeviceCaps.GDI32(?,0000000C), ref: 004D726F
GetSysColor.USER32(0000000F), ref: 004D727D
GetSysColor.USER32(00000010), ref: 004D7287
GetSysColor.USER32(00000015), ref: 004D7291
GetSysColor.USER32(00000016), ref: 004D729B
GetSysColor.USER32(00000014), ref: 004D72A5
GetSysColor.USER32(00000012), ref: 004D72AF
GetSysColor.USER32(00000011), ref: 004D72B9
GetSysColor.USER32(00000006), ref: 004D72C0
GetSysColor.USER32(0000000D), ref: 004D72C7
GetSysColor.USER32(0000000E), ref: 004D72CE
GetSysColor.USER32(00000005), ref: 004D72D5
GetSysColor.USER32(00000008), ref: 004D72DF
GetSysColor.USER32(00000009), ref: 004D72E6
GetSysColor.USER32(00000007), ref: 004D72ED
GetSysColor.USER32(00000002), ref: 004D72F4
GetSysColor.USER32(00000003), ref: 004D72FB
GetSysColor.USER32(0000001B), ref: 004D7302
GetSysColor.USER32(0000001C), ref: 004D730C
GetSysColor.USER32(0000000A), ref: 004D7316
GetSysColor.USER32(0000000B), ref: 004D7320
GetSysColor.USER32(00000013), ref: 004D732A
GetSysColor.USER32(0000001A), ref: 004D7344
GetSysColorBrush.USER32(00000010), ref: 004D735F
GetSysColorBrush.USER32(00000014), ref: 004D7376
GetSysColorBrush.USER32(00000005), ref: 004D7388
CreateSolidBrush.GDI32(?), ref: 004D73AC
CreateSolidBrush.GDI32(?), ref: 004D73C8
CreateSolidBrush.GDI32(?), ref: 004D73E4
CreateSolidBrush.GDI32(?), ref: 004D7400
CreateSolidBrush.GDI32(?), ref: 004D741C
CreateSolidBrush.GDI32(?), ref: 004D7438
CreateSolidBrush.GDI32(?), ref: 004D7454
CreatePen.GDI32(00000000,00000001,00000000), ref: 004D747D
CreatePen.GDI32(00000000,00000001,00000000), ref: 004D74A0
CreatePen.GDI32(00000000,00000001,00000000), ref: 004D74C3
CreateSolidBrush.GDI32(?), ref: 004D7547
CreatePatternBrush.GDI32(00000000), ref: 004D7588

Part of subcall function 004B7F10: DeleteObject.GDI32(00000000), ref: 004B7F1F

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: Color$BrushCreate$Solid$CapsDeleteDeviceH_prolog3ObjectPattern
String ID:
API String ID: 3754413814-0
Opcode ID: 78787f3655faeb4413d688779a0f1af4147f5aa6aaff11e147570f6b1f99c44f
Instruction ID: 5a7851490d64099118b5ebcb44374de2ec153e31cf57f48783afeef94ba797fc
Opcode Fuzzy Hash: 78787f3655faeb4413d688779a0f1af4147f5aa6aaff11e147570f6b1f99c44f
Instruction Fuzzy Hash: 08B17070904B459ED734EF76CC96BEBBBE5AF80300F00492EE19786691EB79A504DF24

Uniqueness

Uniqueness Score: -1.00%

Function 0041A0B2 Relevance: 58.5, APIs: 1, Strings: 32, Instructions: 720
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3.LIBCMT ref: 0041A0B9

Part of subcall function 00401BAB: __EH_prolog3.LIBCMT ref: 00401BB2

Part of subcall function 00409E02: ConvertStringSidToSidA.ADVAPI32(?,?), ref: 00409E19
Part of subcall function 00409E02: LookupAccountSidA.ADVAPI32(00000000,?,00000000,?,00000000,?,?), ref: 00409E44
Part of subcall function 00409E02: GetLastError.KERNEL32 ref: 00409E46
Part of subcall function 00409E02: _malloc.LIBCMT ref: 00409E62
Part of subcall function 00409E02: _malloc.LIBCMT ref: 00409E6C
Part of subcall function 00409E02: _memset.LIBCMT ref: 00409E83
Part of subcall function 00409E02: _memset.LIBCMT ref: 00409E8F
Part of subcall function 00409E02: LookupAccountSidA.ADVAPI32(00000000,?,00000000,00000000,00000000,00000000,?), ref: 00409EAB
Part of subcall function 00409E02: _free.LIBCMT ref: 00409ED0
Part of subcall function 00409E02: _free.LIBCMT ref: 00409EDF
Part of subcall function 00409E02: LocalFree.KERNEL32(?), ref: 00409EFA

Part of subcall function 0041DD58: __EH_prolog3_GS.LIBCMT ref: 0041DD62

Part of subcall function 004014A6: _memcpy_s.LIBCMT ref: 004014F6

Part of subcall function 0041DD58: __splitpath_s.LIBCMT ref: 0041DEB0
Part of subcall function 0041DD58: _strlen.LIBCMT ref: 0041DEBC

Part of subcall function 00445632: __EH_prolog3.LIBCMT ref: 00445639

Part of subcall function 00445F5E: __EH_prolog3.LIBCMT ref: 00445F65

Strings

%StartupFolder%, xrefs: 0041A803
Users, xrefs: 0041A1BC
My Video, xrefs: 0041A627
%LaunchUserMyPicturesFolder%, xrefs: 0041A5FD, 0041A8A3
%LaunchUserDesktopFolder%, xrefs: 0041A303, 0041A70B
%s\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders, xrefs: 0041A194
%LaunchUserApplicationDataFolder%, xrefs: 0041A284, 0041A6C2
%MyVideosFolder%, xrefs: 0041A8CF
%LaunchUserStartProgramsFolder%, xrefs: 0041A401, 0041A793
Personal, xrefs: 0041A32D
!, xrefs: 0041A8EC
Startup, xrefs: 0041A4AA
Desktop, xrefs: 0041A2AE
%ApplicationDataFolder%, xrefs: 0041A6AA
%LaunchUserDomain%, xrefs: 0041A158
%LaunchUserStartupFolder%, xrefs: 0041A4FF, 0041A81B
My Music, xrefs: 0041A529
%LaunchUserName%, xrefs: 0041A11E
Programs, xrefs: 0041A3AC
%StartFolder%, xrefs: 0041A7BF
%MyDocumentsFolder%, xrefs: 0041A737
Start Menu, xrefs: 0041A42B
%LaunchUserMyMusicFolder%, xrefs: 0041A57E, 0041A85F
%LaunchUserMyDocumentsFolder%, xrefs: 0041A382, 0041A74F
AppData, xrefs: 0041A22F
%MyPicturesFolder%, xrefs: 0041A88B
%LaunchUserMyVideosFolder%, xrefs: 0041A678, 0041A8E7
%LaunchUserStartFolder%, xrefs: 0041A480, 0041A7D7
My Pictures, xrefs: 0041A5A8
%StartProgramsFolder%, xrefs: 0041A77B
%DesktopFolder%, xrefs: 0041A6F3
%MyMusicFolder%, xrefs: 0041A847

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: H_prolog3$AccountLookup_free_malloc_memset$ConvertErrorFreeH_prolog3_LastLocalString__splitpath_s_memcpy_s_strlen
String ID: !$%ApplicationDataFolder%$%DesktopFolder%$%LaunchUserApplicationDataFolder%$%LaunchUserDesktopFolder%$%LaunchUserDomain%$%LaunchUserMyDocumentsFolder%$%LaunchUserMyMusicFolder%$%LaunchUserMyPicturesFolder%$%LaunchUserMyVideosFolder%$%LaunchUserName%$%LaunchUserStartFolder%$%LaunchUserStartProgramsFolder%$%LaunchUserStartupFolder%$%MyDocumentsFolder%$%MyMusicFolder%$%MyPicturesFolder%$%MyVideosFolder%$%StartFolder%$%StartProgramsFolder%$%StartupFolder%$%s\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders$AppData$Desktop$My Music$My Pictures$My Video$Personal$Programs$Start Menu$Startup$Users
API String ID: 3940958275-2356433915
Opcode ID: a5357e24b258e595108c0aad8c6c260a0065b39adcc0ebefec3cbdb5f7a5287f
Instruction ID: b5d2882960390890bb3e755470848708f13eb2ab17b8d508fdffdd65389ace15
Opcode Fuzzy Hash: a5357e24b258e595108c0aad8c6c260a0065b39adcc0ebefec3cbdb5f7a5287f
Instruction Fuzzy Hash: 6F42A2B0D11248ABDF04EBE9C952ADEBBB9AF45318F14015EF015732D2CB781E05CB6A

Uniqueness

Uniqueness Score: -1.00%

Function 005216C9 Relevance: 40.7, APIs: 22, Strings: 1, Instructions: 421
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3.LIBCMT ref: 005216D3
LoadImageW.USER32(00000000,?,00000000,00000000,00000000,00002000), ref: 00521895
GetObjectA.GDI32(00000082,00000018,?), ref: 005218A7
CreateCompatibleDC.GDI32(00000000), ref: 005218F9
GetObjectA.GDI32(00000082,00000018,?), ref: 00521914
SelectObject.GDI32(?,00000082), ref: 00521928
CreateCompatibleBitmap.GDI32(?,?,?), ref: 0052194C
SelectObject.GDI32(?,00000000), ref: 0052195F
CreateCompatibleDC.GDI32(?), ref: 00521975
SelectObject.GDI32(?,?), ref: 0052198A
SelectObject.GDI32(?,00000000), ref: 00521999
DeleteObject.GDI32(?), ref: 0052199E
BitBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,00CC0020), ref: 005219BE
GetPixel.GDI32(?,?,?), ref: 005219DD
SetPixel.GDI32(?,?,?,00000000), ref: 00521A13
SelectObject.GDI32(?,?), ref: 00521A35
SelectObject.GDI32(?,00000000), ref: 00521A3D
DeleteObject.GDI32(00000082), ref: 00521A42
DeleteObject.GDI32(00000082), ref: 00521A74
__EH_prolog3.LIBCMT ref: 00521AA8
CreateCompatibleDC.GDI32(00000000), ref: 00521B73
CreateCompatibleDC.GDI32(00000000), ref: 00521B7F

Strings

, xrefs: 005218AD

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: Object$Select$CompatibleCreate$Delete$H_prolog3Pixel$BitmapImageLoad
String ID:
API String ID: 1197801157-3916222277
Opcode ID: 16c418f635b7997d422461bb1109cad39f8a5bab48b5cba29466cf8432ef0e31
Instruction ID: b9e0d0b840771250a26158187debf6a9cc37814855b68089529b1d60e3d0ddd7
Opcode Fuzzy Hash: 16c418f635b7997d422461bb1109cad39f8a5bab48b5cba29466cf8432ef0e31
Instruction Fuzzy Hash: 9F0257B0C01629DFCF15DFA4D884AEEBFB6FF59700F10816AE805AA296D7704941CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 004445C9 Relevance: 36.9, APIs: 17, Strings: 4, Instructions: 198
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32(00000000,?,00000000), ref: 004445EE
GetModuleFileNameA.KERNEL32(00000000,00000000,00000104,00000104,00000000,?,00000000), ref: 00444609

Part of subcall function 00405435: _strnlen.LIBCMT ref: 0040544E

LoadLibraryA.KERNEL32(Kernel32.dll,00000000,?,00000000), ref: 00444641
GetProcAddress.KERNEL32(00000000,QueryFullProcessImageNameA), ref: 00444660
OpenProcess.KERNEL32(00001000,00000000,?,?,00000000), ref: 00444679
_memset.LIBCMT ref: 0044469C
QueryFullProcessImageNameA.KERNEL32(?,00000000,?,?,00000000), ref: 004446BF

Strings

System, xrefs: 00444724
System Idle Process, xrefs: 00444718
QueryFullProcessImageNameA, xrefs: 0044465A
Kernel32.dll, xrefs: 0044463C

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: Process$Name$AddressCurrentFileFullImageLibraryLoadModuleOpenProcQuery_memset_strnlen
String ID: Kernel32.dll$QueryFullProcessImageNameA$System$System Idle Process
API String ID: 2485872015-1946616455
Opcode ID: 6b093323826ac006c3ceb908b3be76456bd45cabf645229688d3930e6abbe1cb
Instruction ID: a02533f0275960e48d2c5a4f9e025311784f07c53599bab7754c0fdaecda7c4d
Opcode Fuzzy Hash: 6b093323826ac006c3ceb908b3be76456bd45cabf645229688d3930e6abbe1cb
Instruction Fuzzy Hash: B6719175900129ABEB20AF60CC89BAEBBB9EB45355F1001A7F509E2150DB7C5E81CF55

Uniqueness

Uniqueness Score: -1.00%

Function 00472F83 Relevance: 31.8, APIs: 16, Strings: 2, Instructions: 273
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3.LIBCMT ref: 00472F8A

Part of subcall function 00459443: lua_getfield.LUA5.1(?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459455
Part of subcall function 00459443: lua_pushstring.LUA5.1(?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459460
Part of subcall function 00459443: lua_gettable.LUA5.1(?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459468
Part of subcall function 00459443: lua_remove.LUA5.1(?,000000FE,?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459470
Part of subcall function 00459443: lua_type.LUA5.1(?,000000FF,?,000000FE,?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459478
Part of subcall function 00459443: lua_pcall.LUA5.1(?,00000000,00000000,00000000), ref: 0045948B
Part of subcall function 00459443: lua_remove.LUA5.1(?,000000FF), ref: 0045949A

Part of subcall function 004597A0: __EH_prolog3.LIBCMT ref: 004597A7
Part of subcall function 004597A0: lua_gettop.LUA5.1(?,00000000,00000000,00000008,004076D1,?,00000002,?), ref: 004597D3

Part of subcall function 00459852: __EH_prolog3.LIBCMT ref: 00459859
Part of subcall function 00459852: lua_tolstring.LUA5.1(?,?,00000000,00000000,00000000,0000000C,004082AF,?,00000002,?,00000001,?,00000002), ref: 0045988A

Part of subcall function 00401BAB: __EH_prolog3.LIBCMT ref: 00401BB2

Part of subcall function 0045974C: __EH_prolog3.LIBCMT ref: 00459753

lua_type.LUA5.1(?,00000002), ref: 0047300F
lua_type.LUA5.1(?,00000003), ref: 00473045
lua_type.LUA5.1(?,00000004), ref: 00473073
lua_type.LUA5.1(?,?,?,?,?,?,?,?,?,?,00000078), ref: 004730DA
lua_type.LUA5.1(?,00000006,?,?,?,?,?,?,?,?,00000078), ref: 004730FF
lua_type.LUA5.1(?,00000006,?,?,?,?,?,?,?,?,00000078), ref: 0047310D

Part of subcall function 004019B2: _strlen.LIBCMT ref: 004019C2

_memset.LIBCMT ref: 00473142
ShellExecuteEx.SHELL32(?), ref: 00473189
TranslateMessage.USER32(?), ref: 004731B8
DispatchMessageA.USER32(?), ref: 004731C2
PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 004731D3
MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000004FF), ref: 004731E8
GetExitCodeProcess.KERNEL32(?,00000000), ref: 00473204
CloseHandle.KERNEL32(?,?,?), ref: 00473220
lua_pushnumber.LUA5.1(?,?,?,?,?), ref: 00473243

Strings

@, xrefs: 00473157
open, xrefs: 00472FFB

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: lua_type.$H_prolog3$Message$lua_remove.$CloseCodeDispatchExecuteExitHandleMultipleObjectsPeekProcessShellTranslateWait_memset_strlenlua_getfield.lua_gettable.lua_gettop.lua_pcall.lua_pushnumber.lua_pushstring.lua_tolstring.
String ID: @$open
API String ID: 1748809283-267353779
Opcode ID: 69cb91ca6aa18d53d3b9747b94d441df8d28cbc87f33bb7bc4226c01ec9e5028
Instruction ID: 000cf7223813bef519a688619f11619f6c4dccf32749e9755a5d4d205109e549
Opcode Fuzzy Hash: 69cb91ca6aa18d53d3b9747b94d441df8d28cbc87f33bb7bc4226c01ec9e5028
Instruction Fuzzy Hash: 5C91C472D042099FDB14EFA5CC46BEE77B8EF05325F24412FF114B62D2DA386A448B69

Uniqueness

Uniqueness Score: -1.00%

Function 004BB78B Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 191
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004B87F6: GetWindowLongA.USER32(?,000000F0), ref: 004B8801

GetParent.USER32(?), ref: 004BB7C5
SendMessageA.USER32(00000000,0000036B,00000000,00000000), ref: 004BB7E6
GetWindowRect.USER32(?,?), ref: 004BB805
GetWindowLongA.USER32(00000000,000000F0), ref: 004BB837
MonitorFromWindow.USER32(00000000,00000001), ref: 004BB86B
GetMonitorInfoA.USER32(00000000), ref: 004BB872
CopyRect.USER32(?,?), ref: 004BB886
CopyRect.USER32(?,?), ref: 004BB890
GetWindowRect.USER32(00000000,?), ref: 004BB899
MonitorFromWindow.USER32(00000000,00000002), ref: 004BB8A6
GetMonitorInfoA.USER32(00000000), ref: 004BB8AD
CopyRect.USER32(?,?), ref: 004BB8BB

Strings

(, xrefs: 004BB84D

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: Window$Rect$Monitor$Copy$FromInfoLong$MessageParentSend
String ID: (
API String ID: 783970248-3887548279
Opcode ID: 2e206c960bff76c65d011af9281d4477af9f095c375483303fdf7989cd3c9211
Instruction ID: 0526c366f56fd67939eef59efbbfee4d572cc4f5001d7726c902ecad3bd9f23d
Opcode Fuzzy Hash: 2e206c960bff76c65d011af9281d4477af9f095c375483303fdf7989cd3c9211
Instruction Fuzzy Hash: 246105B1E10229ABCB11DFA9CD88AEEBBBDFF48710F145116E505B3650DB74A901CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0044C87A Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 170
windowstringprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 0044C8DD
_memset.LIBCMT ref: 0044C8EC
lstrlen.KERNEL32(?,?,?,00000000), ref: 0044C950
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,00000000), ref: 0044C993
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,?,?,?), ref: 0044C9C2
GetLastError.KERNEL32(?,?,?,?,?,?,?,00000000), ref: 0044C9CC
TranslateMessage.USER32(?), ref: 0044CA2A
DispatchMessageA.USER32(?), ref: 0044CA37
PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 0044CA48
MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000004FF), ref: 0044CA62
GetExitCodeProcess.KERNEL32(?,?), ref: 0044CA7C
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00000000), ref: 0044CA8E
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00000000), ref: 0044CA96

Strings

"%s" %s, xrefs: 0044C97A

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: Message$CloseHandleProcess_memsetlstrlen$CodeCreateDispatchErrorExitLastMultipleObjectsPeekTranslateWait
String ID: "%s" %s
API String ID: 2044587009-1070868581
Opcode ID: c0cc0c49a236f5ded0ea8b06f0b4c4182e01ed3215f27af4462474b041b00ea4
Instruction ID: 35c82a5213f9f35a52ecf7f5653f6d96b4d14db4d77b397bd2bc0d4724070ad4
Opcode Fuzzy Hash: c0cc0c49a236f5ded0ea8b06f0b4c4182e01ed3215f27af4462474b041b00ea4
Instruction Fuzzy Hash: 4851717195222DABDB619F64CC88BEBBB78EF04710F140197B509E2161DB344E80CF94

Uniqueness

Uniqueness Score: -1.00%

Function 0041D295 Relevance: 23.0, APIs: 8, Strings: 5, Instructions: 251windowstringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0041D328
MessageBoxA.USER32(00000000,?,026282D8,00000010), ref: 0041D38E
_malloc.LIBCMT ref: 0041D3F4
lstrcpy.KERNEL32(?,?), ref: 0041D4F4
lstrcat.KERNEL32(?,?), ref: 0041D508
MessageBoxA.USER32(00000000,?,ERROR,00000010), ref: 0041D426

Part of subcall function 00401BAB: __EH_prolog3.LIBCMT ref: 00401BB2

MessageBoxA.USER32(00000000,?,?,00000000), ref: 0041D652
_free.LIBCMT ref: 0041D696

Strings

Unable to open archive file, xrefs: 0041D350
Unable to open archive file: %d, xrefs: 0041D367
ERROR, xrefs: 0041D416
Unable to allocate memory buffer, xrefs: 0041D404
Error in compressed file - Bad CRCOriginal: %dCalculated: %d, xrefs: 0041D635

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: Message$H_prolog3_free_malloc_memsetlstrcatlstrcpy
String ID: ERROR$Error in compressed file - Bad CRCOriginal: %dCalculated: %d$Unable to allocate memory buffer$Unable to open archive file$Unable to open archive file: %d
API String ID: 2051063334-2979399668
Opcode ID: 3d88c7f2ae69a968be2d778677e82cc7cc4de5c7527dc46d7acb9f94a65af994
Instruction ID: 228f271a15597c2f46b9f19d639ac7bbf06cb629f60768003966d6c7016263ec
Opcode Fuzzy Hash: 3d88c7f2ae69a968be2d778677e82cc7cc4de5c7527dc46d7acb9f94a65af994
Instruction Fuzzy Hash: 8DB128B1900228DFDB20DB64CD45EDDB7B4AB98318F1085DAF499B2282DBB45AE4CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0042736F Relevance: 21.3, APIs: 8, Strings: 4, Instructions: 268fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0040C75B: __EH_prolog3.LIBCMT ref: 0040C762

Part of subcall function 0043A00F: __EH_prolog3.LIBCMT ref: 0043A016

_strlen.LIBCMT ref: 00427430

Part of subcall function 00403C07: _strnlen.LIBCMT ref: 00403C37
Part of subcall function 00403C07: _memcpy_s.LIBCMT ref: 00403C6B

DeleteFileA.KERNEL32(?,?,?,\irsetup.skin,00000000,?), ref: 00427451
GetLastError.KERNEL32(00000000), ref: 00427490

Part of subcall function 0040C75B: _strlen.LIBCMT ref: 0040C79F

GetFileAttributesA.KERNEL32(00000001,?,?,?,00000000,00000001,00000000), ref: 004275BD
DeleteFileA.KERNEL32(00000001,?,?,?,00000000,00000001,00000000), ref: 004275CB

Part of subcall function 00401BAB: __EH_prolog3.LIBCMT ref: 00401BB2

Part of subcall function 00405AB7: __mbsinc.LIBCMT ref: 00405AF2

Strings

Delete skin file: , xrefs: 0042745D
Delete plugin file: , xrefs: 004276D7, 0042770C
\irsetup.skin, xrefs: 0042742A, 0042742F, 00427437, 00427499
Delete primer file: , xrefs: 004274FF, 004275D7

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: FileH_prolog3$Delete_strlen$AttributesErrorLast__mbsinc_memcpy_s_strnlen
String ID: Delete plugin file: $Delete primer file: $Delete skin file: $\irsetup.skin
API String ID: 41566659-3049212666
Opcode ID: 5a0049a2c3271468f71c39f71784d62b2d8032af1d314b8bd9f7e15357b7b5e2
Instruction ID: e1ad8fb57a85e154da548c55155deb92fce6abe91f50a8f3a994385913f67cd5
Opcode Fuzzy Hash: 5a0049a2c3271468f71c39f71784d62b2d8032af1d314b8bd9f7e15357b7b5e2
Instruction Fuzzy Hash: B2A17E719040499FDB04EBE8DC85EBE7BB9AF55324F14026EF111B72E2DA385D40CB6A

Uniqueness

Uniqueness Score: -1.00%

Function 0042D840 Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 434COMMON

Download Yara Rule

Strings

MSG_SKIPPING, xrefs: 0042D986
_SuppressUninstallDataDuplicateCheck, xrefs: 0042DA03
%s%s, xrefs: 0042E02E
MSG_INSTALLING, xrefs: 0042D951
ERR_CREATE_FOLDER, xrefs: 0042DFA0, 0042E004
INSTALL_STAGE_INSTALLING_FILES, xrefs: 0042DB5F
Install archive file: , xrefs: 0042DF22
MSG_ERROR, xrefs: 0042E05D

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID:
String ID: %s%s$ERR_CREATE_FOLDER$INSTALL_STAGE_INSTALLING_FILES$Install archive file: $MSG_ERROR$MSG_INSTALLING$MSG_SKIPPING$_SuppressUninstallDataDuplicateCheck
API String ID: 0-1397023231
Opcode ID: 6b2b4816e3fe1f59c8daa3f8d5eee16e08241a84fd2d987692c1a28bcd17f514
Instruction ID: 03ff3c82bcaaacfabcb7d7b7adf69115315a6705427eed211a3a6a666c0bcce8
Opcode Fuzzy Hash: 6b2b4816e3fe1f59c8daa3f8d5eee16e08241a84fd2d987692c1a28bcd17f514
Instruction Fuzzy Hash: D7124D70D00658DECB24DF65CC81EDEB7B5AF49318F4041EEE089A7292DAB856C0CF19

Uniqueness

Uniqueness Score: -1.00%

Function 004CC8AF Relevance: 19.7, APIs: 13, Instructions: 168filetimeCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(?,?,?), ref: 004CC8F9
GetLastError.KERNEL32(?,?,?), ref: 004CC90A
SetFileAttributesA.KERNEL32(?,?,?,?), ref: 004CC933
GetLastError.KERNEL32(?,?,?), ref: 004CC93E
CreateFileA.KERNEL32(?,C0000000,00000001,00000000,00000003,00000080,00000000,?,?), ref: 004CC9BC
GetLastError.KERNEL32(?,?,?), ref: 004CC9CA
SetFileTime.KERNEL32(00000000,?,?,?,?,?), ref: 004CC9DF
GetLastError.KERNEL32(?,?), ref: 004CC9EF
CloseHandle.KERNEL32(00000000,?,?), ref: 004CC9F9
CloseHandle.KERNEL32(00000000,?,?), ref: 004CCA05

Part of subcall function 004CC5B9: GetModuleHandleA.KERNEL32(kernel32.dll,0000000C,?,004CC6FC,00450998,00000000,0067C48C,0000002E,00450998,00000000,?,?,-00000010,0067C48C,000000FF), ref: 004CC5CB
Part of subcall function 004CC5B9: GetProcAddress.KERNEL32(00000000,GetFileAttributesTransactedA), ref: 004CC5DB

GetLastError.KERNEL32(?,?,?), ref: 004CCA0C
SetFileAttributesA.KERNEL32(?,?,?,?), ref: 004CCA3B
GetLastError.KERNEL32(?,?,?), ref: 004CCA46

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: ErrorLast$File$AttributesHandle$Close$AddressCreateModuleProcTime
String ID:
API String ID: 3934836844-0
Opcode ID: 9b8751c275534dc08fd078b97f0551b692b488f452cd7dc5d972a61b331c35ed
Instruction ID: 24ab066ba45105931fb556f069e2820fc17eb39e3b3e24fd6d639b2d76d4516e
Opcode Fuzzy Hash: 9b8751c275534dc08fd078b97f0551b692b488f452cd7dc5d972a61b331c35ed
Instruction Fuzzy Hash: 65515D79910204ABDB54EFB5D8C9FBE77B9AF08310B14451FF91AA2251DB38A8019B28

Uniqueness

Uniqueness Score: -1.00%

Function 00495B62 Relevance: 19.4, APIs: 1, Strings: 10, Instructions: 173COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00495B69

Part of subcall function 00401BAB: __EH_prolog3.LIBCMT ref: 00401BB2

Part of subcall function 0048CCBB: __EH_prolog3.LIBCMT ref: 0048CCC2

Part of subcall function 0048C2A0: __EH_prolog3.LIBCMT ref: 0048C2A7

Part of subcall function 004C3A0F: __EH_prolog3_catch_GS.LIBCMT ref: 004C3A19

Strings

number e_CtrlID, number e_MsgID, table e_Details, xrefs: 00495CCB
On Preload, xrefs: 00495B9C, 00495D23
On Back, xrefs: 00495BE0, 00495D33
Screen.Next();, xrefs: 00495BFE
Screen.Back();, xrefs: 00495BBD
On Cancel, xrefs: 00495C62, 00495D53
On Next, xrefs: 00495C21, 00495D43
if g_ConfirmSetupAbort() thenApplication.Exit();end, xrefs: 00495C3F
On Help, xrefs: 00495C9F, 00495CA4, 00495D63
On Ctrl Message, xrefs: 00495CE2, 00495CE7, 00495D6F

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: H_prolog3$H_prolog3_catch_
String ID: On Back$On Cancel$On Ctrl Message$On Help$On Next$On Preload$Screen.Back();$Screen.Next();$if g_ConfirmSetupAbort() thenApplication.Exit();end$number e_CtrlID, number e_MsgID, table e_Details
API String ID: 2899319929-3261342500
Opcode ID: 03d0ceb04b709f9b52de4624381557cf450ee9ced8033bd109f6557579b78b67
Instruction ID: 85f5a6a40cc4e7496d428545d972af7344d72b37c1b01569cf554b4e6e7f0580
Opcode Fuzzy Hash: 03d0ceb04b709f9b52de4624381557cf450ee9ced8033bd109f6557579b78b67
Instruction Fuzzy Hash: 02516370E11205AACF04FFA9C993EDDBAB59F49714F10855EF015732D1DB782F048AAA

Uniqueness

Uniqueness Score: -1.00%

Function 00409E02 Relevance: 18.1, APIs: 12, Instructions: 101COMMON

Download Yara Rule

APIs

ConvertStringSidToSidA.ADVAPI32(?,?), ref: 00409E19
LookupAccountSidA.ADVAPI32(00000000,?,00000000,?,00000000,?,?), ref: 00409E44
GetLastError.KERNEL32 ref: 00409E46
_malloc.LIBCMT ref: 00409E62

Part of subcall function 005B4B83: __FF_MSGBANNER.LIBCMT ref: 005B4B9C
Part of subcall function 005B4B83: __NMSG_WRITE.LIBCMT ref: 005B4BA3
Part of subcall function 005B4B83: RtlAllocateHeap.NTDLL(00000000,00000001,00000001), ref: 005B4BC8

_malloc.LIBCMT ref: 00409E6C
_memset.LIBCMT ref: 00409E83
_memset.LIBCMT ref: 00409E8F
LookupAccountSidA.ADVAPI32(00000000,?,00000000,00000000,00000000,00000000,?), ref: 00409EAB
_free.LIBCMT ref: 00409ED0
_free.LIBCMT ref: 00409EDF
GetLastError.KERNEL32 ref: 00409EE7
LocalFree.KERNEL32(?), ref: 00409EFA

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: AccountErrorLastLookup_free_malloc_memset$AllocateConvertFreeHeapLocalString
String ID:
API String ID: 2640322024-0
Opcode ID: 5ea395a3e36f9e9e05fc0fa55426daa0ca483c7ef0d141acad7c5a1c92f1767b
Instruction ID: a0d2c250bb39911456f383e9fe37b1c20b5463b8f4ad8ceab07637e08fc4b812
Opcode Fuzzy Hash: 5ea395a3e36f9e9e05fc0fa55426daa0ca483c7ef0d141acad7c5a1c92f1767b
Instruction Fuzzy Hash: 173133B680011ABBCF12AFA1DC848EEBFBDFF44750B204466F904A2192D7319E41DBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00427AB9 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 263COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00427AC3

Part of subcall function 0040C62C: __mbsinc.LIBCMT ref: 0040C654

Part of subcall function 0041E239: __mbsinc.LIBCMT ref: 0041E25A

_strlen.LIBCMT ref: 00427B05

Part of subcall function 00403C07: _strnlen.LIBCMT ref: 00403C37
Part of subcall function 00403C07: _memcpy_s.LIBCMT ref: 00403C6B

GetCurrentDirectoryA.KERNEL32(00000104,?,00698DAC,00000000,0000005C), ref: 00427B22
_memset.LIBCMT ref: 00427B3D
SetCurrentDirectoryA.KERNEL32(?), ref: 00427BB9
SetCurrentDirectoryA.KERNEL32(?,00698DAC,00000002,0069C3B4,?,00000002), ref: 00427D7C
CreateDirectoryA.KERNEL32(?,00000000), ref: 00427D92

Part of subcall function 0040C75B: _strlen.LIBCMT ref: 0040C79F

CreateDirectoryA.KERNEL32(?,00000000), ref: 00427BCF

Part of subcall function 0040C75B: __EH_prolog3.LIBCMT ref: 0040C762

Part of subcall function 0043A00F: __EH_prolog3.LIBCMT ref: 0043A016

SetCurrentDirectoryA.KERNEL32(?), ref: 00427E96

Strings

Create folder: , xrefs: 00427B7D, 00427C2D, 00427C67, 00427D25, 00427DF0, 00427E2A

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: Directory$Current$CreateH_prolog3__mbsinc_strlen$H_prolog3__memcpy_s_memset_strnlen
String ID: Create folder:
API String ID: 589701281-1628409573
Opcode ID: d95adbabc404d7e64d32e594425b69f5a45ddbd51dd9ab267e7ab12384eaaea4
Instruction ID: e36bac802864067c2d9b8f7b26585984129ea439d9d0ff545939566fe11bde49
Opcode Fuzzy Hash: d95adbabc404d7e64d32e594425b69f5a45ddbd51dd9ab267e7ab12384eaaea4
Instruction Fuzzy Hash: 05B19171A0011CAFCB24EBA5DC89BEE7779AF15314F4001EAE10967291DB386E85CF69

Uniqueness

Uniqueness Score: -1.00%

Function 004D2C55 Relevance: 16.6, APIs: 11, Instructions: 106memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlEnterCriticalSection.NTDLL(0000001C), ref: 004D2C68
GlobalAlloc.KERNEL32(00000002,00000000,?,?,?,00000000,00000000,?,004D3093,00000004,004C3271,004B4C78,004B55B9,0040192B,?), ref: 004D2CBE
GlobalHandle.KERNEL32(?), ref: 004D2CC7
GlobalUnWire.KERNEL32(00000000), ref: 004D2CD1
GlobalReAlloc.KERNEL32(?,00000000,00002002), ref: 004D2CEA
GlobalHandle.KERNEL32(?), ref: 004D2CFC
GlobalFix.KERNEL32(00000000), ref: 004D2D03
RtlLeaveCriticalSection.NTDLL(?), ref: 004D2D0C
GlobalFix.KERNEL32(00000000), ref: 004D2D18
_memset.LIBCMT ref: 004D2D32
RtlLeaveCriticalSection.NTDLL(?), ref: 004D2D60

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: Global$CriticalSection$AllocHandleLeave$EnterWire_memset
String ID:
API String ID: 9613507-0
Opcode ID: 0679316ae341752556f16bd125170ce8895d1f644be7faa857a94d0bdf51db94
Instruction ID: bdda9141ab7e882e202a32f6f1f59a44c2d9e325207c2d706d45ec3e76051b19
Opcode Fuzzy Hash: 0679316ae341752556f16bd125170ce8895d1f644be7faa857a94d0bdf51db94
Instruction Fuzzy Hash: EE31EF71604704AFD7209F68CD89A5ABBFEFF84B05B05486FE446D3A61DB74EC008B54

Uniqueness

Uniqueness Score: -1.00%

Function 00403F67 Relevance: 16.1, APIs: 3, Strings: 6, Instructions: 306windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00403F71

Part of subcall function 004174DC: __EH_prolog3.LIBCMT ref: 004174E3

Part of subcall function 005B5A3A: __waccess_s.LIBCMT ref: 005B5A45

_strlen.LIBCMT ref: 0040420F

Part of subcall function 00403C07: _strnlen.LIBCMT ref: 00403C37
Part of subcall function 00403C07: _memcpy_s.LIBCMT ref: 00403C6B

MessageBoxA.USER32(00000004,?,00000000,?), ref: 004042E3

Part of subcall function 00401BAB: __EH_prolog3.LIBCMT ref: 00401BB2

Part of subcall function 0043C227: __EH_prolog3.LIBCMT ref: 0043C22E

Part of subcall function 0043C227: __EH_prolog3.LIBCMT ref: 0043C2C6

Strings

MSG_NEW_LOCATION, xrefs: 0040405B
%s%s, xrefs: 00404289
MSG_ASK_FOR_DISK, xrefs: 00404089
ERR_WRONG_DISK, xrefs: 00404265
%s %d. %s, xrefs: 004040AD
MSG_ERROR, xrefs: 004042BE

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: H_prolog3$Message__waccess_s_memcpy_s_strlen_strnlen
String ID: %s%s$%s %d. %s$ERR_WRONG_DISK$MSG_ASK_FOR_DISK$MSG_ERROR$MSG_NEW_LOCATION
API String ID: 3414207875-2309438953
Opcode ID: 7eaaa0701f7c619a911f5e60caa3b119e50061a95c3eb329e4b0700a4bfa0a1c
Instruction ID: 4409bf8b29afb032833091567734ab4e1fb510bfcd76155e5a94485c31c37759
Opcode Fuzzy Hash: 7eaaa0701f7c619a911f5e60caa3b119e50061a95c3eb329e4b0700a4bfa0a1c
Instruction Fuzzy Hash: A5C17270900149DBCB04EBE5CC95BEEB778AF55328F14426EF125B72D2DB386A04CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00493E5A Relevance: 16.1, APIs: 1, Strings: 8, Instructions: 304COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00493E61

Part of subcall function 00495D98: __EH_prolog3.LIBCMT ref: 00495D9F

Part of subcall function 004019B2: _strlen.LIBCMT ref: 004019C2

Part of subcall function 004B3C8A: _malloc.LIBCMT ref: 004B3CA8

Part of subcall function 00401BAB: __EH_prolog3.LIBCMT ref: 00401BB2

Part of subcall function 0043A2C6: __EH_prolog3.LIBCMT ref: 0043A2CD

Part of subcall function 004AADE0: __EH_prolog3.LIBCMT ref: 004AADE7

Part of subcall function 004A26F3: __EH_prolog3_GS.LIBCMT ref: 004A26FA

Strings

IDS_CTRL_STATICTEXT_SPACEREQUIRED, xrefs: 00494158
%AppFolder%, xrefs: 00493E76
IDS_CTRL_STATICTEXT_SPACEAVAILABLE, xrefs: 004941F2
IDS_CTRL_STATICTEXT_LABEL_01, xrefs: 00493F50
IDS_CTRL_STATICTEXT_TOPINSTRUCTIONS, xrefs: 00493EBA
IDS_CTRL_BUTTON_BROWSE, xrefs: 004940C1
IDS_CTRL_EDIT_FOLDER, xrefs: 00493FEA
n, xrefs: 00493E7B

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: H_prolog3$H_prolog3__malloc_strlen
String ID: %AppFolder%$IDS_CTRL_BUTTON_BROWSE$IDS_CTRL_EDIT_FOLDER$IDS_CTRL_STATICTEXT_LABEL_01$IDS_CTRL_STATICTEXT_SPACEAVAILABLE$IDS_CTRL_STATICTEXT_SPACEREQUIRED$IDS_CTRL_STATICTEXT_TOPINSTRUCTIONS$n
API String ID: 3536593336-2937258074
Opcode ID: c2fd84cd051f2db8b813c17c40dc6cc69e324e0b74074124a4ba2014e15081dd
Instruction ID: e3f013ed91f7927fc694d6f8086a221780781eac5970542975d86febf2f687fc
Opcode Fuzzy Hash: c2fd84cd051f2db8b813c17c40dc6cc69e324e0b74074124a4ba2014e15081dd
Instruction Fuzzy Hash: E3C1B2B0900705DFCB24EFA6C492AAFBBF4BF15314F10461EE166A76D1CB786604CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0041A93E Relevance: 16.0, APIs: 1, Strings: 8, Instructions: 248COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0041A945

Part of subcall function 00445632: __EH_prolog3.LIBCMT ref: 00445639

Part of subcall function 00401BAB: __EH_prolog3.LIBCMT ref: 00401BB2

Part of subcall function 00445F5E: __EH_prolog3.LIBCMT ref: 00445F65

Part of subcall function 0041DC12: __EH_prolog3.LIBCMT ref: 0041DC19

Strings

Software\Microsoft\Shared Tools\DAO, xrefs: 0041AAD2
Software\Microsoft\Shared Tools\DAO350.dll, xrefs: 0041A9FF
%CommonFilesFolder%\Microsoft Shared\DAO, xrefs: 0041ABDA
Software\Microsoft\Shared Tools\DAO360.dll, xrefs: 0041A98F
LocalMachine, xrefs: 0041A982, 0041A9F2, 0041AA5D, 0041AAC5
Path, xrefs: 0041A99C, 0041AA0C, 0041AA77, 0041AADF
Software\Microsoft\Shared Tools\DAO350, xrefs: 0041AA6A
.DLL, xrefs: 0041AB5C

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: H_prolog3
String ID: %CommonFilesFolder%\Microsoft Shared\DAO$.DLL$LocalMachine$Path$Software\Microsoft\Shared Tools\DAO$Software\Microsoft\Shared Tools\DAO350$Software\Microsoft\Shared Tools\DAO350.dll$Software\Microsoft\Shared Tools\DAO360.dll
API String ID: 431132790-2418651373
Opcode ID: 7c87532cb145e8d55a0ccc06198c49e8409880952a807129710eb846e7b0998f
Instruction ID: 081ab0f7e7ca8fe283798c7dec49f6d0af966a49eed98f15e8d4fb4765556b11
Opcode Fuzzy Hash: 7c87532cb145e8d55a0ccc06198c49e8409880952a807129710eb846e7b0998f
Instruction Fuzzy Hash: 1E813170A40548ABEF05EBA5CC92EEF7B7D9F50708F44005EF106771D2DA781A86C6AA

Uniqueness

Uniqueness Score: -1.00%

Function 0044D704 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 78stringCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0044D70E

Part of subcall function 00401BAB: __EH_prolog3.LIBCMT ref: 00401BB2

GetFileAttributesA.KERNEL32(?), ref: 0044D73E
lstrcpy.KERNEL32(?,?), ref: 0044D757
_malloc.LIBCMT ref: 0044D77B

Part of subcall function 005B4B83: __FF_MSGBANNER.LIBCMT ref: 005B4B9C
Part of subcall function 005B4B83: __NMSG_WRITE.LIBCMT ref: 005B4BA3
Part of subcall function 005B4B83: RtlAllocateHeap.NTDLL(00000000,00000001,00000001), ref: 005B4BC8

73EE1500.VERSION(00000000,00698DAC,?,?,?,?,00000000,00000000,?,?), ref: 0044D7AF
_memmove.LIBCMT ref: 0044D7C7
_free.LIBCMT ref: 0044D7FF

Strings

%d.%d.%d.%d, xrefs: 0044D7F0

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: AllocateAttributesE1500FileH_prolog3H_prolog3_Heap_free_malloc_memmovelstrcpy
String ID: %d.%d.%d.%d
API String ID: 180271064-3491811756
Opcode ID: 12c11256bb6e408ceb6329a30832052851e5c26f8be2e7c1613ab96279c63b83
Instruction ID: ae708701a1223bbf4dc120fe5af396da4ea2dc9e1d833a5e0aa810d0715649d5
Opcode Fuzzy Hash: 12c11256bb6e408ceb6329a30832052851e5c26f8be2e7c1613ab96279c63b83
Instruction Fuzzy Hash: 6421A071801129ABCB25ABA18C49AEEB77DEF45324F0001DAB518B6291DB349E808FA4

Uniqueness

Uniqueness Score: -1.00%

Function 0049A6F5 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 224COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0049A6FC

Part of subcall function 00495D98: __EH_prolog3.LIBCMT ref: 00495D9F

Part of subcall function 004019B2: _strlen.LIBCMT ref: 004019C2

Part of subcall function 004B3C8A: _malloc.LIBCMT ref: 004B3CA8

Part of subcall function 004A87FA: __EH_prolog3.LIBCMT ref: 004A8801

Strings

IDS_CTRL_RADIOBTN_ALLUSERS, xrefs: 0049A97D
%AppShortcutFolderName%, xrefs: 0049A711
IDS_CTRL_RADIOBTN_PERUSER, xrefs: 0049A8D6
IDS_CTRL_STATICTEXT_LABEL_01, xrefs: 0049A7E8
IDS_CTRL_STATICTEXT_TOPINSTRUCTIONS, xrefs: 0049A755
s, xrefs: 0049A716

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: H_prolog3$_malloc_strlen
String ID: %AppShortcutFolderName%$IDS_CTRL_RADIOBTN_ALLUSERS$IDS_CTRL_RADIOBTN_PERUSER$IDS_CTRL_STATICTEXT_LABEL_01$IDS_CTRL_STATICTEXT_TOPINSTRUCTIONS$s
API String ID: 3824019972-717321709
Opcode ID: ce5d85e03088d3bb2759bbc9a5125e5a38c17ae4123f187580fe12927a355283
Instruction ID: 93cb703d68f60375225cd15742f9290a1099f8fd825f281d37f4b1f9cd563d93
Opcode Fuzzy Hash: ce5d85e03088d3bb2759bbc9a5125e5a38c17ae4123f187580fe12927a355283
Instruction Fuzzy Hash: A091C8B0900706EFDB04EFA6C9566AEBBB5BF45314F10431EE115A72C1CB78A610CBE6

Uniqueness

Uniqueness Score: -1.00%

Function 00464D54 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 139COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00464D5B

Part of subcall function 00459443: lua_getfield.LUA5.1(?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459455
Part of subcall function 00459443: lua_pushstring.LUA5.1(?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459460
Part of subcall function 00459443: lua_gettable.LUA5.1(?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459468
Part of subcall function 00459443: lua_remove.LUA5.1(?,000000FE,?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459470
Part of subcall function 00459443: lua_type.LUA5.1(?,000000FF,?,000000FE,?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459478
Part of subcall function 00459443: lua_pcall.LUA5.1(?,00000000,00000000,00000000), ref: 0045948B
Part of subcall function 00459443: lua_remove.LUA5.1(?,000000FF), ref: 0045949A

Part of subcall function 004597A0: __EH_prolog3.LIBCMT ref: 004597A7
Part of subcall function 004597A0: lua_gettop.LUA5.1(?,00000000,00000000,00000008,004076D1,?,00000002,?), ref: 004597D3

Part of subcall function 00459852: __EH_prolog3.LIBCMT ref: 00459859
Part of subcall function 00459852: lua_tolstring.LUA5.1(?,?,00000000,00000000,00000000,0000000C,004082AF,?,00000002,?,00000001,?,00000002), ref: 0045988A

Part of subcall function 00401BAB: __EH_prolog3.LIBCMT ref: 00401BB2

lua_type.LUA5.1(?,00000002), ref: 00464D90
lua_type.LUA5.1(?,00000003), ref: 00464DAF
lua_type.LUA5.1(?,00000004), ref: 00464DCD
lua_type.LUA5.1(?,00000005), ref: 00464DE8
lua_type.LUA5.1(?,00000005), ref: 00464DF7

Part of subcall function 00459912: __EH_prolog3.LIBCMT ref: 00459919
Part of subcall function 00459912: lua_type.LUA5.1(?,?,00000000,00000000,0000000C,00407B22,?,00000002), ref: 00459949

Strings

/, xrefs: 00464E67

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: lua_type.$H_prolog3$lua_remove.$lua_getfield.lua_gettable.lua_gettop.lua_pcall.lua_pushstring.lua_tolstring.
String ID: /
API String ID: 661224282-2043925204
Opcode ID: c533e1fc2a713c2c39f485978012ea7f4acb9ec93bb47e6310397c6ebf964237
Instruction ID: 150edf945b3eebaa46a99f48cbef2d90174abca9690b9ca8d7cd97b5654a0257
Opcode Fuzzy Hash: c533e1fc2a713c2c39f485978012ea7f4acb9ec93bb47e6310397c6ebf964237
Instruction Fuzzy Hash: DC41D671D04204EEDF14EBB9D846BEE77A4AF41328F20061FF110B72D2EB7D6A45865A

Uniqueness

Uniqueness Score: -1.00%

Function 0045366B Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 81fileCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00453672
RemoveDirectoryA.KERNEL32(?,00000000,00000000,00000014,0043899C,00000228,0040F686,?,000000BC), ref: 00453750

Part of subcall function 00405B76: __EH_prolog3.LIBCMT ref: 00405B7D

Part of subcall function 00405B76: _strlen.LIBCMT ref: 00405BB5

RemoveFontResourceA.GDI32(?), ref: 0045372E
DeleteFileA.KERNEL32(?), ref: 0045373B
DeleteFileA.KERNEL32(?), ref: 00453740

Strings

.FON, xrefs: 004536FD
.TFT, xrefs: 004536CF

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: DeleteFileH_prolog3Remove$DirectoryFontResource_strlen
String ID: .FON$.TFT
API String ID: 2487243399-300237490
Opcode ID: 16e63cc75d84feba891de720de485214b6de957ce1bc043bc2fa9e7e82f888c1
Instruction ID: 092cdb1744988c98010576193e33673522256f2603c5e68bc22b94d3eaf48bcb
Opcode Fuzzy Hash: 16e63cc75d84feba891de720de485214b6de957ce1bc043bc2fa9e7e82f888c1
Instruction Fuzzy Hash: CB318D718005099BCB05EBA5CC45AEEBB79AF15359F14425EB825733E2CB38AE04CA69

Uniqueness

Uniqueness Score: -1.00%

Function 005B9A7F Relevance: 12.1, APIs: 8, Instructions: 63threadCOMMON

Download Yara Rule

APIs

___set_flsgetvalue.LIBCMT ref: 005B9AA4
__calloc_crt.LIBCMT ref: 005B9AB0
__getptd.LIBCMT ref: 005B9ABD
__initptd.LIBCMT ref: 005B9AC6
CreateThread.KERNEL32(?,?,005B9A1A,00000000,?,?), ref: 005B9AF4
GetLastError.KERNEL32(?,?,?,?,?,00000000), ref: 005B9AFE
_free.LIBCMT ref: 005B9B07
__dosmaperr.LIBCMT ref: 005B9B12

Part of subcall function 005B7892: __getptd_noexit.LIBCMT ref: 005B7892

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: CreateErrorLastThread___set_flsgetvalue__calloc_crt__dosmaperr__getptd__getptd_noexit__initptd_free
String ID:
API String ID: 73303432-0
Opcode ID: f6d73320a4a997c0cf6abfa75236e6c0e1d8930e124af24a74071945eaf97dd7
Instruction ID: c680e988b2079c9518bbc0e0ec402a995a09aee03cc3f693acd20eed8ee7fb06
Opcode Fuzzy Hash: f6d73320a4a997c0cf6abfa75236e6c0e1d8930e124af24a74071945eaf97dd7
Instruction Fuzzy Hash: 7611E93220871BAFDB106FA4AC45DDB3FDCFF857207204429FA1496192DB71E8018661

Uniqueness

Uniqueness Score: -1.00%

Function 0040473E Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 170COMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 00404748
_memset.LIBCMT ref: 00404872
_memset.LIBCMT ref: 00404886
_memset.LIBCMT ref: 0040489A
__splitpath_s.LIBCMT ref: 004048C0

Strings

%s%s%s.%d, xrefs: 004048E6

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: _memset$H_prolog3_catch___splitpath_s
String ID: %s%s%s.%d
API String ID: 83545884-4241988911
Opcode ID: 6db399e40d94167b5f76db3a03996689f83ec81fc52a925b94aaf317d22f42df
Instruction ID: 7669b8512aeb4f9363ae219213a47c3523ac02e2487f9f431b7658d0081f10e9
Opcode Fuzzy Hash: 6db399e40d94167b5f76db3a03996689f83ec81fc52a925b94aaf317d22f42df
Instruction Fuzzy Hash: 936150B19002189FCB25DF64C891AEEB7FDAF88314F4041AEE149A7291DA346F85CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0044CBB0 Relevance: 10.6, APIs: 7, Instructions: 137COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0044CBBA

Part of subcall function 0040C62C: __mbsinc.LIBCMT ref: 0040C654

Part of subcall function 00405AB7: __mbsinc.LIBCMT ref: 00405AF2

_strlen.LIBCMT ref: 0044CBF9

Part of subcall function 00403C07: _strnlen.LIBCMT ref: 00403C37
Part of subcall function 00403C07: _memcpy_s.LIBCMT ref: 00403C6B

_memset.LIBCMT ref: 0044CC23
SetCurrentDirectoryA.KERNEL32(?), ref: 0044CC8D
CreateDirectoryA.KERNEL32(?,00000000), ref: 0044CC9F
SetCurrentDirectoryA.KERNEL32(?,00698DAC,00000002,0069C3B4,?,00000002), ref: 0044CD43
CreateDirectoryA.KERNEL32(?,00000000), ref: 0044CD55

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: Directory$CreateCurrent__mbsinc$H_prolog3__memcpy_s_memset_strlen_strnlen
String ID:
API String ID: 1898474234-0
Opcode ID: 648d565589500e37cef12648dbb973db257b38290444c3116088d2213bbdecf0
Instruction ID: 2ffcec387168d17eea4a58c53a9f2b9464b6a28545e6cc168bbda13fdaa225ff
Opcode Fuzzy Hash: 648d565589500e37cef12648dbb973db257b38290444c3116088d2213bbdecf0
Instruction Fuzzy Hash: 4051F67190211C9BDB64EF64C8C57DE7B68AF05314F0841BBE909A7181DA385E85CFD9

Uniqueness

Uniqueness Score: -1.00%

Function 00406EB6 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 98COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00406EBD
_strlen.LIBCMT ref: 00406F7A
IsWindow.USER32(?), ref: 00406FB7
RedrawWindow.USER32(?,00000000,00000000,00000105,00000005), ref: 00407000

Part of subcall function 004B3C8A: _malloc.LIBCMT ref: 004B3CA8

Strings

Initializing..., xrefs: 00406F74, 00406F79, 00406F81
MSG_INITIALIZING, xrefs: 00406F2A, 00406F2F, 00406F67

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: Window$H_prolog3Redraw_malloc_strlen
String ID: Initializing...$MSG_INITIALIZING
API String ID: 512199714-1400418863
Opcode ID: 2a4533297e1625ecd4f8429cefe7469d283ee11d23029efe19a3f03ff0893d25
Instruction ID: 5e34b494389515830c364dcee42ac08a1b17245997bafec3f24aeab52446d33b
Opcode Fuzzy Hash: 2a4533297e1625ecd4f8429cefe7469d283ee11d23029efe19a3f03ff0893d25
Instruction Fuzzy Hash: 1731AD719047069BDB24EBB4C951BAF77B9EF40318F10062EB16BA72D2DA386900CB25

Uniqueness

Uniqueness Score: -1.00%

Function 0044C22C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 62libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll), ref: 0044C238
GetProcAddress.KERNEL32(00000000,GetDiskFreeSpaceExA), ref: 0044C24A
GetDiskFreeSpaceExA.KERNEL32(?,?,?,?), ref: 0044C263
GetDiskFreeSpaceA.KERNEL32(?,?,?,?,?), ref: 0044C28E

Strings

GetDiskFreeSpaceExA, xrefs: 0044C244
kernel32.dll, xrefs: 0044C233

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: DiskFreeSpace$AddressHandleModuleProc
String ID: GetDiskFreeSpaceExA$kernel32.dll
API String ID: 746228563-3712701948
Opcode ID: 6c3bc5b2b85cf54cd0feafec8dc0d18ec4f1fc85fc53f8851ad527d9eac810f6
Instruction ID: 14757aa4aa075bc289848a6ed96b6f286cefdcf0e13fba133f5b97f0af843331
Opcode Fuzzy Hash: 6c3bc5b2b85cf54cd0feafec8dc0d18ec4f1fc85fc53f8851ad527d9eac810f6
Instruction Fuzzy Hash: 9A110AB2901119AF9B05DFE4CC84CEEBBBDFB09700B04805AE906D7250EA70DA05CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 005D31F9 Relevance: 10.6, APIs: 7, Instructions: 53COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 005D3200
TlsGetValue.KERNEL32(00000000,0000000C,005D68EE,00000408,005D2578,00000011,is5_GetHBITMAPDimensions,00000000), ref: 005D3217

Part of subcall function 004B3C8A: _malloc.LIBCMT ref: 004B3CA8

TlsSetValue.KERNEL32(?,00000000), ref: 005D324E
GetLastError.KERNEL32(?,00000000), ref: 005D3258
__CxxThrowException@8.LIBCMT ref: 005D326A
RtlEnterCriticalSection.NTDLL(?), ref: 005D3273
RtlLeaveCriticalSection.NTDLL(?), ref: 005D3289

Part of subcall function 005D30BA: __EH_prolog3.LIBCMT ref: 005D30C1
Part of subcall function 005D30BA: RtlInitializeCriticalSection.NTDLL(?), ref: 005D31EB

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: CriticalSection$Value$EnterErrorException@8H_prolog3H_prolog3_catchInitializeLastLeaveThrow_malloc
String ID:
API String ID: 3959456195-0
Opcode ID: 2b598173a0f4d851e8478da5f27def209be45906c25ae8a346a5ccd3321209e6
Instruction ID: 033f31a2d19ad19000d50990a498e67192a641e51abf414b507a699f4f02104d
Opcode Fuzzy Hash: 2b598173a0f4d851e8478da5f27def209be45906c25ae8a346a5ccd3321209e6
Instruction Fuzzy Hash: CC114C75D05206DFDB20EFB889899BEBFB9BB54700B20096FE105E3241DA745F058B62

Uniqueness

Uniqueness Score: -1.00%

Function 004641C0 Relevance: 9.2, APIs: 6, Instructions: 198COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004641C7

Part of subcall function 00459443: lua_getfield.LUA5.1(?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459455
Part of subcall function 00459443: lua_pushstring.LUA5.1(?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459460
Part of subcall function 00459443: lua_gettable.LUA5.1(?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459468
Part of subcall function 00459443: lua_remove.LUA5.1(?,000000FE,?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459470
Part of subcall function 00459443: lua_type.LUA5.1(?,000000FF,?,000000FE,?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459478
Part of subcall function 00459443: lua_pcall.LUA5.1(?,00000000,00000000,00000000), ref: 0045948B
Part of subcall function 00459443: lua_remove.LUA5.1(?,000000FF), ref: 0045949A

Part of subcall function 004597A0: __EH_prolog3.LIBCMT ref: 004597A7
Part of subcall function 004597A0: lua_gettop.LUA5.1(?,00000000,00000000,00000008,004076D1,?,00000002,?), ref: 004597D3

Part of subcall function 00459852: __EH_prolog3.LIBCMT ref: 00459859
Part of subcall function 00459852: lua_tolstring.LUA5.1(?,?,00000000,00000000,00000000,0000000C,004082AF,?,00000002,?,00000001,?,00000002), ref: 0045988A

Part of subcall function 00401BAB: __EH_prolog3.LIBCMT ref: 00401BB2

lua_type.LUA5.1(?,00000002), ref: 0046420F
lua_type.LUA5.1(?,00000003), ref: 00464240
lua_type.LUA5.1(?,00000004), ref: 00464261
lua_type.LUA5.1(?,00000005,?,?,?,?,?,?,00000020), ref: 00464285

Part of subcall function 004019B2: _strlen.LIBCMT ref: 004019C2

Part of subcall function 0045974C: __EH_prolog3.LIBCMT ref: 00459753

Part of subcall function 0044C87A: _memset.LIBCMT ref: 0044C8DD
Part of subcall function 0044C87A: _memset.LIBCMT ref: 0044C8EC
Part of subcall function 0044C87A: lstrlen.KERNEL32(?,?,?,00000000), ref: 0044C950
Part of subcall function 0044C87A: lstrlen.KERNEL32(?,?,?,?,?,?,?,?,00000000), ref: 0044C993
Part of subcall function 0044C87A: CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,?,?,?), ref: 0044C9C2
Part of subcall function 0044C87A: GetLastError.KERNEL32(?,?,?,?,?,?,?,00000000), ref: 0044C9CC

lua_pushnumber.LUA5.1(?,?,?,?,?,?,?,?,?,00000020), ref: 00464383

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: H_prolog3lua_type.$_memsetlstrlenlua_remove.$CreateErrorLastProcess_strlenlua_getfield.lua_gettable.lua_gettop.lua_pcall.lua_pushnumber.lua_pushstring.lua_tolstring.
String ID:
API String ID: 436662782-0
Opcode ID: 0343fa4ccd6f2edcf33364c0cc3c77d9b5c940a1750539c7a076baa53da11e7e
Instruction ID: d5df8da035bba0d8b1fc55304d3aa00b71b62b15117117ad362c46f4b6f236c5
Opcode Fuzzy Hash: 0343fa4ccd6f2edcf33364c0cc3c77d9b5c940a1750539c7a076baa53da11e7e
Instruction Fuzzy Hash: 83510972804205AADB14ABB9DC47BAF7768DF45338F34061FF125B62D3EE3C69408669

Uniqueness

Uniqueness Score: -1.00%

Function 0049247F Relevance: 9.1, APIs: 1, Strings: 4, Instructions: 365COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00492486

Part of subcall function 00495D98: __EH_prolog3.LIBCMT ref: 00495D9F

Part of subcall function 00492382: __EH_prolog3.LIBCMT ref: 00492389

Part of subcall function 004B3C8A: _malloc.LIBCMT ref: 004B3CA8

Part of subcall function 004A51BC: __EH_prolog3.LIBCMT ref: 004A51C3

Part of subcall function 004A26F3: __EH_prolog3_GS.LIBCMT ref: 004A26FA

Strings

IDS_CTRL_STATICTEXT_BOTTOMINSTRUCTIONS, xrefs: 004928AB
, xrefs: 00492569
x, xrefs: 004924B1
IDS_CTRL_STATICTEXT_TOPINSTRUCTIONS, xrefs: 004924ED

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: H_prolog3$H_prolog3__malloc
String ID: $IDS_CTRL_STATICTEXT_BOTTOMINSTRUCTIONS$IDS_CTRL_STATICTEXT_TOPINSTRUCTIONS$x
API String ID: 534863677-1327038464
Opcode ID: 651d966aea8a851ea7862a6b780a26d837fcd4ca01976dd3a215bedc907b26ab
Instruction ID: 7c03824a848b0b150440b1ad397cc3a49011129d7d8a0da48678406ddf21ab2c
Opcode Fuzzy Hash: 651d966aea8a851ea7862a6b780a26d837fcd4ca01976dd3a215bedc907b26ab
Instruction Fuzzy Hash: 89E16EB1D007059FCB14DFA9C941AAEBBF4BF08314F10466EE4A6E72D1DB78A601CB65

Uniqueness

Uniqueness Score: -1.00%

Function 00477D73 Relevance: 9.1, APIs: 6, Instructions: 86COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00477D7A

Part of subcall function 00459443: lua_getfield.LUA5.1(?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459455
Part of subcall function 00459443: lua_pushstring.LUA5.1(?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459460
Part of subcall function 00459443: lua_gettable.LUA5.1(?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459468
Part of subcall function 00459443: lua_remove.LUA5.1(?,000000FE,?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459470
Part of subcall function 00459443: lua_type.LUA5.1(?,000000FF,?,000000FE,?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459478
Part of subcall function 00459443: lua_pcall.LUA5.1(?,00000000,00000000,00000000), ref: 0045948B
Part of subcall function 00459443: lua_remove.LUA5.1(?,000000FF), ref: 0045949A

Part of subcall function 00454035: __EH_prolog3.LIBCMT ref: 0045403C
Part of subcall function 00454035: GetCurrentProcessId.KERNEL32(00000004), ref: 0045404C

Part of subcall function 00444467: K32EnumProcesses.KERNEL32(?,00001000,?), ref: 004444B0

lua_createtable.LUA5.1(?,00000000,00000000,00000000), ref: 00477DCF

Part of subcall function 004445C9: GetCurrentProcessId.KERNEL32(00000000,?,00000000), ref: 004445EE
Part of subcall function 004445C9: GetModuleFileNameA.KERNEL32(00000000,00000000,00000104,00000104,00000000,?,00000000), ref: 00444609

lua_pushnumber.LUA5.1(?,?,?,?), ref: 00477E01
lua_pushstring.LUA5.1(?,?,?,?,?,?), ref: 00477E0A
lua_settable.LUA5.1(?,000000FD,?,?,?,?,?,?), ref: 00477E12
lua_pushnil.LUA5.1(?), ref: 00477E58

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: CurrentH_prolog3Processlua_pushstring.lua_remove.$EnumFileModuleNameProcesseslua_createtable.lua_getfield.lua_gettable.lua_pcall.lua_pushnil.lua_pushnumber.lua_settable.lua_type.
String ID:
API String ID: 1919865280-0
Opcode ID: 13e40c3d9f6643123b315f9e9e2dc89c8865023597f4eab6af70a68bcd927d84
Instruction ID: 8b5e7d3f41d687c7750ffd1ab68f6b4b7d71d40aa2cc28677508ecf9e2ac103d
Opcode Fuzzy Hash: 13e40c3d9f6643123b315f9e9e2dc89c8865023597f4eab6af70a68bcd927d84
Instruction Fuzzy Hash: CA21A031808109ABCB04EFA5CD82AFEB774AF51318F50826FF525661D2DF3C5E05C6AA

Uniqueness

Uniqueness Score: -1.00%

Function 0045237E Relevance: 9.1, APIs: 6, Instructions: 57stringCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00452388
SHGetSpecialFolderLocation.SHELL32 ref: 004523C6
SHGetPathFromIDList.SHELL32(?,?), ref: 004523DD
SHGetMalloc.SHELL32(?), ref: 004523EE
lstrlen.KERNEL32(?), ref: 00452421
lstrlen.KERNEL32(?), ref: 0045242D

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: lstrlen$FolderFromH_prolog3_ListLocationMallocPathSpecial
String ID:
API String ID: 4010010178-0
Opcode ID: c3bdc423bc906938b907a88840b19e00afc1d22f348758823d126643a4692fb8
Instruction ID: 8cb992b7b7bb82ef99b9d4840fb322ab34d29d67bcb88919a0aaea9a5f9cae1b
Opcode Fuzzy Hash: c3bdc423bc906938b907a88840b19e00afc1d22f348758823d126643a4692fb8
Instruction Fuzzy Hash: 5721DBB590021C9FCF15DFA4CD89ADDBBB9BF49304F4040DAE509E7211CA749E858F94

Uniqueness

Uniqueness Score: -1.00%

Function 004060C0 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 213COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004060C7

Part of subcall function 0041C803: __EH_prolog3.LIBCMT ref: 0041C80A

Part of subcall function 0040CC44: __EH_prolog3.LIBCMT ref: 0040CC4B
Part of subcall function 0040CC44: luaL_newstate.LUA5.1(000000FF,00000004,00406164,00000000,00000000,00000000,00000000,00000000,00000004), ref: 0040CC6A
Part of subcall function 0040CC44: luaL_openlibs.LUA5.1(00000000,000000FF,00000004,00406164,00000000,00000000,00000000,00000000,00000000,00000004), ref: 0040CC7F
Part of subcall function 0040CC44: lua_settop.LUA5.1(00000005,00000000,00000000,000000FF,00000004,00406164,00000000,00000000,00000000,00000000,00000000,00000004), ref: 0040CC88

Part of subcall function 00401BAB: __EH_prolog3.LIBCMT ref: 00401BB2

Part of subcall function 00440899: __EH_prolog3.LIBCMT ref: 004408A0

Part of subcall function 00419E06: __EH_prolog3.LIBCMT ref: 00419E0D

Part of subcall function 00403687: __EH_prolog3.LIBCMT ref: 0040368E

Part of subcall function 00453466: __EH_prolog3.LIBCMT ref: 0045346D

Part of subcall function 004019B2: _strlen.LIBCMT ref: 004019C2

__time64.LIBCMT ref: 004063D5

Part of subcall function 005B5F5F: GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,00439F6A,00000000,00000010,00404C11,** [END] ProcessInBuffer !ReadFromDisk,00000001), ref: 005B5F6A
Part of subcall function 005B5F5F: __aulldiv.LIBCMT ref: 005B5F8A

Strings

!, xrefs: 00406349
Unknown, xrefs: 004063F2
C:\temp\SUF_SFX_TEST\, xrefs: 00406371

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: H_prolog3$Time$FileL_newstate.L_openlibs.System__aulldiv__time64_strlenlua_settop.
String ID: !$C:\temp\SUF_SFX_TEST\$Unknown
API String ID: 3492532725-3646170354
Opcode ID: fe8626150ef14a28e7e8cb209215f57995f0a3b284d4ed1177f0fe670d395b1f
Instruction ID: 6514961cb838c387339fdeeb49d0c1aba93dcbc7a31ddbfc98c63869a35db57d
Opcode Fuzzy Hash: fe8626150ef14a28e7e8cb209215f57995f0a3b284d4ed1177f0fe670d395b1f
Instruction Fuzzy Hash: D2B16F74805B44DDD715EF75C591BDAFBE0AF25308F80485EA4AF63282CB783608DB6A

Uniqueness

Uniqueness Score: -1.00%

Function 00495D98 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 190COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00495D9F

Part of subcall function 004B3C8A: _malloc.LIBCMT ref: 004B3CA8

Part of subcall function 004A26F3: __EH_prolog3_GS.LIBCMT ref: 004A26FA

Part of subcall function 0043A2C6: __EH_prolog3.LIBCMT ref: 0043A2CD

Part of subcall function 004AADE0: __EH_prolog3.LIBCMT ref: 004AADE7

Strings

IDS_CTRL_BUTTON_CANCEL, xrefs: 00495F9F
IDS_CTRL_BUTTON_NEXT, xrefs: 00495F06
IDS_CTRL_BUTTON_HELP, xrefs: 00495DDB
IDS_CTRL_BUTTON_BACK, xrefs: 00495E70

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: H_prolog3$H_prolog3__malloc
String ID: IDS_CTRL_BUTTON_BACK$IDS_CTRL_BUTTON_CANCEL$IDS_CTRL_BUTTON_HELP$IDS_CTRL_BUTTON_NEXT
API String ID: 534863677-2679619293
Opcode ID: 313f2a568404646e56cc717cf5c43d73db14a55be1ffd1d68af161b8c9e221fd
Instruction ID: 8462461c20c031ecd194dd3403e519ade6fccd1fb8bf50a2e450e1a4d7074a14
Opcode Fuzzy Hash: 313f2a568404646e56cc717cf5c43d73db14a55be1ffd1d68af161b8c9e221fd
Instruction Fuzzy Hash: D07176B0D00706EBCB04EFAAC9525AEBBB5BF09724F10431EF125A72D1DB785611CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00425CFD Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 152windowCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00425D07

Part of subcall function 0044A8A2: __EH_prolog3_GS.LIBCMT ref: 0044A8AC

MessageBoxA.USER32(?,?,00000000,?), ref: 00425EF0

Strings

ERR_ARCHIVE_INTEGRITY, xrefs: 00425E6C
Verify archive integrity, xrefs: 00425E31, 00425F11, 00425F33, 00425F4B
MSG_ERROR, xrefs: 00425EBA

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: H_prolog3_$Message
String ID: ERR_ARCHIVE_INTEGRITY$MSG_ERROR$Verify archive integrity
API String ID: 3988267852-2868250619
Opcode ID: 84b10cfb4a57cfc72ee97695ae962451a0d6f80154fadefb411c534e22b875d8
Instruction ID: ff6cc2f4b6dbf86dd0907479ff0d022d817d4fa1bbd8b1d6086f1ddec9b10a7f
Opcode Fuzzy Hash: 84b10cfb4a57cfc72ee97695ae962451a0d6f80154fadefb411c534e22b875d8
Instruction Fuzzy Hash: CE515E70A001289FCB24DF59DD91AE9B7B5AF49324F4140EEE10DA72A2DB381E80CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0041031A Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 139COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00410321

Part of subcall function 004C6401: __EH_prolog3.LIBCMT ref: 004C6408
Part of subcall function 004C6401: SetRectEmpty.USER32(?), ref: 004C64AA

Part of subcall function 0040FF40: __EH_prolog3.LIBCMT ref: 0040FF47
Part of subcall function 0040FF40: _strlen.LIBCMT ref: 0040FFE3

Part of subcall function 0040F9BF: __EH_prolog3.LIBCMT ref: 0040F9C6
Part of subcall function 0040F9BF: GetFileAttributesA.KERNEL32(?), ref: 0040FA3E
Part of subcall function 0040F9BF: ExtractIconA.SHELL32(?,?,00000000), ref: 0040FA55
Part of subcall function 0040F9BF: LoadIconA.USER32(?,00000073), ref: 0040FA75

LoadCursorA.USER32(00000000,00007F00), ref: 004103F1

Part of subcall function 004BF1C9: __snwprintf_s.LIBCMT ref: 004BF214

Part of subcall function 004019B2: _strlen.LIBCMT ref: 004019C2

Part of subcall function 004C6877: LoadMenuA.USER32(?,?), ref: 004C6897

Strings

%WindowTitle%, xrefs: 00410479
%WindowTitleUninstall%, xrefs: 0041049A
Setup Application, xrefs: 00410414

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: H_prolog3Load$Icon_strlen$AttributesCursorEmptyExtractFileH_prolog3_MenuRect__snwprintf_s
String ID: %WindowTitle%$%WindowTitleUninstall%$Setup Application
API String ID: 3136545289-4203591063
Opcode ID: 8ed4229772573b4acb05299a183a4784e9a333f509233280762f0fce9d156340
Instruction ID: 544d9c7ea3191b2daf23db1e8ecc8cfacc3e720bf763c029d3feb3cc4f9b36ef
Opcode Fuzzy Hash: 8ed4229772573b4acb05299a183a4784e9a333f509233280762f0fce9d156340
Instruction Fuzzy Hash: CD518470900644DFDB15EFA9C981AEEBBB8AF04318F54416FF115772D2DB782940CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00484FD9 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 72COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00484FE0

Part of subcall function 00401BAB: __EH_prolog3.LIBCMT ref: 00401BB2

Part of subcall function 00484584: __EH_prolog3.LIBCMT ref: 0048458B

Strings

End deleting files, xrefs: 00485084
Failed to delete one or more files, xrefs: 0048506A
Invalid source, xrefs: 00485032
Start deleting files, xrefs: 00485010

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: H_prolog3
String ID: End deleting files$Failed to delete one or more files$Invalid source$Start deleting files
API String ID: 431132790-3723306913
Opcode ID: a7492b591834adcb8266a2f371cf5afcbd7a4feb1be4bd279d18b1cdcbe1c022
Instruction ID: 14a6b71bee0dca5d46d573b660f33e22b0ab86944e05c0a735af55a5f0395c75
Opcode Fuzzy Hash: a7492b591834adcb8266a2f371cf5afcbd7a4feb1be4bd279d18b1cdcbe1c022
Instruction Fuzzy Hash: 4121C6707006019BCB18BF69C89696E7BF2AF88714700851FF1479B3D1DF38AD018B9A

Uniqueness

Uniqueness Score: -1.00%

Function 0040F386 Relevance: 7.6, APIs: 5, Instructions: 113COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(00000000), ref: 0040F42B
GetSystemMetrics.USER32(00000001), ref: 0040F43A
IsWindow.USER32(?), ref: 0040F464

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: MetricsSystem$Window
String ID:
API String ID: 1155976603-0
Opcode ID: 8abfd56f2395f5287dd50d6e6034312f45d80a1a59b2c202297007860769953d
Instruction ID: 99e93b408323617b140028d8ed73d71b4ff401aeca781491c7eaaa0bbbc0a8d2
Opcode Fuzzy Hash: 8abfd56f2395f5287dd50d6e6034312f45d80a1a59b2c202297007860769953d
Instruction Fuzzy Hash: 394157B1900705AFDB20DF78C984A4BBBF8FB14314F14863AE9459BA90D738E908CB94

Uniqueness

Uniqueness Score: -1.00%

Function 004B0433 Relevance: 7.6, APIs: 5, Instructions: 61windowCOMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 004B0462
GetWindowRect.USER32(?,?), ref: 004B047B

Part of subcall function 004B791F: ScreenToClient.USER32(?,?), ref: 004B7930
Part of subcall function 004B791F: ScreenToClient.USER32(?,?), ref: 004B793D

Part of subcall function 004B871B: GetDlgItem.USER32(?,?), ref: 004B872C

GetWindowRect.USER32(?,?), ref: 004B0498
LoadIconA.USER32(?,00000073), ref: 004B04BE
SendMessageA.USER32(?,00000080,00000000,00000000), ref: 004B04CF

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: ClientRect$ScreenWindow$IconItemLoadMessageSend
String ID:
API String ID: 1742658178-0
Opcode ID: 6415d357f28b8735c1df4822b593f97f1f05ea4c1186fa1bb5e0e786ec7e2ad5
Instruction ID: c8ff9c2ea82d51ed1613ef4a00d2e19e05506b3ba2256031696dc6e2f9793490
Opcode Fuzzy Hash: 6415d357f28b8735c1df4822b593f97f1f05ea4c1186fa1bb5e0e786ec7e2ad5
Instruction Fuzzy Hash: 51115BB1A00208AFDB10EF79CC45EEEBBF9FF48304F00446AE58693561DA34AA008B64

Uniqueness

Uniqueness Score: -1.00%

Function 004D496A Relevance: 7.6, APIs: 5, Instructions: 54stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(00000001,00000000,?,?), ref: 004D4996
_memset.LIBCMT ref: 004D49B3
GetWindowTextA.USER32(?,00000000,00000100), ref: 004D49CD
lstrcmp.KERNEL32(00000000,00000001), ref: 004D49DF
SetWindowTextA.USER32(?,00000001), ref: 004D49EB

Part of subcall function 004B4C5C: __CxxThrowException@8.LIBCMT ref: 004B4C72
Part of subcall function 004B4C5C: __EH_prolog3.LIBCMT ref: 004B4C7F

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: TextWindow$Exception@8H_prolog3Throw_memsetlstrcmplstrlen
String ID:
API String ID: 4273134663-0
Opcode ID: 4a92289861294db0525a6efe15941e1c76e387b3e9cad5eb7d5ecf87a0a3a65b
Instruction ID: 75a2df91f8a76a76aa9e37672bf7bc5b03bc6f616c9716464034dcf6c86f78cb
Opcode Fuzzy Hash: 4a92289861294db0525a6efe15941e1c76e387b3e9cad5eb7d5ecf87a0a3a65b
Instruction Fuzzy Hash: 2C01D6B6601114ABDB20AF759C95FEF77ADEB85740F0000A7F546D3241EA789E448BB4

Uniqueness

Uniqueness Score: -1.00%

Function 0040F6C6 Relevance: 7.5, APIs: 5, Instructions: 44windowCOMMON

Download Yara Rule

APIs

GetSystemMenu.USER32(?,00000000,?,?,?), ref: 0040F6E5
RemoveMenu.USER32(?,0000F000,00000000,00000000,?,?,?), ref: 0040F706
RemoveMenu.USER32(?,0000F010,00000000,?,?,?), ref: 0040F711
RemoveMenu.USER32(?,0000F030,00000000,?,?,?), ref: 0040F71C
RemoveMenu.USER32(?,0000F020,00000000,?,?,?), ref: 0040F727

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: Menu$Remove$System
String ID:
API String ID: 1817084541-0
Opcode ID: e76d138b187e25983bf8500d474f56c6bfb23f262933950599fa275c92b43fc6
Instruction ID: 018801e066f95afbb0997612c77401e111a54cf50fcf1850825ebb964a22665e
Opcode Fuzzy Hash: e76d138b187e25983bf8500d474f56c6bfb23f262933950599fa275c92b43fc6
Instruction Fuzzy Hash: AEF09C715001197FD7301BB1DC45D3BBE1DFB043F47004537B614628A1C671AC10E694

Uniqueness

Uniqueness Score: -1.00%

Function 00437565 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 332COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0043756C

Part of subcall function 00401BAB: __EH_prolog3.LIBCMT ref: 00401BB2

Part of subcall function 0040C578: lua_getfield.LUA5.1(0000C259,FFFFD8EE,?,80000000,?,?,00403F08,?), ref: 0040C58C
Part of subcall function 0040C578: lua_isnumber.LUA5.1(0000C259,000000FF,0000C259,FFFFD8EE,?,80000000,?,?,00403F08,?), ref: 0040C596
Part of subcall function 0040C578: lua_tonumber.LUA5.1(0000C259,000000FF), ref: 0040C5A7
Part of subcall function 0040C578: lua_remove.LUA5.1(0000C259,000000FF), ref: 0040C5BA

Part of subcall function 0043C227: __EH_prolog3.LIBCMT ref: 0043C22E

Part of subcall function 004B4C5C: __CxxThrowException@8.LIBCMT ref: 004B4C72
Part of subcall function 004B4C5C: __EH_prolog3.LIBCMT ref: 004B4C7F

Part of subcall function 004278AD: __EH_prolog3.LIBCMT ref: 004278B4

Strings

MSG_PROG_CHECKING_FILES, xrefs: 004375C5
INSTALL_STAGE_PREPARING, xrefs: 0043758E
MSG_PROG_CHECKING_DRIVESPACE, xrefs: 0043788B

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: H_prolog3$Exception@8Throwlua_getfield.lua_isnumber.lua_remove.lua_tonumber.
String ID: INSTALL_STAGE_PREPARING$MSG_PROG_CHECKING_DRIVESPACE$MSG_PROG_CHECKING_FILES
API String ID: 2982315526-2391240801
Opcode ID: 058e34f6c871d464848eb2de10ebb241af4334e5f1b45abcef70c2f60c606445
Instruction ID: 341226f509a2c4e3a0d9add75a64ff10c40779562ccd6fd4e06d73a157241031
Opcode Fuzzy Hash: 058e34f6c871d464848eb2de10ebb241af4334e5f1b45abcef70c2f60c606445
Instruction Fuzzy Hash: 84C13FB0E042059FCB14DFA9C886AEE77B5FF49324F04456EF455A7392CB38A801CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00406952 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 330fileCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00406959

Part of subcall function 00401BAB: __EH_prolog3.LIBCMT ref: 00401BB2

Part of subcall function 004067BC: __EH_prolog3_GS.LIBCMT ref: 004067C6
Part of subcall function 004067BC: GetTempPathA.KERNEL32(00000104,?), ref: 00406806
Part of subcall function 004067BC: _strlen.LIBCMT ref: 00406862
Part of subcall function 004067BC: GetTempFileNameA.KERNEL32(?,sufun,00000000,?,tmp,00000000), ref: 0040688A
Part of subcall function 004067BC: _strlen.LIBCMT ref: 0040689B

SetFileAttributesA.KERNEL32(?,00000080,?,?,00000001,00001000,00000000,?,00008000,00000000,00000000,00000000,00000078), ref: 00406DA0
DeleteFileA.KERNEL32(?), ref: 00406DA9

Part of subcall function 004C213C: __EH_prolog3_catch_GS.LIBCMT ref: 004C2146

Strings

Constants, xrefs: 00406A8B, 00406C84

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: File$H_prolog3Temp_strlen$AttributesDeleteH_prolog3_H_prolog3_catch_NamePath
String ID: Constants
API String ID: 2974014962-289176987
Opcode ID: db7b0347c894976e575fb99079ecdbe9aede5b514061fbe6e5c9576477d9b5d9
Instruction ID: 9d4199288d0bf3aa795d17ba980c8f5fd9b737e6d8b057213c53f69c96193bbb
Opcode Fuzzy Hash: db7b0347c894976e575fb99079ecdbe9aede5b514061fbe6e5c9576477d9b5d9
Instruction Fuzzy Hash: 09E15C7090020ADFCB14DBA4C884EEEB7B5BF54308F14859EF15AA72A2DB386A44CB54

Uniqueness

Uniqueness Score: -1.00%

Function 004458D4 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 152registryCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004458DB

Part of subcall function 00401BAB: __EH_prolog3.LIBCMT ref: 00401BB2

RegQueryValueExA.KERNEL32(?,00000000,00000000,?,00000000,?,00000000,NoName,0000000C,00446312,00000000,?,00000000,00000006,00000000,?), ref: 00445994
RegQueryValueExA.KERNEL32(?,00000000,00000000,?,?,?,00000000,000000FF,?,00451A65,00000000,?,00000000,00020019,00000000,00000000), ref: 00445A01

Strings

NoName, xrefs: 00445925

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: H_prolog3QueryValue
String ID: NoName
API String ID: 2373586757-1084695559
Opcode ID: 6c34fb76c86a00a4e2aa3f5d976652e994c8d19a540bc29317e12c21211d2dd5
Instruction ID: aaa8586c3ea0bdd6543efa0fcfa3e2751c87d85623b07de9ca53c83627b2a8eb
Opcode Fuzzy Hash: 6c34fb76c86a00a4e2aa3f5d976652e994c8d19a540bc29317e12c21211d2dd5
Instruction Fuzzy Hash: 78514DB190060AAFDF14DFA5C8D19BFB7B4EF14318B50462EF516A7291DB38AE40CB58

Uniqueness

Uniqueness Score: -1.00%

Function 0049B2E6 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 102COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0049B2ED

Part of subcall function 00495D98: __EH_prolog3.LIBCMT ref: 00495D9F

Part of subcall function 004B3C8A: _malloc.LIBCMT ref: 004B3CA8

Strings

IDS_CTRL_STATICTEXT_BODY, xrefs: 0049B330
d, xrefs: 0049B2FE
IDS_CTRL_HEADINGTEXT_BODY, xrefs: 0049B3C6

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: H_prolog3$_malloc
String ID: IDS_CTRL_HEADINGTEXT_BODY$IDS_CTRL_STATICTEXT_BODY$d
API String ID: 1683881009-1169261666
Opcode ID: 0e49c189689075ad5c9071e6bce8f52527e3f06028edf8a2100be12d4735ec86
Instruction ID: 939313588ecb4c4ef44c195ab12a574873ca2e876672acbcac578cb8929b0269
Opcode Fuzzy Hash: 0e49c189689075ad5c9071e6bce8f52527e3f06028edf8a2100be12d4735ec86
Instruction Fuzzy Hash: DB41D670900705DBCB24EFAAC8526AFBBF4BF45324F10471EE166A72D1CB785604CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0043F3CE Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 63COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0043F3D5
__time64.LIBCMT ref: 0043F3EE

Part of subcall function 005B5F5F: GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,00439F6A,00000000,00000010,00404C11,** [END] ProcessInBuffer !ReadFromDisk,00000001), ref: 005B5F6A
Part of subcall function 005B5F5F: __aulldiv.LIBCMT ref: 005B5F8A

Part of subcall function 0043F322: __EH_prolog3_GS.LIBCMT ref: 0043F329
Part of subcall function 0043F322: lstrlenW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0043F371
Part of subcall function 0043F322: __fassign.LIBCMT ref: 0043F389

Part of subcall function 004019B2: _strlen.LIBCMT ref: 004019C2

Strings

%CompanyURL%, xrefs: 0043F46C
%CompanyName%, xrefs: 0043F45C

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: Time$FileH_prolog3H_prolog3_System__aulldiv__fassign__time64_strlenlstrlen
String ID: %CompanyName%$%CompanyURL%
API String ID: 1881766755-3998575189
Opcode ID: e5fca4b182f9d04d1902db677f768de7da90307287cfdf4abb7f82b6b7b4ebdd
Instruction ID: 5105b56d9845c78cd6ddb4c145b052a05579c23c92088d19a4647a4d7cda0493
Opcode Fuzzy Hash: e5fca4b182f9d04d1902db677f768de7da90307287cfdf4abb7f82b6b7b4ebdd
Instruction Fuzzy Hash: AB215CB0800B048FC724EF66C9929ABFBF4FF98714B504A2EE09793A91DB74B544CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00440F9B Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 56COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00440FA2

Part of subcall function 004B876E: SetDlgItemTextA.USER32(?,?,?), ref: 004B8782

Part of subcall function 00401BAB: __EH_prolog3.LIBCMT ref: 00401BB2

Part of subcall function 0043C227: __EH_prolog3.LIBCMT ref: 0043C22E

_strlen.LIBCMT ref: 00441027

Strings

Initializing..., xrefs: 00441021, 00441026, 0044102E
MSG_INITIALIZING, xrefs: 00440FD8, 00440FDD, 00441014

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: H_prolog3$ItemText_strlen
String ID: Initializing...$MSG_INITIALIZING
API String ID: 1130358893-1400418863
Opcode ID: 16310ed88656a9a50074d9262547ca357c85c05452cc7fd456dcfed9c01ef119
Instruction ID: 9896458aaf37dde6f64fe3894bdde2d3e15da1e2c5a5a8e75fe77b1b501d87ee
Opcode Fuzzy Hash: 16310ed88656a9a50074d9262547ca357c85c05452cc7fd456dcfed9c01ef119
Instruction Fuzzy Hash: D711CE31910116ABDB08F7B5CD52BFE7769AF91318F50052EB412B72D2CE382A01C679

Uniqueness

Uniqueness Score: -1.00%

Function 00458F0C Relevance: 6.0, APIs: 4, Instructions: 40COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000008,?,76A1F010,?,004591AF), ref: 00458F1C
OpenProcessToken.ADVAPI32(00000000,?,004591AF), ref: 00458F23
GetTokenInformation.KERNELBASE(?,00000012(TokenIntegrityLevel),004591AF,00000004,?,?,004591AF), ref: 00458F3C
CloseHandle.KERNEL32(00000000,?,004591AF), ref: 00458F5D

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: ProcessToken$CloseCurrentHandleInformationOpen
String ID:
API String ID: 215268677-0
Opcode ID: f32db9fc75154aff66f02febb6651cb6a121f115b1c4b79ef1ccc234c40b3c44
Instruction ID: 32246bd4c572361810724ea4bb94f376156821456e6dd3e1cf620288d564cc5e
Opcode Fuzzy Hash: f32db9fc75154aff66f02febb6651cb6a121f115b1c4b79ef1ccc234c40b3c44
Instruction Fuzzy Hash: 31F062B2500118ABDF509BA1DC49A9FB77EEB08742F005056AD05F2191DF348F0CD798

Uniqueness

Uniqueness Score: -1.00%

Function 00405462 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 220COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00405469
FreeLibrary.KERNEL32(?), ref: 004055CA

Strings

, xrefs: 004055E1

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: FreeH_prolog3Library
String ID:
API String ID: 1631603194-3916222277
Opcode ID: 99b72b9934228aff5a59330d7ccee98977775f9817a4ba57e08b2fceee69ea51
Instruction ID: 2cddbf5fc9d1921f82863c8cac73a1eedda5caccbc21eb6de35e5e82688cc2bb
Opcode Fuzzy Hash: 99b72b9934228aff5a59330d7ccee98977775f9817a4ba57e08b2fceee69ea51
Instruction Fuzzy Hash: DFA19F34500B44DBDB14EBB5C595BEEB7A1AF65304F40896ED49BA32C2DF3CAA04CB19

Uniqueness

Uniqueness Score: -1.00%

Function 004262C2 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 158COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004262C9

Part of subcall function 0043A00F: __EH_prolog3.LIBCMT ref: 0043A016

Strings

Global include script: %s, xrefs: 0042638A
Include script: , xrefs: 004263F8

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: H_prolog3
String ID: Global include script: %s$Include script:
API String ID: 431132790-2954161150
Opcode ID: 6f7b91ace1ad39ad5f8025a1a43fc186ca4ba94b97e2eb3059607a0d99d1eea8
Instruction ID: a6da63d34b4f1b8e2307afa6a16e9cce30dc3c7d8fa72cb4c6072385dfcb1110
Opcode Fuzzy Hash: 6f7b91ace1ad39ad5f8025a1a43fc186ca4ba94b97e2eb3059607a0d99d1eea8
Instruction Fuzzy Hash: A551B371E00109DFCB04EFA9D982AAEB7B4AF15324F55416EF151A73D2DB38AD00CB69

Uniqueness

Uniqueness Score: -1.00%

Function 0043B5E3 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 81COMMON

Download Yara Rule

APIs

Part of subcall function 004150D3: __EH_prolog3.LIBCMT ref: 004150DA

__EH_prolog3.LIBCMT ref: 0043B68E

Part of subcall function 004150D3: _strlen.LIBCMT ref: 00415183
Part of subcall function 004150D3: _strlen.LIBCMT ref: 00415210
Part of subcall function 004150D3: _strlen.LIBCMT ref: 00415231

Strings

SUF70Messages, xrefs: 0043B5FE, 0043B60C
Messages, xrefs: 0043B629

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: _strlen$H_prolog3
String ID: Messages$SUF70Messages
API String ID: 2883720156-3546710208
Opcode ID: 181ffe2da18e5b587a705d300779f15bb3274006208cd4a4a80a239d5c320e53
Instruction ID: b4199b725145aa4922ddda2a54367824652d058e283d71b41ee2e88a8f515c0c
Opcode Fuzzy Hash: 181ffe2da18e5b587a705d300779f15bb3274006208cd4a4a80a239d5c320e53
Instruction Fuzzy Hash: 8011C6717002049BDB14BB768C53FAF6699DF88B14F11543FBA069B283DA289C44C7EA

Uniqueness

Uniqueness Score: -1.00%

Function 004357CD Relevance: 4.7, APIs: 3, Instructions: 158COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004357D4

Part of subcall function 00405C53: __EH_prolog3.LIBCMT ref: 00405C5A
Part of subcall function 00405C53: lua_getfield.LUA5.1(?,FFFFD8EE,SetupData,?,?,?,00000000,00000004), ref: 00405C9A
Part of subcall function 00405C53: lua_type.LUA5.1(?,000000FF,?,FFFFD8EE,SetupData,?,?,?,00000000,00000004), ref: 00405CA2
Part of subcall function 00405C53: lua_pushstring.LUA5.1(?,GetAppShortcutFolderPath), ref: 00405CB5
Part of subcall function 00405C53: lua_gettable.LUA5.1(?,000000FE,?,GetAppShortcutFolderPath), ref: 00405CBD
Part of subcall function 00405C53: lua_remove.LUA5.1(?,000000FE,?,000000FE,?,GetAppShortcutFolderPath), ref: 00405CC5
Part of subcall function 00405C53: lua_type.LUA5.1(?,000000FF,?,000000FE,?,000000FE,?,GetAppShortcutFolderPath), ref: 00405CCD
Part of subcall function 00405C53: lua_pcall.LUA5.1(?,00000000,00000001,00000000), ref: 00405CDF
Part of subcall function 00405C53: lua_isstring.LUA5.1(?,000000FF), ref: 00405CEE
Part of subcall function 00405C53: lua_tolstring.LUA5.1(?,000000FF,00000000), ref: 00405CFD
Part of subcall function 00405C53: lua_settop.LUA5.1(?,00000000), ref: 00405D21

SHChangeNotify.SHELL32(00000008,00000001,?,00000000), ref: 004358B5
SHChangeNotify.SHELL32(00001000,00000001,?,00000000), ref: 00435986

Part of subcall function 004B4C5C: __CxxThrowException@8.LIBCMT ref: 004B4C72
Part of subcall function 004B4C5C: __EH_prolog3.LIBCMT ref: 004B4C7F

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: H_prolog3$ChangeNotifylua_type.$Exception@8Throwlua_getfield.lua_gettable.lua_isstring.lua_pcall.lua_pushstring.lua_remove.lua_settop.lua_tolstring.
String ID:
API String ID: 2376141247-0
Opcode ID: 16725aae54bf8a05049745d3144639e1357b35ea704f9943fb28d9ab89561330
Instruction ID: f02e862ee6a469edd215d1f42420aaa1e4481b8540a8c68394833c54e9d06668
Opcode Fuzzy Hash: 16725aae54bf8a05049745d3144639e1357b35ea704f9943fb28d9ab89561330
Instruction Fuzzy Hash: C2512C71E00542CFCF18EBA4C881ABEB771AF48314F19906FE5452B392DB389D41CB99

Uniqueness

Uniqueness Score: -1.00%

Function 005725E8 Relevance: 4.6, APIs: 3, Instructions: 123COMMON

Download Yara Rule

APIs

Part of subcall function 004B4C5C: __CxxThrowException@8.LIBCMT ref: 004B4C72
Part of subcall function 004B4C5C: __EH_prolog3.LIBCMT ref: 004B4C7F

_memset.LIBCMT ref: 00572651
_memset.LIBCMT ref: 00572681
_memset.LIBCMT ref: 00572700

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: _memset$Exception@8H_prolog3Throw
String ID:
API String ID: 3954392632-0
Opcode ID: dfb8f1502ec594f49237b4172233581e2204fa0bd7f90ccdfaab0878f7964187
Instruction ID: 57e4627e674aa0b94908f84f376420d6d7a1425f19b847318f5c1cd90d1e1cf4
Opcode Fuzzy Hash: dfb8f1502ec594f49237b4172233581e2204fa0bd7f90ccdfaab0878f7964187
Instruction Fuzzy Hash: 9A41D1B1700B019BDB249E6AD881B677BE9FF80354F20C92EF55ECB641EA34F9419B50

Uniqueness

Uniqueness Score: -1.00%

Function 004D2861 Relevance: 4.6, APIs: 3, Instructions: 117COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 004B4C5C: __CxxThrowException@8.LIBCMT ref: 004B4C72
Part of subcall function 004B4C5C: __EH_prolog3.LIBCMT ref: 004B4C7F

_memset.LIBCMT ref: 004D28B4
_memset.LIBCMT ref: 004D28DD

Part of subcall function 004B3C8A: _malloc.LIBCMT ref: 004B3CA8

_memset.LIBCMT ref: 004D2964

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: _memset$Exception@8H_prolog3Throw_malloc
String ID:
API String ID: 2916024377-0
Opcode ID: f24e0b82de37896257f43158a9d79aaadf10faca8b6ae6627d0305b4c13d7e44
Instruction ID: 9428f07e5876b9ac1f91ec52ee5f2dc89a956b587546566e78f593d03493d2e7
Opcode Fuzzy Hash: f24e0b82de37896257f43158a9d79aaadf10faca8b6ae6627d0305b4c13d7e44
Instruction Fuzzy Hash: 023103B17007019BD720AF6ACDE1A1BBBE5EB90354B10C92FF15ADB701D6B9E940CB54

Uniqueness

Uniqueness Score: -1.00%

Function 004C26B9 Relevance: 4.6, APIs: 3, Instructions: 109COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 004B4C5C: __CxxThrowException@8.LIBCMT ref: 004B4C72
Part of subcall function 004B4C5C: __EH_prolog3.LIBCMT ref: 004B4C7F

_memset.LIBCMT ref: 004C270B
_memset.LIBCMT ref: 004C2730
_memset.LIBCMT ref: 004C27A8

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: _memset$Exception@8H_prolog3Throw
String ID:
API String ID: 3954392632-0
Opcode ID: cca0cfb1f7e56783b001057b2dbf6859836dc4f60ac66284293b3ba2ab0235d8
Instruction ID: fa06b2c8758a7909894c4313d8569ec7728d4a5dec69a9af1b24ad551cccc6ac
Opcode Fuzzy Hash: cca0cfb1f7e56783b001057b2dbf6859836dc4f60ac66284293b3ba2ab0235d8
Instruction Fuzzy Hash: 1E31F6796007019BDB20AF2ACEC1E5B7AE5EB80758B10C43FE51ACB611D6F8E9418B58

Uniqueness

Uniqueness Score: -1.00%

Function 00445632 Relevance: 4.6, APIs: 3, Instructions: 101registryCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00445639

Part of subcall function 0044555A: __EH_prolog3.LIBCMT ref: 00445561
Part of subcall function 0044555A: RegConnectRegistryA.ADVAPI32(00000000,80000001,?), ref: 004455E3

RegCreateKeyExA.ADVAPI32(?,?,00000000,00000000,?,?,?,?,?,00000000,?,00000008,00451A49,00000000,00020019,00000000), ref: 004456EA
RegOpenKeyExA.KERNEL32(?,?,?,?,?,?,00000008,00451A49,00000000,00020019,00000000,00000000,00000000,00000000,?,0000005C), ref: 0044572A

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: H_prolog3$ConnectCreateOpenRegistry
String ID:
API String ID: 1903319790-0
Opcode ID: 6cb1f7e5de44f9a705ba83b996efca93034e4766672fef9e5a95f2a2f325535d
Instruction ID: 8b76dfa91d09497acb607cc84b412dd7995ac2c98ebe4b08f0be69fc36592031
Opcode Fuzzy Hash: 6cb1f7e5de44f9a705ba83b996efca93034e4766672fef9e5a95f2a2f325535d
Instruction Fuzzy Hash: 6831917150050AEFDF14EFA5C891AAE7BB5FF18314B10462EF416A72E1DB38AA11CB54

Uniqueness

Uniqueness Score: -1.00%

Function 00444467 Relevance: 4.6, APIs: 3, Instructions: 93COMMON

Download Yara Rule

APIs

K32EnumProcesses.KERNEL32(?,00001000,?), ref: 004444B0
_memset.LIBCMT ref: 00444526
CloseHandle.KERNEL32(00000000), ref: 00444562

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: CloseEnumHandleProcesses_memset
String ID:
API String ID: 716639067-0
Opcode ID: 98e159adcf41f94d7fba03eab9677cbe43c1ddb8154a627813625bb765e53ec3
Instruction ID: 9fc98dbffeb1dcd6ea9409312b49427caa0fd5a2fa9704ace820c8fda7a7ad1d
Opcode Fuzzy Hash: 98e159adcf41f94d7fba03eab9677cbe43c1ddb8154a627813625bb765e53ec3
Instruction Fuzzy Hash: D131CF30600614ABEB24DF65DC85AEB77F8FB89749B00446AE646C2151EB78EA448B28

Uniqueness

Uniqueness Score: -1.00%

Function 00449EEE Relevance: 4.6, APIs: 3, Instructions: 83timeCOMMON

Download Yara Rule

APIs

__time64.LIBCMT ref: 00449F08

Part of subcall function 005B5F5F: GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,00439F6A,00000000,00000010,00404C11,** [END] ProcessInBuffer !ReadFromDisk,00000001), ref: 005B5F6A
Part of subcall function 005B5F5F: __aulldiv.LIBCMT ref: 005B5F8A

FileTimeToLocalFileTime.KERNEL32(00000001,?,?), ref: 00449F18
FileTimeToSystemTime.KERNEL32(?,?), ref: 00449F2E

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: Time$File$System$Local__aulldiv__time64
String ID:
API String ID: 1325953181-0
Opcode ID: 7d5eda5d7c17afcaa90afc124eb34680b6a17d4e7f5dbb10a19980429e78bceb
Instruction ID: 137103f93c3a36310d6fcee4b1bc602af07ef2b4b6b640045022c8db07218818
Opcode Fuzzy Hash: 7d5eda5d7c17afcaa90afc124eb34680b6a17d4e7f5dbb10a19980429e78bceb
Instruction Fuzzy Hash: ED217A71A00219AADB188FA8D8416FFB7F8AF08711F10412FF816E6280FB38DD44DB58

Uniqueness

Uniqueness Score: -1.00%

Function 0043F322 Relevance: 4.6, APIs: 3, Instructions: 52stringCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0043F329
lstrlenW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0043F371
__fassign.LIBCMT ref: 0043F389

Part of subcall function 005B7CE6: __wcstombs_l_helper.LIBCMT ref: 005B7CF6

Part of subcall function 004019B2: _strlen.LIBCMT ref: 004019C2

Part of subcall function 00405AB7: __mbsinc.LIBCMT ref: 00405AF2

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: H_prolog3___fassign__mbsinc__wcstombs_l_helper_strlenlstrlen
String ID:
API String ID: 3507903230-0
Opcode ID: bae7098e8de5e4521b4184293ed22974e0d8bac9042f097458197bcfa5bbe6ce
Instruction ID: 01b4a8a456310bc556cf941e9091665af5c5593e7d5aafa74801d30152924d29
Opcode Fuzzy Hash: bae7098e8de5e4521b4184293ed22974e0d8bac9042f097458197bcfa5bbe6ce
Instruction Fuzzy Hash: 71114CB1904108EBCB01AFA5CD49ADDBAF9AF8C308F50405AF001B7252DB796E008BA9

Uniqueness

Uniqueness Score: -1.00%

Function 004C1959 Relevance: 4.5, APIs: 3, Instructions: 37windowCOMMON

Download Yara Rule

APIs

GetMessageA.USER32(00000030,00000000,00000000,00000000), ref: 004C1927
TranslateMessage.USER32(00000030), ref: 004C1946
DispatchMessageA.USER32(00000030), ref: 004C194D

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: Message$DispatchTranslate
String ID:
API String ID: 1706434739-0
Opcode ID: aa67f5c3532f9ed918bb61762df46c0d23c030e8761d42cb2870a2cf1cd8128f
Instruction ID: 3a48fe3be2e58022b0479d476e5cf68954e2b1d9cd1a068b3aa2f2b679990756
Opcode Fuzzy Hash: aa67f5c3532f9ed918bb61762df46c0d23c030e8761d42cb2870a2cf1cd8128f
Instruction Fuzzy Hash: E5F054793141019B97A56B21AD58F3F37ADEF83715305945FF402DA521DB3CDD02C625

Uniqueness

Uniqueness Score: -1.00%

Function 005D78BB Relevance: 4.5, APIs: 3, Instructions: 35COMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,?,00000000,005D7DB0), ref: 005D78E5
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,00000000,005D7DB0), ref: 005D78EF
RtlInitializeCriticalSection.NTDLL(00766CDC), ref: 005D78F8

Part of subcall function 005D77A8: __EH_prolog3.LIBCMT ref: 005D77AF
Part of subcall function 005D77A8: CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,?,?,?,?,00000008,005D790B,?,00000000,005D7DB0), ref: 005D7859

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: CreateEvent$CriticalH_prolog3InitializeSection
String ID:
API String ID: 853632984-0
Opcode ID: 74f18d164a49f984b0b99c8118f0e208d626ed1b16c55c559a80bde23efdfc0f
Instruction ID: 2098cc38ac30defdec77c0c00120e7876c1919a2f17b11f2b2b41c875d04ac40
Opcode Fuzzy Hash: 74f18d164a49f984b0b99c8118f0e208d626ed1b16c55c559a80bde23efdfc0f
Instruction Fuzzy Hash: 3CF030B25047546FD7219FAE9C84D57BBEDFB48714B40442FF18AC3650EAB5B8408B64

Uniqueness

Uniqueness Score: -1.00%

Function 004037D4 Relevance: 4.5, APIs: 3, Instructions: 29windowCOMMON

Download Yara Rule

APIs

TranslateMessage.USER32(?), ref: 004037F0
DispatchMessageA.USER32(?), ref: 004037FA
PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 00403809

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: Message$DispatchPeekTranslate
String ID:
API String ID: 4217535847-0
Opcode ID: 4d1fa65f869119f8eb48531b1783fafcbdb02d815108c4e18a1bd46b40aef0ef
Instruction ID: 230d1a7fd78e38e5e7e2ff1727be3fba21a708245e1fb99df8430c01b9c38188
Opcode Fuzzy Hash: 4d1fa65f869119f8eb48531b1783fafcbdb02d815108c4e18a1bd46b40aef0ef
Instruction Fuzzy Hash: FFE06DB3C0410AA7CF20AFA99C49C9F7FBCAB86701B008063F602E3140E2789602C7B0

Uniqueness

Uniqueness Score: -1.00%

Function 005B99D9 Relevance: 4.5, APIs: 3, Instructions: 19COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 005B99E5

Part of subcall function 005C093E: __getptd_noexit.LIBCMT ref: 005C0941
Part of subcall function 005C093E: __amsg_exit.LIBCMT ref: 005C094E

__endthreadex.LIBCMT ref: 005B99F5

Part of subcall function 005B99BA: __getptd_noexit.LIBCMT ref: 005B99BF
Part of subcall function 005B99BA: __freeptd.LIBCMT ref: 005B99C9
Part of subcall function 005B99BA: RtlExitUserThread.NTDLL(?,?,005B99FA,00000000), ref: 005B99D2
Part of subcall function 005B99BA: __XcptFilter.LIBCMT ref: 005B9A06

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: __getptd_noexit$ExitFilterThreadUserXcpt__amsg_exit__endthreadex__freeptd__getptd
String ID:
API String ID: 4175385852-0
Opcode ID: 0f845f3f70725221d37237fa4b6275f3d2e7307b0e17be4a80889d17d95b1443
Instruction ID: f6b0f23288c684e4ba658460e8918f9fb5ab2923cc7bb97a4101bc6ba6eebf78
Opcode Fuzzy Hash: 0f845f3f70725221d37237fa4b6275f3d2e7307b0e17be4a80889d17d95b1443
Instruction Fuzzy Hash: EEE0ECB19456059FEB08EBA0C85AF6D7F65FF85701F21404CF2015B2A2CA79AD40DF21

Uniqueness

Uniqueness Score: -1.00%

Function 004049DA Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 145COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 004049E1

Part of subcall function 0040962D: SetFilePointer.KERNEL32(?,00000000,00000000,00000001,?,?,?,?,00403CB6,?,?,?,?,?,?,00000000), ref: 0040964D

Strings

%s.%d, xrefs: 00404AD8

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: FileH_prolog3_catchPointer
String ID: %s.%d
API String ID: 1029581113-645285463
Opcode ID: 2cf28d0d7dbde8d696b693a3b024b2cc82cbbe99989841bf7c5819284448bd2d
Instruction ID: f6bfabe15112e10d2021aedb37b825e30a7ba2fe20c25d73c94819169403aa61
Opcode Fuzzy Hash: 2cf28d0d7dbde8d696b693a3b024b2cc82cbbe99989841bf7c5819284448bd2d
Instruction Fuzzy Hash: B15160B1900609DFCB14DFA4C981AAFB7B4BF84314F10452EE566B76C1CB38BA00CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00403DC6 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 122COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 00403DCD

Part of subcall function 00441FC9: __EH_prolog3.LIBCMT ref: 00441FD0

Strings

INSTALL_STAGE_INSTALLING_FILES, xrefs: 00403EED

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: H_prolog3H_prolog3_catch
String ID: INSTALL_STAGE_INSTALLING_FILES
API String ID: 1882928916-3727005748
Opcode ID: 6e002a23081e2c4f35d0827096b97d1c2ea42e4049f0585ad7a5560914da30d0
Instruction ID: 4c4b225032fc98407ecc922abed6584a764cdc155a9d17f40ffa592a14ad15ef
Opcode Fuzzy Hash: 6e002a23081e2c4f35d0827096b97d1c2ea42e4049f0585ad7a5560914da30d0
Instruction Fuzzy Hash: 3F516771D1060A9BCB14DFA6C8556EEBBF1FF48322F20851DE452B76A0DB386A05CF94

Uniqueness

Uniqueness Score: -1.00%

Function 00405D33 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 84COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00405D3A

Strings

--@@, xrefs: 00405D7F

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: H_prolog3
String ID: --@@
API String ID: 431132790-3308024793
Opcode ID: 78ceb95e7cfcb1bc6b59dba87163bc5351280eb06869bca0bf503ec8fc5a9fda
Instruction ID: ac2b5ca2e8aad6e44eb1495fd6908b05e63b1d67ac6e56c3b5bf998b027f2299
Opcode Fuzzy Hash: 78ceb95e7cfcb1bc6b59dba87163bc5351280eb06869bca0bf503ec8fc5a9fda
Instruction Fuzzy Hash: 373164719005099BCB04EBF8C856AEF7768AF25328F14835EB526B72D2DB386604CB65

Uniqueness

Uniqueness Score: -1.00%

Function 004B3C8A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 23COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 004B3CA8

Part of subcall function 005B4B83: __FF_MSGBANNER.LIBCMT ref: 005B4B9C
Part of subcall function 005B4B83: __NMSG_WRITE.LIBCMT ref: 005B4BA3
Part of subcall function 005B4B83: RtlAllocateHeap.NTDLL(00000000,00000001,00000001), ref: 005B4BC8

Strings

n<K, xrefs: 004B3C92

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: AllocateHeap_malloc
String ID: n<K
API String ID: 501242067-804642527
Opcode ID: 70ccda7115b5538b9a355c173a85d747d9f10a4687382083b19c9700fd6030eb
Instruction ID: 425f89b3e108cb1748da0adde01facfce3b2915990464791145b534aac679131
Opcode Fuzzy Hash: 70ccda7115b5538b9a355c173a85d747d9f10a4687382083b19c9700fd6030eb
Instruction Fuzzy Hash: BBD0C23320811E675A211ED6DC005D6BF68AB817B13054022BC04E6210EA15DE0146E8

Uniqueness

Uniqueness Score: -1.00%

Function 00444138 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 11COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,00000000), ref: 00444151

Strings

+DD, xrefs: 00444138

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: FreeLibrary
String ID: +DD
API String ID: 3664257935-788365211
Opcode ID: 7fa69a98f222113d5d6a5682390afbc78be1dae08846f69be65ebfc48afb6bc1
Instruction ID: cb3643c5b2b4d7173b6a84c2f193ec15d5db4b101370a3427a0e7ffe636a3bd2
Opcode Fuzzy Hash: 7fa69a98f222113d5d6a5682390afbc78be1dae08846f69be65ebfc48afb6bc1
Instruction Fuzzy Hash: 45D0C9795102108BF7118F22EC0D71236A9B7A6726F40C85BD4118A1A0C7FDC884CF28

Uniqueness

Uniqueness Score: -1.00%

Function 0043FB28 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(UxTheme.dll), ref: 0043FB3A

Strings

UxTheme.dll, xrefs: 0043FB2F

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: LibraryLoad
String ID: UxTheme.dll
API String ID: 1029625771-352951104
Opcode ID: e22393b03e469b2d5d625147a5e59620f4a3889966a02facf619b83408b1e9d6
Instruction ID: 0d1182f4eae971cf662eb17ef7ed9b1b947267e5cd31cab848660cfb067bf13b
Opcode Fuzzy Hash: e22393b03e469b2d5d625147a5e59620f4a3889966a02facf619b83408b1e9d6
Instruction Fuzzy Hash: 69C08C712123208FE3606F18AC06385BAE9EB87B2AF01A41FE899C3700C3B46C008F84

Uniqueness

Uniqueness Score: -1.00%

Function 00409082 Relevance: 3.2, APIs: 2, Instructions: 173COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00409133
_memset.LIBCMT ref: 00409147

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: e6244bb53d62b9827d2097a900e9ea0134b4e67a69c837c7211b87c66968b982
Instruction ID: 623ab72a5c3815ca52f40d0e73931cc74145f66951075847e6e990ea1ec32dd3
Opcode Fuzzy Hash: e6244bb53d62b9827d2097a900e9ea0134b4e67a69c837c7211b87c66968b982
Instruction Fuzzy Hash: 35612FB194421DAFEF24CF64CCC4BDAB7B9AB08300F0044FAE549B6282D6749E94DF55

Uniqueness

Uniqueness Score: -1.00%

Function 00484443 Relevance: 3.1, APIs: 2, Instructions: 113COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0048444A

Part of subcall function 00461B2A: __EH_prolog3.LIBCMT ref: 00461B31

Part of subcall function 004825AF: __EH_prolog3.LIBCMT ref: 004825B6

_strlen.LIBCMT ref: 004844CE

Part of subcall function 00403C07: _strnlen.LIBCMT ref: 00403C37
Part of subcall function 00403C07: _memcpy_s.LIBCMT ref: 00403C6B

Part of subcall function 004014A6: _memcpy_s.LIBCMT ref: 004014F6

Part of subcall function 0044A6E6: __EH_prolog3.LIBCMT ref: 0044A6ED

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: H_prolog3$_memcpy_s$_strlen_strnlen
String ID:
API String ID: 3956432433-0
Opcode ID: 2a6e9c8a6c2f35bb26e462877923e92feef1b0dacecf4ba4a417432369dc280d
Instruction ID: 3663a5e60db5b3be0c3d28bc635fcabb65245f9e12fbb19a086d4e65796cdba2
Opcode Fuzzy Hash: 2a6e9c8a6c2f35bb26e462877923e92feef1b0dacecf4ba4a417432369dc280d
Instruction Fuzzy Hash: 25417371D00205AFDB14EBA9CC829BFB7B8EF55334B55061EF161B72D2DA385D008BA9

Uniqueness

Uniqueness Score: -1.00%

Function 005D77A8 Relevance: 3.1, APIs: 2, Instructions: 96COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 005D77AF

Part of subcall function 005D6FDF: SetEvent.KERNEL32(?,005D77E1,00000008,005D790B,?,00000000,005D7DB0), ref: 005D6FE2

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,?,?,?,?,00000008,005D790B,?,00000000,005D7DB0), ref: 005D7859

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: Event$CreateH_prolog3
String ID:
API String ID: 4200046576-0
Opcode ID: eb9662040770b0ae103a3b2a949fc92bca1c798c017083df6be7ced9e22b9e16
Instruction ID: 3f04adaf6d1f566f914da4d060858ce2c58529d2388c069fb698ef11150c0f4f
Opcode Fuzzy Hash: eb9662040770b0ae103a3b2a949fc92bca1c798c017083df6be7ced9e22b9e16
Instruction Fuzzy Hash: C131943190450BAFDB24EFB8C99997EBBB5FF48301B00862BA41597781EB30E951DB91

Uniqueness

Uniqueness Score: -1.00%

Function 004C6877 Relevance: 3.1, APIs: 2, Instructions: 70windowCOMMON

Download Yara Rule

APIs

LoadMenuA.USER32(?,?), ref: 004C6897
DestroyMenu.USER32(?,?,?,?,?,?,?,00000000,?,?,?,?,?,0041042D,?,Setup Application), ref: 004C6912

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: Menu$DestroyLoad
String ID:
API String ID: 588275208-0
Opcode ID: 0a5e2cf5542b02355b5516374b6d399ab414f2b15756e9a757885ce1624bb07c
Instruction ID: 2cc6ca7f52f195958bdf57bedeb10de36ddf9c34aded3a0349cb1698e3ef9203
Opcode Fuzzy Hash: 0a5e2cf5542b02355b5516374b6d399ab414f2b15756e9a757885ce1624bb07c
Instruction Fuzzy Hash: 24214979600109EFCF01DF55C948DAA7BBAFF88350B22846AF84597221D735DE21DF64

Uniqueness

Uniqueness Score: -1.00%

Function 00404E52 Relevance: 3.1, APIs: 2, Instructions: 70COMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNEL32(?,00000080), ref: 00404E7A

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: b6dbd0e1bd343ddd81bc5c63ddd5315ba9a2b431d7f4237d61069310423c1954
Instruction ID: 10466322e316144fae4e3b0826e3eda4152b836e30990e096f2836929df9b740
Opcode Fuzzy Hash: b6dbd0e1bd343ddd81bc5c63ddd5315ba9a2b431d7f4237d61069310423c1954
Instruction Fuzzy Hash: DA213BB5600205EFD7209F25D88095ABBB5FF88355B20883EF6499A690C735E980CBD4

Uniqueness

Uniqueness Score: -1.00%

Function 00404EF6 Relevance: 3.1, APIs: 2, Instructions: 64fileCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 00404EFD
DeleteFileA.KERNEL32(?,0000000C), ref: 00404FAA

Part of subcall function 0040962D: SetFilePointer.KERNEL32(?,00000000,00000000,00000001,?,?,?,?,00403CB6,?,?,?,?,?,?,00000000), ref: 0040964D

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: File$DeleteH_prolog3_catchPointer
String ID:
API String ID: 3963598556-0
Opcode ID: a9ddcca6dbf9c5edc2f42dfc23696fc8e075db968b7a8cf04f83ec110f14a5d3
Instruction ID: 9709beac7b1e45319a93a47515ac78f7f2f47d48cd15239805dedf14955f40cd
Opcode Fuzzy Hash: a9ddcca6dbf9c5edc2f42dfc23696fc8e075db968b7a8cf04f83ec110f14a5d3
Instruction Fuzzy Hash: 5C11AFB1600606DFCB21DF65888195B7BA1FFC5704B24843EFB05A6281D639D890CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 004BCFA0 Relevance: 3.1, APIs: 2, Instructions: 58COMMON

Download Yara Rule

APIs

Part of subcall function 004B87F6: GetWindowLongA.USER32(?,000000F0), ref: 004B8801

GetWindowRect.USER32(?,?), ref: 004BCFE3
GetWindow.USER32(?,00000004), ref: 004BD000

Part of subcall function 004B8974: IsWindowEnabled.USER32(?), ref: 004B897D

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: Window$EnabledLongRect
String ID:
API String ID: 3170195891-0
Opcode ID: 57b31ca22d54c06492331068916c95bde77e0bf4c651ab53af9036eb318f0feb
Instruction ID: 51950e6a6e8df0d008177dc4729bea961426fc9a1b35c00e95105864991f6082
Opcode Fuzzy Hash: 57b31ca22d54c06492331068916c95bde77e0bf4c651ab53af9036eb318f0feb
Instruction Fuzzy Hash: 72116030A002049BCF24EF6AC844AEFB7F9AF98754F50009BE401A7211EB78DD42CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00401144 Relevance: 3.1, APIs: 2, Instructions: 57COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,?,?,00000000), ref: 0040118C
GetLastError.KERNEL32(?,?,00000000), ref: 0040119A

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: e71ff78fe9d1d678931d00fdb003892f89a636c29b92c59c42d52dd7430c14a9
Instruction ID: 0e2aaf0c3e0af77ff8604a9acf290ee6c5f290eec8fbce575e00f235865a8dfe
Opcode Fuzzy Hash: e71ff78fe9d1d678931d00fdb003892f89a636c29b92c59c42d52dd7430c14a9
Instruction Fuzzy Hash: 2A01C471A10105BFCB18CF68D845EABB7F9EF4C710F24893BE612EB3A0D63499019B54

Uniqueness

Uniqueness Score: -1.00%

Function 0040F8A9 Relevance: 3.1, APIs: 2, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0040F8B0
DeleteObject.GDI32(?), ref: 0040F912

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: DeleteH_prolog3Object
String ID:
API String ID: 2942389277-0
Opcode ID: 706ebbc755093a5d9d8a18f64f7e8e886ba9319beb28ab5bbd1b3db866458dcb
Instruction ID: e3de53362e35915b99009c0e59d36622c7380ccfe596ee9b6f8297171005c6bd
Opcode Fuzzy Hash: 706ebbc755093a5d9d8a18f64f7e8e886ba9319beb28ab5bbd1b3db866458dcb
Instruction Fuzzy Hash: F721D170401B00DECB35EB68C9553EEBBA1AF40308F64856ED056276C6DB7D2A09CB2A

Uniqueness

Uniqueness Score: -1.00%

Function 0041D6A7 Relevance: 3.0, APIs: 2, Instructions: 45COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0041D6AE

Part of subcall function 00405AB7: __mbsinc.LIBCMT ref: 00405AF2

_strlen.LIBCMT ref: 0041D6D9

Part of subcall function 00403C07: _strnlen.LIBCMT ref: 00403C37
Part of subcall function 00403C07: _memcpy_s.LIBCMT ref: 00403C6B

Part of subcall function 00406EB6: __EH_prolog3.LIBCMT ref: 00406EBD
Part of subcall function 00406EB6: _strlen.LIBCMT ref: 00406F7A
Part of subcall function 00406EB6: IsWindow.USER32(?), ref: 00406FB7
Part of subcall function 00406EB6: RedrawWindow.USER32(?,00000000,00000000,00000105,00000005), ref: 00407000

Part of subcall function 0041D295: _memset.LIBCMT ref: 0041D328
Part of subcall function 0041D295: MessageBoxA.USER32(00000000,?,026282D8,00000010), ref: 0041D38E

Part of subcall function 004053C5: IsWindow.USER32(?), ref: 004053D5

Part of subcall function 00405435: _strnlen.LIBCMT ref: 0040544E

Part of subcall function 0040F7D6: __EH_prolog3_catch_GS.LIBCMT ref: 0040F7E0

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: Window$H_prolog3_strlen_strnlen$H_prolog3_catch_MessageRedraw__mbsinc_memcpy_s_memset
String ID:
API String ID: 2626163449-0
Opcode ID: c12d348f4e870654fca48f28d7014525eb314eaa7539487b0cfde81e42b4b109
Instruction ID: 3d2cb502150bf57fa9faceea8c7b04f658fa715f275df4c26581434b428963e9
Opcode Fuzzy Hash: c12d348f4e870654fca48f28d7014525eb314eaa7539487b0cfde81e42b4b109
Instruction Fuzzy Hash: 6F015B35500148ABDB08FF65C856BED3B25AF51328F00816EB8156B2D2DF78AA44CA99

Uniqueness

Uniqueness Score: -1.00%

Function 0040181F Relevance: 3.0, APIs: 2, Instructions: 44COMMON

Download Yara Rule

APIs

_memmove_s.LIBCMT ref: 00401866

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: _memmove_s
String ID:
API String ID: 800865076-0
Opcode ID: 96b1094e8ff69239307f6b243ab5d868c27e43372049561afe5f8bbafe7f33c0
Instruction ID: f27183513869212a4da24ad4136747741623ac209ef4a67712c033fab610d61f
Opcode Fuzzy Hash: 96b1094e8ff69239307f6b243ab5d868c27e43372049561afe5f8bbafe7f33c0
Instruction Fuzzy Hash: 3F018B32500108ABCF11BF95C885DADB769EF44354B50812BFD057B2A1DB3A9D60DF59

Uniqueness

Uniqueness Score: -1.00%

Function 004C0694 Relevance: 3.0, APIs: 2, Instructions: 35COMMON

Download Yara Rule

APIs

GetWindowTextLengthA.USER32(00000000), ref: 004C06B7
GetWindowTextA.USER32(00000000,00000000,00000000), ref: 004C06CC

Part of subcall function 00405435: _strnlen.LIBCMT ref: 0040544E

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: TextWindow$Length_strnlen
String ID:
API String ID: 1159536582-0
Opcode ID: 076fd303d090c406907696a15ca8f38f2f6930f6e85743e471de7f63f5c2e697
Instruction ID: 5c4937c2e2e014ec81a48cf3809eaa955872ad50b593ebb93feaca9ee9590088
Opcode Fuzzy Hash: 076fd303d090c406907696a15ca8f38f2f6930f6e85743e471de7f63f5c2e697
Instruction Fuzzy Hash: 62F09036104248EBCB01AF96DC18EBF37A9EBC9320B04401FF92587290CA389451CB65

Uniqueness

Uniqueness Score: -1.00%

Function 0040588A Relevance: 3.0, APIs: 2, Instructions: 33COMMON

Download Yara Rule

APIs

_memcpy_s.LIBCMT ref: 004058AB
_memcpy_s.LIBCMT ref: 004058BB

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: _memcpy_s
String ID:
API String ID: 2001391462-0
Opcode ID: bf3270726b1e6cdd97388ec0c93b56f6992d1f98cd07fd050026713c04a19370
Instruction ID: e10f8e0dd46059571d7913495a7d2d67f72b569096e9015733705064427d2858
Opcode Fuzzy Hash: bf3270726b1e6cdd97388ec0c93b56f6992d1f98cd07fd050026713c04a19370
Instruction Fuzzy Hash: 69F012715012597BCF10AF56DC89CEF7F6CEE85754704041AFD1957212D634F960CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 004BE3EF Relevance: 3.0, APIs: 2, Instructions: 32threadCOMMON

Download Yara Rule

APIs

Part of subcall function 004D303F: __EH_prolog3.LIBCMT ref: 004D3046

GetCurrentThreadId.KERNEL32 ref: 004BE41E
SetWindowsHookExA.USER32(00000005,004BE1A8,00000000,00000000), ref: 004BE42E

Part of subcall function 004B4C5C: __CxxThrowException@8.LIBCMT ref: 004B4C72
Part of subcall function 004B4C5C: __EH_prolog3.LIBCMT ref: 004B4C7F

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: H_prolog3$CurrentException@8HookThreadThrowWindows
String ID:
API String ID: 1415497866-0
Opcode ID: 7ea2ca7ad50fe30f72e350f3ae467c7ca8a0107d4785d3a0b0e26a16f7bebcb8
Instruction ID: 5780401fc2edf1c90f2b31025af2906d046a794e948bb3c981230ab5b122f8ef
Opcode Fuzzy Hash: 7ea2ca7ad50fe30f72e350f3ae467c7ca8a0107d4785d3a0b0e26a16f7bebcb8
Instruction Fuzzy Hash: E1F0E23124071067CB302B979806BD77AB9DBC0F6AF16052BE60546641CA78A84086BF

Uniqueness

Uniqueness Score: -1.00%

Function 004C1D43 Relevance: 3.0, APIs: 2, Instructions: 32fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000,7FFFFFFF,80000000,?,004045D4,?,00000000,?,00008000,?,00009011,00000000), ref: 004C1D60
GetLastError.KERNEL32(?,?,004045D4,?,00000000,?,00008000,?,00009011,00000000), ref: 004C1D6D

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID:
API String ID: 442123175-0
Opcode ID: e6761d8dcf3d84b2c9de5956123e1aac6d773a16725031e72b32f39b8c96ff8f
Instruction ID: bba89665e96726043d0c1c17ca459907c87cbe3a3f05df843f4ecd94134bdc27
Opcode Fuzzy Hash: e6761d8dcf3d84b2c9de5956123e1aac6d773a16725031e72b32f39b8c96ff8f
Instruction Fuzzy Hash: 3EF0A73A1006047BCB605F56DC04F57BB6DEF85731F10821FF92E95660DA35E800DBA4

Uniqueness

Uniqueness Score: -1.00%

Function 004B8882 Relevance: 3.0, APIs: 2, Instructions: 27COMMON

Download Yara Rule

APIs

IsWindow.USER32(?), ref: 004B8896

Part of subcall function 004B4C5C: __CxxThrowException@8.LIBCMT ref: 004B4C72
Part of subcall function 004B4C5C: __EH_prolog3.LIBCMT ref: 004B4C7F

SetWindowTextA.USER32(?,?), ref: 004B88BE

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: Window$Exception@8H_prolog3TextThrow
String ID:
API String ID: 3347280681-0
Opcode ID: 2adde007ad8db28b4545fceeac66a921ebe40eb5de8707ca7c98ba86bc1df595
Instruction ID: b5b46e4a1b6d179fca3762e1ded8144ada2f057a2d06b49014b07af564602dbf
Opcode Fuzzy Hash: 2adde007ad8db28b4545fceeac66a921ebe40eb5de8707ca7c98ba86bc1df595
Instruction Fuzzy Hash: AFF08C32100605DFCB306B55D808A97BBA9FB54361F44443FE58582A20DB359840CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 004C1FA7 Relevance: 3.0, APIs: 2, Instructions: 27COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNEL32(?,?,00008DD8,004038C7,EDB88320,?,00008020,00000000,00000024), ref: 004C1FB8
GetLastError.KERNEL32(?,?,00008DD8,004038C7,EDB88320,?,00008020,00000000,00000024), ref: 004C1FDC

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: ChangeCloseErrorFindLastNotification
String ID:
API String ID: 1687624791-0
Opcode ID: 059c31a56d95eb913fe4fb4bbcd500cde0c0e45f3636628489fcb700f6683d50
Instruction ID: a43b792bec2f9e45bfe62cee496a7570d5e44b3cba210efd4c3b665b0893fab3
Opcode Fuzzy Hash: 059c31a56d95eb913fe4fb4bbcd500cde0c0e45f3636628489fcb700f6683d50
Instruction Fuzzy Hash: BFE06D360046105BC7209A39EC48E6777E9AFC57357258B1EF57AC75F08F3498068614

Uniqueness

Uniqueness Score: -1.00%

Function 004BABDD Relevance: 3.0, APIs: 2, Instructions: 26COMMON

Download Yara Rule

APIs

ActivateActCtx.KERNEL32(?,?,0072C050,00000010,004D5360,?,?,00000000,?,Button), ref: 004BABFD
GetClassInfoA.USER32(?,?,?), ref: 004BAC1A

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: ActivateClassInfo
String ID:
API String ID: 1231007168-0
Opcode ID: 77d7a105247b624b27cf17d56ef42589795aba53838bccdeb988b3c7aef9f8b5
Instruction ID: 93bc917edbfcb538415c6bcd59c112f5191d159347ea46cae13ffd3b71495c16
Opcode Fuzzy Hash: 77d7a105247b624b27cf17d56ef42589795aba53838bccdeb988b3c7aef9f8b5
Instruction Fuzzy Hash: 80F05870800219EBCF21AFA4DD09AEDBEB4BF08710F50806AF514A2161C7388A21DFA9

Uniqueness

Uniqueness Score: -1.00%

Function 004C1D01 Relevance: 3.0, APIs: 2, Instructions: 26fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,00000000,00000000,00000000,00008DD8,?,004038BB,00000000,00008DD8,EDB88320,?,00008020,00000000,00000024), ref: 004C1D22
GetLastError.KERNEL32(?,?,004038BB,00000000,00008DD8,EDB88320,?,00008020,00000000,00000024), ref: 004C1D2F

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: ErrorFileLastRead
String ID:
API String ID: 1948546556-0
Opcode ID: 18302fceabd99679a17bae29bcaff061beada81ef654700ac36232b7d24a2d63
Instruction ID: fd2bbd7cfda3389531d2f27ff3c117c5a8d308a07c58243a45473a648bd7f24b
Opcode Fuzzy Hash: 18302fceabd99679a17bae29bcaff061beada81ef654700ac36232b7d24a2d63
Instruction Fuzzy Hash: 0BE0923A100208BBCF509F50DC04F9677ADEB18320F50C82AFA2AC6421D738E910DB94

Uniqueness

Uniqueness Score: -1.00%

Function 004BAEB1 Relevance: 3.0, APIs: 2, Instructions: 24libraryCOMMON

Download Yara Rule

APIs

ActivateActCtx.KERNEL32(?,00000000,0072C0F0,00000010,0050A8A2,UxTheme.dll,751F6910,?,0050A963,00000004,004E9366,00000000,00000004,0051D8CE), ref: 004BAED1
LoadLibraryW.KERNEL32(00000020,?,0050A963,00000004,004E9366,00000000,00000004,0051D8CE,?,?,006B8DE4), ref: 004BAEE8

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: ActivateLibraryLoad
String ID:
API String ID: 389599620-0
Opcode ID: a9e812d374c1d48b38ac055401c7988ba03ed6a33c3c6b4a47f94ebeb48c11ff
Instruction ID: cfe34e711cd43dd5e217eb46453094d7ca14ef23f7d9b5981eb0129c798481fb
Opcode Fuzzy Hash: a9e812d374c1d48b38ac055401c7988ba03ed6a33c3c6b4a47f94ebeb48c11ff
Instruction Fuzzy Hash: 6AF01CB0C14219ABCF61AFA4DC09AEDBEB8BF08B10F108556F115A2151C6785A51DBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0040F67A Relevance: 3.0, APIs: 2, Instructions: 20windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0042CA05: __EH_prolog3.LIBCMT ref: 0042CA0C

IsWindow.USER32(?), ref: 0040F696
SendMessageA.USER32(?,00000010), ref: 0040F6A7

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: H_prolog3MessageSendWindow
String ID:
API String ID: 3000044278-0
Opcode ID: 7595935588cfea26c5f06aa20456d9b8895b6bb68a2a4329c49106542488ffe3
Instruction ID: 03369c3d16597eb84a1caa73f82033c6e61af4135baf6c86965da822f5626120
Opcode Fuzzy Hash: 7595935588cfea26c5f06aa20456d9b8895b6bb68a2a4329c49106542488ffe3
Instruction Fuzzy Hash: 63E012305156009BDB349F31DC09A5ABA79FB55354B404A3BA082918B0FB395956DE1C

Uniqueness

Uniqueness Score: -1.00%

Function 004BBBF7 Relevance: 3.0, APIs: 2, Instructions: 19libraryCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,004C811C,GetSaveFileNameA,?,?,004C8174,?,?,004C8CB6,?,?), ref: 004BBC05
LoadLibraryA.KERNEL32(?,?,004C811C,GetSaveFileNameA,?,?,004C8174,?,?,004C8CB6,?,?), ref: 004BBC15

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: HandleLibraryLoadModule
String ID:
API String ID: 4133054770-0
Opcode ID: 07f7d6879b2a58102f4be396a89d8d8712eab542e092b3d5ce5f6796f8dcb6f3
Instruction ID: 5e6668458fcd90784bfeccb0b20360c76bfb35b5799bf70c213c30286e767599
Opcode Fuzzy Hash: 07f7d6879b2a58102f4be396a89d8d8712eab542e092b3d5ce5f6796f8dcb6f3
Instruction Fuzzy Hash: BAE0B671515B11DFCB318F35E944A93BBE9EF54720B15C82EE4AAC2A20DB75E840DB50

Uniqueness

Uniqueness Score: -1.00%

Function 005C7155 Relevance: 3.0, APIs: 2, Instructions: 18COMMON

Download Yara Rule

APIs

__lock.LIBCMT ref: 005C716D

Part of subcall function 005C43D8: __mtinitlocknum.LIBCMT ref: 005C43EE
Part of subcall function 005C43D8: __amsg_exit.LIBCMT ref: 005C43FA
Part of subcall function 005C43D8: RtlEnterCriticalSection.NTDLL(?), ref: 005C4402

__tzset_nolock.LIBCMT ref: 005C717E

Part of subcall function 005C6A74: __lock.LIBCMT ref: 005C6A96
Part of subcall function 005C6A74: ____lc_codepage_func.LIBCMT ref: 005C6ADD
Part of subcall function 005C6A74: __getenv_helper_nolock.LIBCMT ref: 005C6AFF
Part of subcall function 005C6A74: _free.LIBCMT ref: 005C6B36
Part of subcall function 005C6A74: _strlen.LIBCMT ref: 005C6B3D
Part of subcall function 005C6A74: __malloc_crt.LIBCMT ref: 005C6B44
Part of subcall function 005C6A74: _strlen.LIBCMT ref: 005C6B5A
Part of subcall function 005C6A74: _strcpy_s.LIBCMT ref: 005C6B68
Part of subcall function 005C6A74: __invoke_watson.LIBCMT ref: 005C6B7D
Part of subcall function 005C6A74: _free.LIBCMT ref: 005C6B8C

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: __lock_free_strlen$CriticalEnterSection____lc_codepage_func__amsg_exit__getenv_helper_nolock__invoke_watson__malloc_crt__mtinitlocknum__tzset_nolock_strcpy_s
String ID:
API String ID: 1828324828-0
Opcode ID: ff786fe9bfa2bf07301908f0dc04e50a6070698d31f686b2c370f685a4b4868f
Instruction ID: 11e3c72a1d31639d79664520584639fe690179cdb0575dad52ce0903828aca3c
Opcode Fuzzy Hash: ff786fe9bfa2bf07301908f0dc04e50a6070698d31f686b2c370f685a4b4868f
Instruction Fuzzy Hash: 5EE08C70495B569EC6256BE0691AF8CBD24BB88B23F248129B040294C2CAB81681CAE6

Uniqueness

Uniqueness Score: -1.00%

Function 005B600F Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

___crtCorExitProcess.LIBCMT ref: 005B6017

Part of subcall function 005B5FE4: GetModuleHandleW.KERNEL32(mscoree.dll,?,005B601C,?,?,005B4BB2,000000FF,0000001E,00000001,00000000,00000000,?,005C4E2D,?,00000001,?), ref: 005B5FEE
Part of subcall function 005B5FE4: GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 005B5FFE

ExitProcess.KERNEL32 ref: 005B6020

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: ExitProcess$AddressHandleModuleProc___crt
String ID:
API String ID: 2427264223-0
Opcode ID: eb5ddc89799c9acec53768ca0820a2e9a94691fcade5ddb4911107f1734abd1a
Instruction ID: 30af643087ab2adc2d35e2618f40d49e364d81bcbec9b2c30b68a258173e47b9
Opcode Fuzzy Hash: eb5ddc89799c9acec53768ca0820a2e9a94691fcade5ddb4911107f1734abd1a
Instruction Fuzzy Hash: FEB09231008108BBCF053F52DC0EC997F2AFB803A1B18606AFC0809071EF72AD92EA80

Uniqueness

Uniqueness Score: -1.00%

Function 004392B1 Relevance: 2.0, APIs: 1, Instructions: 525COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004392B8

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: b54ee6c07d3b9ad21387d1238cfcfde01e7e7b4555c61abd5c7f95925b75f0b8
Instruction ID: 34cfd3ddcf7c302560ad8dc5e815c8d582334ae0fa4df6f7174739a4f93885d4
Opcode Fuzzy Hash: b54ee6c07d3b9ad21387d1238cfcfde01e7e7b4555c61abd5c7f95925b75f0b8
Instruction Fuzzy Hash: FD024F71200A046FC656E76688A1FBE77EF6F8D304F08081EF19BD2192DF2DA5469B25

Uniqueness

Uniqueness Score: -1.00%

Function 004C2494 Relevance: 1.6, APIs: 1, Instructions: 146fileCOMMON

Download Yara Rule

APIs

Part of subcall function 004C2293: __EH_prolog3_GS.LIBCMT ref: 004C229D
Part of subcall function 004C2293: GetFullPathNameA.KERNEL32(00000000,00000104,?,?,00000158,004C2516,?,00000000,?,?,00008DD8,00000000), ref: 004C22DB
Part of subcall function 004C2293: __cftof.LIBCMT ref: 004C22EF

Part of subcall function 004019B2: _strlen.LIBCMT ref: 004019C2

CreateFileA.KERNEL32(00000000,80000000,00000000,0000000C,00000003,00000080,00000000,?,?,00000000,?,?,00008DD8,00000000), ref: 004C2631

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: CreateFileFullH_prolog3_NamePath__cftof_strlen
String ID:
API String ID: 3007231952-0
Opcode ID: f41c2b953a5b2a5d399d489937771e1a2f79567923e31cd65ff6f88e3fb6b36c
Instruction ID: ff9cb5e6a695ad4d079df55aad441010118bf4e6c243a329ae6933dbcf602d0e
Opcode Fuzzy Hash: f41c2b953a5b2a5d399d489937771e1a2f79567923e31cd65ff6f88e3fb6b36c
Instruction Fuzzy Hash: D351E279600209ABEB65CB15CE52FEBB7A4EB44304F10469FE156D2290D7FC9AC1CF58

Uniqueness

Uniqueness Score: -1.00%

Function 0041936F Relevance: 1.6, APIs: 1, Instructions: 127COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00419376

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: 91074d5cbc61c23ce122bd56be1a14e547e5e16098cf9f53adf33df1a250c558
Instruction ID: b6eee3dec6818e159f9845e6a404ee987187129b1927a62353b5342264f8e3f4
Opcode Fuzzy Hash: 91074d5cbc61c23ce122bd56be1a14e547e5e16098cf9f53adf33df1a250c558
Instruction Fuzzy Hash: 22519E30600744CBCB28EFF5C5A57EEB7A1AF65304F1049AED0ABA7282CF786944C719

Uniqueness

Uniqueness Score: -1.00%

Function 00419E06 Relevance: 1.6, APIs: 1, Instructions: 115COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00419E0D

Part of subcall function 00410A95: __EH_prolog3.LIBCMT ref: 00410A9C

Part of subcall function 0043F48F: __EH_prolog3.LIBCMT ref: 0043F496

Part of subcall function 0043F5B2: __EH_prolog3.LIBCMT ref: 0043F5B9

Part of subcall function 00401BAB: __EH_prolog3.LIBCMT ref: 00401BB2

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: ce18bebf4519b9a2f455ce5f8d78bec6a95f9a0cbefa2adb54ec09467f166b3c
Instruction ID: 47e46f9915befb007c79a4bf2bee00be7471ee70f50fcf2a21a9439a16f8553d
Opcode Fuzzy Hash: ce18bebf4519b9a2f455ce5f8d78bec6a95f9a0cbefa2adb54ec09467f166b3c
Instruction Fuzzy Hash: BE517134800684EDD716F7B5C956BDEBBA81F21308F80449EA09BA71D3DE786608D77E

Uniqueness

Uniqueness Score: -1.00%

Function 004B5F92 Relevance: 1.6, APIs: 1, Instructions: 98COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004B5F99

Part of subcall function 004B4C5C: __CxxThrowException@8.LIBCMT ref: 004B4C72
Part of subcall function 004B4C5C: __EH_prolog3.LIBCMT ref: 004B4C7F

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: H_prolog3$Exception@8Throw
String ID:
API String ID: 2489616738-0
Opcode ID: 744b44ba779d7d81834d278857956b34d24a7b0d765aa13c3240b71712506d9b
Instruction ID: 09910c88cec7e345d8f6d56538c75f10c720b5706539e86f403e1ac97648194b
Opcode Fuzzy Hash: 744b44ba779d7d81834d278857956b34d24a7b0d765aa13c3240b71712506d9b
Instruction Fuzzy Hash: 76415FB1500B018FD728DF6AC49166ABBF5FF58304B004A2EE09B87B91D738B905CB54

Uniqueness

Uniqueness Score: -1.00%

Function 004D2A03 Relevance: 1.6, APIs: 1, Instructions: 82COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004D2A77

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: fd39d0818b8892fd6da4b0b0c4f91ae7244d35f2ec04f83597fca4d127a3c411
Instruction ID: 3783f46d9874d75426d8784619e32ef5638b64024784f4afb11b78df1a36e4f5
Opcode Fuzzy Hash: fd39d0818b8892fd6da4b0b0c4f91ae7244d35f2ec04f83597fca4d127a3c411
Instruction Fuzzy Hash: EC2126322006196BC330EE9EC991D9B7799EFD1368710862FF9288B341DA75FD05C794

Uniqueness

Uniqueness Score: -1.00%

Function 004019D8 Relevance: 1.6, APIs: 1, Instructions: 80COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 004019E2

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: H_prolog3_
String ID:
API String ID: 2427045233-0
Opcode ID: 82e6ed7f663d2e58a0b1be4280b06baa61df1b5eece5cec47f81aa6b51787291
Instruction ID: 1ddb9baa0d3e5b840bbef5945d981b50a40a0aa87d8214c813f6981836646acc
Opcode Fuzzy Hash: 82e6ed7f663d2e58a0b1be4280b06baa61df1b5eece5cec47f81aa6b51787291
Instruction Fuzzy Hash: 2F315C7090112C9BDB28EB65CC52BEDB775AF45308F4041EEA109B31E2DB386E85CF65

Uniqueness

Uniqueness Score: -1.00%

Function 00445F5E Relevance: 1.6, APIs: 1, Instructions: 80COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00445F65

Part of subcall function 004458D4: __EH_prolog3.LIBCMT ref: 004458DB
Part of subcall function 004458D4: RegQueryValueExA.KERNEL32(?,00000000,00000000,?,00000000,?,00000000,NoName,0000000C,00446312,00000000,?,00000000,00000006,00000000,?), ref: 00445994

Part of subcall function 004019B2: _strlen.LIBCMT ref: 004019C2

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: H_prolog3$QueryValue_strlen
String ID:
API String ID: 2713988897-0
Opcode ID: 4ecb9f7cb707de0302e7b2ec67c22333ad6b5aefab3a62529ef2570931bc5c24
Instruction ID: 0a384c2bad536400c754a2f014aff6f5f7d79f9a97a8a6906887eae54cd8aed0
Opcode Fuzzy Hash: 4ecb9f7cb707de0302e7b2ec67c22333ad6b5aefab3a62529ef2570931bc5c24
Instruction Fuzzy Hash: 5F314A7290021ACFDF14DFE4C8815BFBBB5BF44304F14412FE511A6292CB385A55CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 004BD041 Relevance: 1.6, APIs: 1, Instructions: 77COMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 004BD048

Part of subcall function 004D303F: __EH_prolog3.LIBCMT ref: 004D3046

Part of subcall function 004B4C5C: __CxxThrowException@8.LIBCMT ref: 004B4C72
Part of subcall function 004B4C5C: __EH_prolog3.LIBCMT ref: 004B4C7F

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: H_prolog3$Exception@8H_prolog3_catch_Throw
String ID:
API String ID: 2285297229-0
Opcode ID: a9c04a5b041187d37d91877f52007bf96dba8ca561945c74f4beca3ce84421f6
Instruction ID: 35d602cffc451bb9ce51de340e279898be0ece3b500f6aa5275223d5c43514cb
Opcode Fuzzy Hash: a9c04a5b041187d37d91877f52007bf96dba8ca561945c74f4beca3ce84421f6
Instruction Fuzzy Hash: 6031F871E00209DFCF04DFA9C8819DEBBB6BF88314F11446AE905AB251D774A941CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00466DF8 Relevance: 1.6, APIs: 1, Instructions: 73COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00466DFF

Part of subcall function 00459443: lua_getfield.LUA5.1(?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459455
Part of subcall function 00459443: lua_pushstring.LUA5.1(?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459460
Part of subcall function 00459443: lua_gettable.LUA5.1(?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459468
Part of subcall function 00459443: lua_remove.LUA5.1(?,000000FE,?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459470
Part of subcall function 00459443: lua_type.LUA5.1(?,000000FF,?,000000FE,?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459478
Part of subcall function 00459443: lua_pcall.LUA5.1(?,00000000,00000000,00000000), ref: 0045948B
Part of subcall function 00459443: lua_remove.LUA5.1(?,000000FF), ref: 0045949A

Part of subcall function 004597A0: __EH_prolog3.LIBCMT ref: 004597A7
Part of subcall function 004597A0: lua_gettop.LUA5.1(?,00000000,00000000,00000008,004076D1,?,00000002,?), ref: 004597D3

Part of subcall function 00459852: __EH_prolog3.LIBCMT ref: 00459859
Part of subcall function 00459852: lua_tolstring.LUA5.1(?,?,00000000,00000000,00000000,0000000C,004082AF,?,00000002,?,00000001,?,00000002), ref: 0045988A

Part of subcall function 00401BAB: __EH_prolog3.LIBCMT ref: 00401BB2

Part of subcall function 0045974C: __EH_prolog3.LIBCMT ref: 00459753

Part of subcall function 004014A6: _memcpy_s.LIBCMT ref: 004014F6

Part of subcall function 0044CBB0: __EH_prolog3_GS.LIBCMT ref: 0044CBBA
Part of subcall function 0044CBB0: _strlen.LIBCMT ref: 0044CBF9
Part of subcall function 0044CBB0: _memset.LIBCMT ref: 0044CC23
Part of subcall function 0044CBB0: SetCurrentDirectoryA.KERNEL32(?), ref: 0044CC8D
Part of subcall function 0044CBB0: CreateDirectoryA.KERNEL32(?,00000000), ref: 0044CC9F

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: H_prolog3$Directorylua_remove.$CreateCurrentH_prolog3__memcpy_s_memset_strlenlua_getfield.lua_gettable.lua_gettop.lua_pcall.lua_pushstring.lua_tolstring.lua_type.
String ID:
API String ID: 2899551767-0
Opcode ID: 72af5e0a08816f0170062f9f09a885833ef6b2a960a2ebe063d85ec001510ee5
Instruction ID: 1e8488d5594155b11a25db18a69d6b6ff1ec418ed2b32236f21ab301b3b40ea5
Opcode Fuzzy Hash: 72af5e0a08816f0170062f9f09a885833ef6b2a960a2ebe063d85ec001510ee5
Instruction Fuzzy Hash: 7F2151728002059BDB04EBA5C847BBE7774AF11328F28055EF550772D2DA7C5A4487A9

Uniqueness

Uniqueness Score: -1.00%

Function 0048BD00 Relevance: 1.6, APIs: 1, Instructions: 61COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0048BD07

Part of subcall function 004B7F10: DeleteObject.GDI32(00000000), ref: 004B7F1F

Part of subcall function 004025A1: __EH_prolog3_catch_GS.LIBCMT ref: 004025AB

Part of subcall function 00489B68: __EH_prolog3.LIBCMT ref: 00489B6F

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: H_prolog3$DeleteH_prolog3_catch_Object
String ID:
API String ID: 3005623789-0
Opcode ID: 666a8d487d370905c94483db3d1d733d4f7bcdd364d7cbb9819042d27e0edc82
Instruction ID: 00c3991bfe3d78ba08a411d1603922248540fea42ed9a35973da0ea0aefe6159
Opcode Fuzzy Hash: 666a8d487d370905c94483db3d1d733d4f7bcdd364d7cbb9819042d27e0edc82
Instruction Fuzzy Hash: 48214D34405B84DED725FBB5C1667EDBBA0AF25308F54888DD49A132C2DF782709D72A

Uniqueness

Uniqueness Score: -1.00%

Function 00449FCA Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00449FD1

Part of subcall function 00405B76: __EH_prolog3.LIBCMT ref: 00405B7D

Part of subcall function 00449EEE: __time64.LIBCMT ref: 00449F08
Part of subcall function 00449EEE: FileTimeToLocalFileTime.KERNEL32(00000001,?,?), ref: 00449F18
Part of subcall function 00449EEE: FileTimeToSystemTime.KERNEL32(?,?), ref: 00449F2E

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: Time$File$H_prolog3$LocalSystem__time64
String ID:
API String ID: 1704945122-0
Opcode ID: 6c3cafa34ab455583b4a186e846650d15654d0f72975b27b90bc4934b2b588d1
Instruction ID: 8edd6162f4f81386a2219fc17730774e422d45b40ca8196191fbfbed2052983f
Opcode Fuzzy Hash: 6c3cafa34ab455583b4a186e846650d15654d0f72975b27b90bc4934b2b588d1
Instruction Fuzzy Hash: A8113372400609ABC714EFA5C881ADBB7F8FF18314B14862EF556D7681EB38F654CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00401437 Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

_memcpy_s.LIBCMT ref: 00401484

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: _memcpy_s
String ID:
API String ID: 2001391462-0
Opcode ID: 9dddd9812740acf6309119ac11461552adba8f76e61a688046cda27d89329e2e
Instruction ID: d8fd880ea3f8ec5dadecaff8660c66f2118ea668a4eecb3c5a83ed41aefea348
Opcode Fuzzy Hash: 9dddd9812740acf6309119ac11461552adba8f76e61a688046cda27d89329e2e
Instruction Fuzzy Hash: 9A015AB5600204AFD700DFA8C885CAABBA8FF49358B1045AEF955E7361DB75ED00CA64

Uniqueness

Uniqueness Score: -1.00%

Function 00420009 Relevance: 1.5, APIs: 1, Instructions: 44COMMON

Download Yara Rule

APIs

IsWindow.USER32(?), ref: 0042001A

Part of subcall function 004B894D: ShowWindow.USER32(?,?,?,004B6C70,00000000,0000E146,00000000,?,?,00402098,0000002C,0000000A), ref: 004B895E

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: Window$Show
String ID:
API String ID: 990937876-0
Opcode ID: d80afbce797d1d91d63c43501ce3f6093879a1fdbe9a40adc6a26084fa7dc238
Instruction ID: 0059cb2f85582c594cbf677edbae5ecea8e0ecd1c3bee1c144135006f980bc30
Opcode Fuzzy Hash: d80afbce797d1d91d63c43501ce3f6093879a1fdbe9a40adc6a26084fa7dc238
Instruction Fuzzy Hash: 420188353006108FE721AB28E844B7A33E6BF80715F48405EE49A8B362CF29EC01CB99

Uniqueness

Uniqueness Score: -1.00%

Function 004D303F Relevance: 1.5, APIs: 1, Instructions: 43COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004D3046

Part of subcall function 004B4C5C: __CxxThrowException@8.LIBCMT ref: 004B4C72
Part of subcall function 004B4C5C: __EH_prolog3.LIBCMT ref: 004B4C7F

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: H_prolog3$Exception@8Throw
String ID:
API String ID: 2489616738-0
Opcode ID: 88b59579be12c39c5554ba635bc1fa668eae106899fd88567c371986c63ec5ce
Instruction ID: 9b10b40ea2fdd3bb14725b35e422f5a388c3696fdd90f1f3fb94d67d1dc2e190
Opcode Fuzzy Hash: 88b59579be12c39c5554ba635bc1fa668eae106899fd88567c371986c63ec5ce
Instruction Fuzzy Hash: 3901B5301002068BCB29FF35C8263AE3AA2AB51356F24842FE54187390DFBCCD00C759

Uniqueness

Uniqueness Score: -1.00%

Function 004010EA Relevance: 1.5, APIs: 1, Instructions: 41fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,00400000,00000000,00000000), ref: 00401119

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 737286a37961cd1bf920fb7793b9182856de261f3294f5bd5c4be44f4ad453c9
Instruction ID: fd0ce55e1d8b475e94c382aa1f117de81b36cac8a70a1f4a7569a9fe7c6bb526
Opcode Fuzzy Hash: 737286a37961cd1bf920fb7793b9182856de261f3294f5bd5c4be44f4ad453c9
Instruction Fuzzy Hash: E7F04F362142459BDB188E59DC007AB73AAFF84771F04443FFD9497690DB74DC108B94

Uniqueness

Uniqueness Score: -1.00%

Function 00401090 Relevance: 1.5, APIs: 1, Instructions: 41fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,00400000,00000000,00000000), ref: 004010BF

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: d16d3f1bc7910b5c5ebed88e9fc9793a28bda42857519fe0fb2439fef4123a45
Instruction ID: e1bf84e88daaaf2509aabbbb5d847b9b5f02ed78212a20b108d70aa10a2bcbc7
Opcode Fuzzy Hash: d16d3f1bc7910b5c5ebed88e9fc9793a28bda42857519fe0fb2439fef4123a45
Instruction Fuzzy Hash: 54F04F36210245ABEB148E59DC007AB73A9FF84371F05443FFD9497790D779D8908B94

Uniqueness

Uniqueness Score: -1.00%

Function 004BC0D3 Relevance: 1.5, APIs: 1, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,00000000,?,?,004BF875,00000004,00401D99), ref: 004BC11B

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: DestroyWindow
String ID:
API String ID: 3375834691-0
Opcode ID: 12dcc94864c201e898f2ebc25172f21333b9b77f9d783bd0891a24de6e76c733
Instruction ID: 568c9728df4464269c6de650153aa71730d2cf4722e92b3938b34ea842d2de8b
Opcode Fuzzy Hash: 12dcc94864c201e898f2ebc25172f21333b9b77f9d783bd0891a24de6e76c733
Instruction Fuzzy Hash: 15F03135600A00CF4B32AA69D8C08A773E6EBC4351325491FE0C6D6712EA28DC42CF29

Uniqueness

Uniqueness Score: -1.00%

Function 00401614 Relevance: 1.5, APIs: 1, Instructions: 40COMMON

Download Yara Rule

APIs

_memcpy_s.LIBCMT ref: 00401664

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: _memcpy_s
String ID:
API String ID: 2001391462-0
Opcode ID: 39e4f229af4e30c8d53802847369c1d014af499fde2e25785608ad57cc278073
Instruction ID: 393fc8767cacaa3764580e8698a10bd688945135bb74fefa78c0aeaad2ec02b5
Opcode Fuzzy Hash: 39e4f229af4e30c8d53802847369c1d014af499fde2e25785608ad57cc278073
Instruction Fuzzy Hash: 73F09632200140A7DB206E598C05E6F77A9DF91B54F14443FFA54F62A1D67798109AAD

Uniqueness

Uniqueness Score: -1.00%

Function 0043F48F Relevance: 1.5, APIs: 1, Instructions: 38COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0043F496

Part of subcall function 0043F3CE: __EH_prolog3.LIBCMT ref: 0043F3D5
Part of subcall function 0043F3CE: __time64.LIBCMT ref: 0043F3EE

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: H_prolog3$__time64
String ID:
API String ID: 1961665919-0
Opcode ID: 6ce4192f22f41713f400a727332b2a39af6f3e942b352b10085a309da6721ed9
Instruction ID: e42b9f65b37361f6490ca16654b7a180aad3da059e86116934e769f3e4921e38
Opcode Fuzzy Hash: 6ce4192f22f41713f400a727332b2a39af6f3e942b352b10085a309da6721ed9
Instruction Fuzzy Hash: 76018471C00A40AED716FFA5C8467DEB7E86F50318F80455EB047E6192DEB8AA09CB6D

Uniqueness

Uniqueness Score: -1.00%

Function 0044A6E6 Relevance: 1.5, APIs: 1, Instructions: 36COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0044A6ED

Part of subcall function 00485930: __EH_prolog3.LIBCMT ref: 00485937
Part of subcall function 00485930: __time64.LIBCMT ref: 0048598D
Part of subcall function 00485930: __time64.LIBCMT ref: 00485993
Part of subcall function 00485930: __time64.LIBCMT ref: 00485999

Part of subcall function 0044A06A: __EH_prolog3_GS.LIBCMT ref: 0044A074
Part of subcall function 0044A06A: FindFirstFileA.KERNEL32(?,?,00000148,0041F1AF,?,?,?,?,00000104,?,00000000), ref: 0044A089
Part of subcall function 0044A06A: FindClose.KERNEL32(00000000,?,?,00000001,?,?,?,?,?,?,00000104,?,00000000), ref: 0044A0C6

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: __time64$FindH_prolog3$CloseFileFirstH_prolog3_
String ID:
API String ID: 4146640304-0
Opcode ID: a1bcbbc4a30aaf6df79075bd7ed9f8308d213629a28d2355651a8634fd2ae646
Instruction ID: 81549d7dddf35ac21028f3018a2ad4e8f29330a37daaa7d160e8f0fcd0ae93de
Opcode Fuzzy Hash: a1bcbbc4a30aaf6df79075bd7ed9f8308d213629a28d2355651a8634fd2ae646
Instruction Fuzzy Hash: F5F08C31910119ABDB18EFE8C806BDCBB60BF24328F54860DF415AB3D6CB789A05CB95

Uniqueness

Uniqueness Score: -1.00%

Function 005D70BD Relevance: 1.5, APIs: 1, Instructions: 30threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNEL32(?,?,00766C98,005D78B3,?,?,?,?,00000008,005D790B,?,00000000,005D7DB0), ref: 005D70DF

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 1c1b6921be856c63e3ae9c46fd72be89775b898bcd9533865af811849bae6022
Instruction ID: 86c7be887ec7c1b31b44e063d5f279947f38e8f4a93e5cf6394cf27351513c2a
Opcode Fuzzy Hash: 1c1b6921be856c63e3ae9c46fd72be89775b898bcd9533865af811849bae6022
Instruction Fuzzy Hash: CBF0A0351086044E8B38CE1DD8588A6BB96AF89320315861FD97B87BE1DE60BC82CF00

Uniqueness

Uniqueness Score: -1.00%

Function 004C47D6 Relevance: 1.5, APIs: 1, Instructions: 30windowCOMMON

Download Yara Rule

APIs

PostMessageA.USER32(?,00000362,0000E001,00000000), ref: 004C4810

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: a8569bb7c6968e71bb9b6fee31d299d4f2f0d38daeaf7b9fb219c4803eecf9a7
Instruction ID: 8cd3648e401eff5dfaffd811c479b16f5d50dda1588a98380e5f254167e490bc
Opcode Fuzzy Hash: a8569bb7c6968e71bb9b6fee31d299d4f2f0d38daeaf7b9fb219c4803eecf9a7
Instruction Fuzzy Hash: 35F0A7342105006BCB201F358C05FA977D5EF45730F11072BF955962E0CBB5D9409654

Uniqueness

Uniqueness Score: -1.00%

Function 004BB6FD Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 004BB704

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: H_prolog3_catch
String ID:
API String ID: 3886170330-0
Opcode ID: cb61f555d0003d5a84a893c439963661690f428a1aa8cf7adfe6cbb7ed9b99e4
Instruction ID: f57176400a2e8db19faa0f26fc1d71298f8b8d1649e094a28a4b65491ccb419c
Opcode Fuzzy Hash: cb61f555d0003d5a84a893c439963661690f428a1aa8cf7adfe6cbb7ed9b99e4
Instruction Fuzzy Hash: C801A4B4900209CFDB08DF99C085AEDBBF1BF98300F10806EE809AB351DA706941CF64

Uniqueness

Uniqueness Score: -1.00%

Function 0043B4CE Relevance: 1.5, APIs: 1, Instructions: 28COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0043B4D5

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: 21b44d4ef5729340bbcdf14e1cfc1f86120f2ff158bc182162681a283508a673
Instruction ID: c377a5cafc5b397f9798f995e224054fdece02fea5b6d3a1c83eb9c6d8866aec
Opcode Fuzzy Hash: 21b44d4ef5729340bbcdf14e1cfc1f86120f2ff158bc182162681a283508a673
Instruction Fuzzy Hash: F8F090745017018BDB64EFA4C64675EBBE1BF18304F90659DE542976D2DB78FA00CB48

Uniqueness

Uniqueness Score: -1.00%

Function 0040962D Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,00000000,00000000,00000001,?,?,?,?,00403CB6,?,?,?,?,?,?,00000000), ref: 0040964D

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 4f16980afffdedc01ac7431d0324489a5f8f0009f096265cab29818fe86be34f
Instruction ID: 3caaf326fbabbe74bf1658b1ca7b05505cab82d0c084d78479f47485b56d7096
Opcode Fuzzy Hash: 4f16980afffdedc01ac7431d0324489a5f8f0009f096265cab29818fe86be34f
Instruction Fuzzy Hash: 6CE0E5B1900214BFDB04DB55DC45EEEB7BDEF88714F108169F514E7290E275AE418694

Uniqueness

Uniqueness Score: -1.00%

Function 00405B1F Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00405B26

Part of subcall function 0040588A: _memcpy_s.LIBCMT ref: 004058AB
Part of subcall function 0040588A: _memcpy_s.LIBCMT ref: 004058BB

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: _memcpy_s$H_prolog3
String ID:
API String ID: 1888667434-0
Opcode ID: 86d6c9abd8ec275428fa5454b7acb60ea51a2a5d9e49945607cc6d18155f5dd3
Instruction ID: bf621cff12e37e08e620ce67135f1ed7af3f448e948334f85dda5d4bfe59561b
Opcode Fuzzy Hash: 86d6c9abd8ec275428fa5454b7acb60ea51a2a5d9e49945607cc6d18155f5dd3
Instruction Fuzzy Hash: 28F03AB9900604AFDF04EF54C849BAEBB75FF44325F108448F9156F281C7B5AE10CB98

Uniqueness

Uniqueness Score: -1.00%

Function 0040100B Relevance: 1.5, APIs: 1, Instructions: 27fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,?,00000001,00000000,?,00000080,00000000), ref: 00401035

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 4f3b07bd40f3d522c7aee41185788622155d2c63125d41ec50d1eaf27111335f
Instruction ID: 2c7a2793617e4f947822ac07c5b0ec67816180b1c4a959a4a58cf2a9e728180f
Opcode Fuzzy Hash: 4f3b07bd40f3d522c7aee41185788622155d2c63125d41ec50d1eaf27111335f
Instruction Fuzzy Hash: 7EE086F16A42086FF7084E34EC06F753399D705B25F144B69BD1AC56E0E675A8509510

Uniqueness

Uniqueness Score: -1.00%

Function 004053C5 Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

IsWindow.USER32(?), ref: 004053D5

Part of subcall function 004B894D: ShowWindow.USER32(?,?,?,004B6C70,00000000,0000E146,00000000,?,?,00402098,0000002C,0000000A), ref: 004B895E

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: Window$Show
String ID:
API String ID: 990937876-0
Opcode ID: 10eaca586d665bd59372f736d38392cad926d01f32a5e6ef62b59ec4ce0dc1c4
Instruction ID: bf3591042bfef8a7ac9b8e62adde967be53af70fa7cfcff4c7ff55ed3b1a5ef9
Opcode Fuzzy Hash: 10eaca586d665bd59372f736d38392cad926d01f32a5e6ef62b59ec4ce0dc1c4
Instruction Fuzzy Hash: 8EF0A5317197008BD7249B28D564BA777E9EF05706F1504ADA45E9B2A2CB78B840CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00403D79 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00403D80

Part of subcall function 00401BAB: __EH_prolog3.LIBCMT ref: 00401BB2

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: 3f2dca423c74055454f3b3c662d62741d56569162571df05e91416816b0d3300
Instruction ID: 5515a941255dffa032bcb3759c20b981950cb6b02a4cecc93e5771125058ccba
Opcode Fuzzy Hash: 3f2dca423c74055454f3b3c662d62741d56569162571df05e91416816b0d3300
Instruction Fuzzy Hash: DDF0E530510508DBCB18EF75C485BDE3B75BF40304F00862EB4426B2D1EB38EA44CB84

Uniqueness

Uniqueness Score: -1.00%

Function 004CB483 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

Part of subcall function 004B894D: ShowWindow.USER32(?,?,?,004B6C70,00000000,0000E146,00000000,?,?,00402098,0000002C,0000000A), ref: 004B895E

ShowOwnedPopups.USER32(?,00000000), ref: 004CB49B

Part of subcall function 004B8B6D: SetWindowPos.USER32(?,000000FF,000000FF,?,?,00000000,004BB972,?,004BB972,00000000,?,?,000000FF,000000FF,00000015), ref: 004B8B95

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: ShowWindow$OwnedPopups
String ID:
API String ID: 2413815092-0
Opcode ID: 1ee8a6c5a38572d3527425811c51b935c75a3ee2ba2c4016e4faf8b7854e545f
Instruction ID: 95d775233abd1f69a50bff3466d101abaafb5dacebb1ce71043bdd846fb57335
Opcode Fuzzy Hash: 1ee8a6c5a38572d3527425811c51b935c75a3ee2ba2c4016e4faf8b7854e545f
Instruction Fuzzy Hash: 2BE08C72200180BBC3305727EC4CCA77EBDFBCEF20705011EB089471618960A801C674

Uniqueness

Uniqueness Score: -1.00%

Function 0041D761 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0041D768

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: 0982b9d7c6d6447bcf7e7886ea0aff9b503804373ece7742af4d2f91059f05d7
Instruction ID: c82c482e0c6429a92941809339157213fc0636f57b3459e766a34f661389f167
Opcode Fuzzy Hash: 0982b9d7c6d6447bcf7e7886ea0aff9b503804373ece7742af4d2f91059f05d7
Instruction Fuzzy Hash: 55E02BB4900202CBDB14EFE0C10979DBBA17F00320F108A4ED061872C1DB789D81C795

Uniqueness

Uniqueness Score: -1.00%

Function 0043B94C Relevance: 1.5, APIs: 1, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0043B953

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: 9b83ba0655314f4e37a556a4b6de155a674e27f4f46e4ba5d4396f453d480eca
Instruction ID: 8975a5f96dafda6855f93029d06ed42361a455b31ed2e1dd82acb62b3f23f5c0
Opcode Fuzzy Hash: 9b83ba0655314f4e37a556a4b6de155a674e27f4f46e4ba5d4396f453d480eca
Instruction Fuzzy Hash: 8CE0A970100200CBDB28FFE9C216B6CBAA2BF50304F400A5EE096636C2CFB42504C722

Uniqueness

Uniqueness Score: -1.00%

Function 004D2B63 Relevance: 1.5, APIs: 1, Instructions: 21COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 004D2B6A

Part of subcall function 004D31EC: RtlEnterCriticalSection.NTDLL(00751018), ref: 004D3226
Part of subcall function 004D31EC: RtlInitializeCriticalSection.NTDLL(?), ref: 004D3238
Part of subcall function 004D31EC: RtlLeaveCriticalSection.NTDLL(00751018), ref: 004D3245
Part of subcall function 004D31EC: RtlEnterCriticalSection.NTDLL(?), ref: 004D3255

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: CriticalSection$Enter$H_prolog3_catchInitializeLeave
String ID:
API String ID: 1641187343-0
Opcode ID: 8a7cc949bffc3f1c55c0b4995aa4ef9a20200d60a57f43d420b089c3778747e4
Instruction ID: 78ec497cddfd717cb3eb8d1fff045b4ac5d97da2e09ed5493533672b637149ec
Opcode Fuzzy Hash: 8a7cc949bffc3f1c55c0b4995aa4ef9a20200d60a57f43d420b089c3778747e4
Instruction Fuzzy Hash: 8FE0923420060697E764EFB4C906B8DB6E07F20321F20462BF8D09B3C0DAB19A408715

Uniqueness

Uniqueness Score: -1.00%

Function 00401BAB Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00401BB2

Part of subcall function 004019B2: _strlen.LIBCMT ref: 004019C2

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: H_prolog3_strlen
String ID:
API String ID: 782648989-0
Opcode ID: 77f7bc30006821a29958f2c4bbffccb0d3b49072c26207cd58cb6d1ce87ecae4
Instruction ID: c0d3374da0a1dc439287b81cb4d1cabab3852fbea1a8714df7ef82b3d37554df
Opcode Fuzzy Hash: 77f7bc30006821a29958f2c4bbffccb0d3b49072c26207cd58cb6d1ce87ecae4
Instruction Fuzzy Hash: 14E0867460091057CF0BBF54881679D6A626F40704F00401EF4447B292DF3D5B1286DD

Uniqueness

Uniqueness Score: -1.00%

Function 004B3CD5 Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 004B3CDC

Part of subcall function 004B4C5C: __CxxThrowException@8.LIBCMT ref: 004B4C72
Part of subcall function 004B4C5C: __EH_prolog3.LIBCMT ref: 004B4C7F

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: Exception@8H_prolog3H_prolog3_catchThrow
String ID:
API String ID: 1377961577-0
Opcode ID: 056d0ac23da770a9f415828359bd401a0104db57860f668a10dc8e5c22ae7a66
Instruction ID: 84e816adfeb80e0627f80a186ab24802854d759c283db3f2d7e03e3fcf9de192
Opcode Fuzzy Hash: 056d0ac23da770a9f415828359bd401a0104db57860f668a10dc8e5c22ae7a66
Instruction Fuzzy Hash: B9E04830E015078BDF48EFB545431ADBEB2AFD4305B34C477E401E6145E5398A439B25

Uniqueness

Uniqueness Score: -1.00%

Function 00492E91 Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00492E98

Part of subcall function 0049247F: __EH_prolog3.LIBCMT ref: 00492486

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: d2225bb162fb305fda03ddef380af5f7b938387385bf41c4c286c3c507b44ea7
Instruction ID: f40f84efc84cb7ea32fc51e235c349be48d5c23038bd9b9444b380acb951bef4
Opcode Fuzzy Hash: d2225bb162fb305fda03ddef380af5f7b938387385bf41c4c286c3c507b44ea7
Instruction Fuzzy Hash: A1E02670A40B55AADF10FB688D06BDD7D956B54B00F50426EB2846B1C2CBF82A01479E

Uniqueness

Uniqueness Score: -1.00%

Function 00401067 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNEL32 ref: 00401076

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: d5184d9b09d2be1529850392db2792c83136f6f13d0f3dc67b5608a725ea0b67
Instruction ID: 83cb294aa58a1aa32953ae01fab8f13757e9e32933b898cf421cde06aad7fa49
Opcode Fuzzy Hash: d5184d9b09d2be1529850392db2792c83136f6f13d0f3dc67b5608a725ea0b67
Instruction Fuzzy Hash: C2D05E312186189BD7205EBDAC05492B7ECEA013B13500F77ECF4D3AE0D33098818684

Uniqueness

Uniqueness Score: -1.00%

Function 0049B21C Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0049B223

Part of subcall function 0049A6F5: __EH_prolog3.LIBCMT ref: 0049A6FC

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: 268965899baa35009ed55d7985054983c7c4cea072cd9c2fdd58425af9011a44
Instruction ID: 5af64875ab721ea2d479c0b5a7cbdefb8929fbe80b725dca7dbbf035c477cdb2
Opcode Fuzzy Hash: 268965899baa35009ed55d7985054983c7c4cea072cd9c2fdd58425af9011a44
Instruction Fuzzy Hash: 23E086709005529ACF15BF64844539D7A916F50304F50016EB14597282DFB85E0187DE

Uniqueness

Uniqueness Score: -1.00%

Function 00494BCD Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00494BD4

Part of subcall function 00493E5A: __EH_prolog3.LIBCMT ref: 00493E61

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: 93c9ccaecbb3fa92279ad36eb0aa0240f293ad26ba26cf516c058dfe3f345915
Instruction ID: c9370370dc4300762a20998a4d30c237e5962e3c0239b04b5e84eb5d88828255
Opcode Fuzzy Hash: 93c9ccaecbb3fa92279ad36eb0aa0240f293ad26ba26cf516c058dfe3f345915
Instruction Fuzzy Hash: C9E08CB09009128ACF1AFFA4C8163DDBEA17F50704F40416EB1859B282CFB85E0187DE

Uniqueness

Uniqueness Score: -1.00%

Function 0049A5CC Relevance: 1.5, APIs: 1, Instructions: 17COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0049A5D3

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: 70fd2fd428c446c98601ad2d921c309d10dda4974682c86379bc1ed7af2a9136
Instruction ID: 9b0e613fcb040e0f2727c8112f33bf8e7ee4743588f220c7bb375048c98c3490
Opcode Fuzzy Hash: 70fd2fd428c446c98601ad2d921c309d10dda4974682c86379bc1ed7af2a9136
Instruction Fuzzy Hash: 9BE08670501617CBCF28FFB885063BD7EA2BF40314F10066EA0A5572C6CBB42A01D799

Uniqueness

Uniqueness Score: -1.00%

Function 004448CC Relevance: 1.5, APIs: 1, Instructions: 17registryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(?,?,004449DB,?,004449ED,?,00444D70,0000000C,0044542D,?,00000001,00000000,?,?,?,004454E5), ref: 004448D7

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: 82d40b0c88f336ab992d3fa3c17fab83d8e08eb5dde4761dfa95bb71d53fc3aa
Instruction ID: 3d38625a62aa55905e3da18d8033baa83e9d22a5bf85c2335f0f34ff1f719cf5
Opcode Fuzzy Hash: 82d40b0c88f336ab992d3fa3c17fab83d8e08eb5dde4761dfa95bb71d53fc3aa
Instruction Fuzzy Hash: EFD0A772A607124BEB3C8E38E8067B676D8BF08324F145B3E544BC36C0DB6CD844865C

Uniqueness

Uniqueness Score: -1.00%

Function 004448A0 Relevance: 1.5, APIs: 1, Instructions: 17registryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RegCloseKey.KERNEL32(?,?,004449D4,?,004449ED,?,00444D70,0000000C,0044542D,?,00000001,00000000,?,?,?,004454E5), ref: 004448AB

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: db3b1c38f9f89b360529ed9fce9be2f5a3619a48cbb9e826765914fccc7d31d6
Instruction ID: e917cf194c724aebc0155a8f253f845af1eff8a635c946eb43483ec416ea8548
Opcode Fuzzy Hash: db3b1c38f9f89b360529ed9fce9be2f5a3619a48cbb9e826765914fccc7d31d6
Instruction Fuzzy Hash: 7DD0A772B607114BEB3C8E29E8067B637D89F08724F141B3E540FC26C0C66CD844865C

Uniqueness

Uniqueness Score: -1.00%

Function 004019B2 Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 004019C2

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: _strlen
String ID:
API String ID: 4218353326-0
Opcode ID: f610e71837fda57ba0704dfed6013f9328de71b2def3e1478a2ab0c17d0b684a
Instruction ID: 70b7c1fba3fa54e2513cb73effcb1cb93493a030d389469eeda3df0ca5a38489
Opcode Fuzzy Hash: f610e71837fda57ba0704dfed6013f9328de71b2def3e1478a2ab0c17d0b684a
Instruction Fuzzy Hash: 02D0C9721101286E9B152E64E8018BE7B9DDB507A1700C03BFE049A2A1EA759E9096E8

Uniqueness

Uniqueness Score: -1.00%

Function 0049B260 Relevance: 1.5, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0049B267

Part of subcall function 004B3C8A: _malloc.LIBCMT ref: 004B3CA8

Part of subcall function 0049B21C: __EH_prolog3.LIBCMT ref: 0049B223

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: H_prolog3$_malloc
String ID:
API String ID: 1683881009-0
Opcode ID: a0a53f325660f74bfbd1f73e3748d373e4863111c5ae2561d4d7b149cec002af
Instruction ID: 6804d3dbd8772e955c34fe946930d8275dde2fd07f02d26f2fc5bdf1deaa9f40
Opcode Fuzzy Hash: a0a53f325660f74bfbd1f73e3748d373e4863111c5ae2561d4d7b149cec002af
Instruction Fuzzy Hash: ACD0A7656401064ADF4CFBF8560636C1D91AF48300F00417EE108DE2C1EE3405414669

Uniqueness

Uniqueness Score: -1.00%

Function 004A54E7 Relevance: 1.5, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004A54EE

Part of subcall function 004B3C8A: _malloc.LIBCMT ref: 004B3CA8

Part of subcall function 004A51BC: __EH_prolog3.LIBCMT ref: 004A51C3

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: H_prolog3$_malloc
String ID:
API String ID: 1683881009-0
Opcode ID: ac585c5dbe608006666a736f47737a8a9b21b8667c16c645131b4eb93ee122fa
Instruction ID: 9f3cfc6ca601d2ceb662abab7bcc2831cc351385507c3cca27cc441545fa7249
Opcode Fuzzy Hash: ac585c5dbe608006666a736f47737a8a9b21b8667c16c645131b4eb93ee122fa
Instruction Fuzzy Hash: 6BD0A764A015024ADF4CFBF8060236C18923B54304F44812EA108DA282ED3405014729

Uniqueness

Uniqueness Score: -1.00%

Function 0049B6EE Relevance: 1.5, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0049B6F5

Part of subcall function 004B3C8A: _malloc.LIBCMT ref: 004B3CA8

Part of subcall function 0049B6BF: __EH_prolog3.LIBCMT ref: 0049B6C6

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: H_prolog3$_malloc
String ID:
API String ID: 1683881009-0
Opcode ID: 26ab3fdd207691da395a357fdbff512ff9a822558e0cfca97220e601c979df5a
Instruction ID: 4fbf2487f9102fde76b59471fbb79e8a2e516566721050e000bba067d66e0eec
Opcode Fuzzy Hash: 26ab3fdd207691da395a357fdbff512ff9a822558e0cfca97220e601c979df5a
Instruction Fuzzy Hash: 8AD0A7656001124ADF1CFFF8160237C2CE16F84300F00423EE108DA281EE341940466A

Uniqueness

Uniqueness Score: -1.00%

Function 004B876E Relevance: 1.5, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

SetDlgItemTextA.USER32(?,?,?), ref: 004B8782

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: ItemText
String ID:
API String ID: 3367045223-0
Opcode ID: 4a49ff6d043cade1bf5420b34ef3de4c80269102bd6716103146f925be0cd26c
Instruction ID: c7a0fd1a567b4702c86ec7b5c7c9aa05e55f3f45dd4f1aa552d1e37f61c93377
Opcode Fuzzy Hash: 4a49ff6d043cade1bf5420b34ef3de4c80269102bd6716103146f925be0cd26c
Instruction Fuzzy Hash: 58D01232100508DFCB405F40D848AA53BA9FB58315F6080A9E55C0A522CB339862DB40

Uniqueness

Uniqueness Score: -1.00%

Function 00497C42 Relevance: 1.5, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00497C49

Part of subcall function 004B3C8A: _malloc.LIBCMT ref: 004B3CA8

Part of subcall function 00497C09: __EH_prolog3.LIBCMT ref: 00497C10

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: H_prolog3$_malloc
String ID:
API String ID: 1683881009-0
Opcode ID: 2d760c4596559ddcf92df6c274c2bdb9cc3ddbeb34fa375ed53a3abf0e38b908
Instruction ID: cfc93cbe0e52640c19a475a1c784f4a920168cdcce7a8ba29dc63274a0bad243
Opcode Fuzzy Hash: 2d760c4596559ddcf92df6c274c2bdb9cc3ddbeb34fa375ed53a3abf0e38b908
Instruction Fuzzy Hash: 77D0A764A041024ADF0CFBF8094639C1C913B48301F44453FA108DA281F97415404729

Uniqueness

Uniqueness Score: -1.00%

Function 00494C11 Relevance: 1.5, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00494C18

Part of subcall function 004B3C8A: _malloc.LIBCMT ref: 004B3CA8

Part of subcall function 00494BCD: __EH_prolog3.LIBCMT ref: 00494BD4

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: H_prolog3$_malloc
String ID:
API String ID: 1683881009-0
Opcode ID: a0a53f325660f74bfbd1f73e3748d373e4863111c5ae2561d4d7b149cec002af
Instruction ID: 4726b98e77acdfa6c9562c6c5c54724581029f320d9bbc14561950200a3373ca
Opcode Fuzzy Hash: a0a53f325660f74bfbd1f73e3748d373e4863111c5ae2561d4d7b149cec002af
Instruction Fuzzy Hash: DFD0A7656001064ADF1CFBF8450276C1C912F84304F00423FB118DA2C1FD3455424629

Uniqueness

Uniqueness Score: -1.00%

Function 00493CA8 Relevance: 1.5, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00493CAF

Part of subcall function 004B3C8A: _malloc.LIBCMT ref: 004B3CA8

Part of subcall function 00492E91: __EH_prolog3.LIBCMT ref: 00492E98

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: H_prolog3$_malloc
String ID:
API String ID: 1683881009-0
Opcode ID: 1c4d2af1ef4808458cff65c6b57620736680b1bcdbbfecedf828336fd7f1c24a
Instruction ID: 14bdd4c944f82d78484cd96270e6dc7ac4d1beb2e38a3326e3390376c06475da
Opcode Fuzzy Hash: 1c4d2af1ef4808458cff65c6b57620736680b1bcdbbfecedf828336fd7f1c24a
Instruction Fuzzy Hash: 32D0A7697002018ADF1CFFF8060639C1C912B44300F00413FB108EA2C1E97416004629

Uniqueness

Uniqueness Score: -1.00%

Function 0041E095 Relevance: 1.5, APIs: 1, Instructions: 14COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0041E09C

Part of subcall function 004CA253: __EH_prolog3.LIBCMT ref: 004CA25A
Part of subcall function 004CA253: __strdup.LIBCMT ref: 004CA27C
Part of subcall function 004CA253: GetCurrentThread.KERNEL32 ref: 004CA2A9
Part of subcall function 004CA253: GetCurrentThreadId.KERNEL32 ref: 004CA2B2

Part of subcall function 004060C0: __EH_prolog3.LIBCMT ref: 004060C7

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: H_prolog3$CurrentThread$__strdup
String ID:
API String ID: 420856885-0
Opcode ID: e9ade39488ba1e3a5bf21aaeb2043b53d6a1c64dd407c6f981127a9b125fd0f3
Instruction ID: e38e78fc9db42415650a20d15b514721e5dd9209ba0cb4ae35b9122df1054bc2
Opcode Fuzzy Hash: e9ade39488ba1e3a5bf21aaeb2043b53d6a1c64dd407c6f981127a9b125fd0f3
Instruction Fuzzy Hash: 1DD0A7B89017158BDB24FF64C81678D7E61BF54714F40854DF149572C1DFB92904C79A

Uniqueness

Uniqueness Score: -1.00%

Function 004B894D Relevance: 1.5, APIs: 1, Instructions: 14COMMONLIBRARYCODE

Download Yara Rule

APIs

ShowWindow.USER32(?,?,?,004B6C70,00000000,0000E146,00000000,?,?,00402098,0000002C,0000000A), ref: 004B895E

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: cbab26d748e0a15bd5f1df365a745f320e5b199e5a708dbeb22ae0832455a3fa
Instruction ID: 39898d7e4c467fc577bf6393c6c6583a5500d8ff6fd4101759beb814fc527ad9
Opcode Fuzzy Hash: cbab26d748e0a15bd5f1df365a745f320e5b199e5a708dbeb22ae0832455a3fa
Instruction Fuzzy Hash: D4D09EB2144608DFCB409F41D808BA177A9FB55315F5040AAE5485A522C7339862DF55

Uniqueness

Uniqueness Score: -1.00%

Function 005B8B91 Relevance: 1.5, APIs: 1, Instructions: 14COMMON

Download Yara Rule

APIs

Part of subcall function 005B6027: __lock.LIBCMT ref: 005B6029

__onexit_nolock.LIBCMT ref: 005B8BA9

Part of subcall function 005B8AAA: RtlDecodePointer.NTDLL(?), ref: 005B8ABF
Part of subcall function 005B8AAA: RtlDecodePointer.NTDLL ref: 005B8ACC
Part of subcall function 005B8AAA: __realloc_crt.LIBCMT ref: 005B8B09
Part of subcall function 005B8AAA: __realloc_crt.LIBCMT ref: 005B8B1F
Part of subcall function 005B8AAA: RtlEncodePointer.NTDLL(00000000), ref: 005B8B31
Part of subcall function 005B8AAA: RtlEncodePointer.NTDLL(000000C7), ref: 005B8B45
Part of subcall function 005B8AAA: RtlEncodePointer.NTDLL(-00000004), ref: 005B8B4D

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: Pointer$Encode$Decode__realloc_crt$__lock__onexit_nolock
String ID:
API String ID: 3536590627-0
Opcode ID: 1a6e4c484800c091bfcd12225422a7768afb95a27e72c5eae6818f9832374a39
Instruction ID: 49f602f23efd1951346255d47a57de7aaca6c853742068e71714724c438f5c96
Opcode Fuzzy Hash: 1a6e4c484800c091bfcd12225422a7768afb95a27e72c5eae6818f9832374a39
Instruction Fuzzy Hash: 98D067B190520BEADB50BBA4D90ABEDBEA4BF80321F604255B114661D2CAB87641DA15

Uniqueness

Uniqueness Score: -1.00%

Function 0041E10C Relevance: 1.5, APIs: 1, Instructions: 13COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0041E113

Part of subcall function 00405462: __EH_prolog3.LIBCMT ref: 00405469
Part of subcall function 00405462: FreeLibrary.KERNEL32(?), ref: 004055CA

Part of subcall function 004CA34D: __EH_prolog3_catch_GS.LIBCMT ref: 004CA357
Part of subcall function 004CA34D: GlobalDeleteAtom.KERNEL32(?), ref: 004CA402
Part of subcall function 004CA34D: GlobalDeleteAtom.KERNEL32(?), ref: 004CA415
Part of subcall function 004CA34D: _free.LIBCMT ref: 004CA447
Part of subcall function 004CA34D: _free.LIBCMT ref: 004CA44F
Part of subcall function 004CA34D: _free.LIBCMT ref: 004CA457
Part of subcall function 004CA34D: _free.LIBCMT ref: 004CA45F
Part of subcall function 004CA34D: _free.LIBCMT ref: 004CA467

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: _free$AtomDeleteGlobalH_prolog3$FreeH_prolog3_catch_Library
String ID:
API String ID: 675080141-0
Opcode ID: 7466d3e1515d5cb88e22c3c93ff0e0474a769487ebb5655857fb6e72d2c17b76
Instruction ID: e8e89a98196806cacb9f970270850bf3e739947f70bfdd30f47313702fc2b245
Opcode Fuzzy Hash: 7466d3e1515d5cb88e22c3c93ff0e0474a769487ebb5655857fb6e72d2c17b76
Instruction Fuzzy Hash: 70D05E74501A15CACB28FBA4C8177DC7A22BB40324F40835DB065571D1DF782A058B9A

Uniqueness

Uniqueness Score: -1.00%

Function 0049B6BF Relevance: 1.5, APIs: 1, Instructions: 13COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0049B6C6

Part of subcall function 0049B2E6: __EH_prolog3.LIBCMT ref: 0049B2ED

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: 960e5c1a84d83fbb9b47a9c1299279ac63d44f9ed5df5f3002a0f6caba85c7e6
Instruction ID: 1b63b986fec2be6298a8efe622d74afaac5772fd3af8e43fe5bb394f675c7fbe
Opcode Fuzzy Hash: 960e5c1a84d83fbb9b47a9c1299279ac63d44f9ed5df5f3002a0f6caba85c7e6
Instruction Fuzzy Hash: 75D0237060051347CF05BFA9554934D7D62BF44704F10415DF10047241DBF84D01C7DD

Uniqueness

Uniqueness Score: -1.00%

Function 0044413A Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,00000000), ref: 00444151

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 103f927f602f5a0317de6a2c5cd1cfa53a8ab444d2c6c0327b1a273052c33ba3
Instruction ID: d4e69dbf1e194ba49a87958b2119b5c4a679d8064e8341f04c3b2b0b6db8d1d1
Opcode Fuzzy Hash: 103f927f602f5a0317de6a2c5cd1cfa53a8ab444d2c6c0327b1a273052c33ba3
Instruction Fuzzy Hash: 5AD0C9385102109BF7518F26EC0D75232A9B3A5727F408857E411862A1C7FCC844CF28

Uniqueness

Uniqueness Score: -1.00%

Function 005B5A3A Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

__waccess_s.LIBCMT ref: 005B5A45

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: __waccess_s
String ID:
API String ID: 4272103461-0
Opcode ID: ef7a6628b8ba34dfa5084db135283d76d392227949a9b5e0c08c397448921cd0
Instruction ID: 06a8dfc5b5382ff6f70570218ebd444095adc4c1c8c94db762e3e7e7b38cb168
Opcode Fuzzy Hash: ef7a6628b8ba34dfa5084db135283d76d392227949a9b5e0c08c397448921cd0
Instruction Fuzzy Hash: 79C09B3305410DBF5F095EE6EC05C553F5AD6C0B707104115FD1C895D1DD32E5519540

Uniqueness

Uniqueness Score: -1.00%

Function 004B7F10 Relevance: 1.5, APIs: 1, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 004B7F1F

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: DeleteObject
String ID:
API String ID: 1531683806-0
Opcode ID: 8dee5854ebe7aa5f13c9033a5ab4ff6aeade993cfb45559b4498977012504771
Instruction ID: 00a8a13074e23b8742a44423fba3bf5989ccb7d2aceae7f2bf33efe7f2b7f19c
Opcode Fuzzy Hash: 8dee5854ebe7aa5f13c9033a5ab4ff6aeade993cfb45559b4498977012504771
Instruction Fuzzy Hash: 83B09260829101AACF40AB3099087672658DB8134EF00ACDAF000C2411DA3DC8629568

Uniqueness

Uniqueness Score: -1.00%

Function 005C0751 Relevance: 1.5, APIs: 1, Instructions: 3COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000), ref: 005C0753

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: 905165860b6ed8c8715898cef22770677476cbdf78b9dcccd65c6754a04bb9de
Instruction ID: 5761ffe3777639a9d3f19702e4ed114a9c722a50efb098d2d1832c376bda3d2f
Opcode Fuzzy Hash: 905165860b6ed8c8715898cef22770677476cbdf78b9dcccd65c6754a04bb9de
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00456018 Relevance: 61.6, APIs: 26, Strings: 9, Instructions: 351libraryloaderfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00401BAB: __EH_prolog3.LIBCMT ref: 00401BB2

_memset.LIBCMT ref: 004560BD
_memset.LIBCMT ref: 004560D6
GetTempPathA.KERNEL32(00000104,?,?,?,?,?,?), ref: 0045611A
GetTempFileNameA.KERNEL32(?,IRWIN,00000000,?), ref: 00456134
SetFileAttributesA.KERNEL32(?,00000080), ref: 00456146
DeleteFileA.KERNEL32(?), ref: 00456153
_memset.LIBCMT ref: 0045617B
_memset.LIBCMT ref: 00456193
_memset.LIBCMT ref: 004561AC
_memset.LIBCMT ref: 004561C5
_memset.LIBCMT ref: 004561DA
_memset.LIBCMT ref: 004561F3
LoadLibraryA.KERNEL32 ref: 00456238
GetProcAddress.KERNEL32(00000000,InternetQueryOptionA), ref: 0045624E
_strncpy.LIBCMT ref: 00456298
GetProcAddress.KERNEL32(?,DetectAutoProxyUrl), ref: 004562B6
GlobalFree.KERNEL32(?), ref: 004562E4
GlobalFree.KERNEL32(?), ref: 004562F8
GlobalFree.KERNEL32(?), ref: 0045630C
FreeLibrary.KERNEL32(?), ref: 00456318
URLDownloadToFileA.URLMON(00000000,?,?,00000000,00000000), ref: 0045633B
LoadLibraryA.KERNEL32(jsproxy.dll), ref: 0045634D
GetProcAddress.KERNEL32(00000000,InternetInitializeAutoProxyDll), ref: 00456363
GetProcAddress.KERNEL32(?,InternetGetProxyInfo), ref: 00456453
GetProcAddress.KERNEL32(?,InternetDeInitializeAutoProxyDll), ref: 004564CE
FreeLibrary.KERNEL32(?), ref: 00456514

Strings

wininet.dll, xrefs: 0045620D
DetectAutoProxyUrl, xrefs: 004562AB
InternetGetProxyInfo, xrefs: 00456448
%s; DIRECT, xrefs: 004564A3
InternetDeInitializeAutoProxyDll, xrefs: 004564C3
IRWIN, xrefs: 00456128
jsproxy.dll, xrefs: 00456348
InternetQueryOptionA, xrefs: 00456248
InternetInitializeAutoProxyDll, xrefs: 0045635D

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: _memset$AddressFreeProc$FileLibrary$Global$LoadTemp$AttributesDeleteDownloadH_prolog3NamePath_strncpy
String ID: %s; DIRECT$DetectAutoProxyUrl$IRWIN$InternetDeInitializeAutoProxyDll$InternetGetProxyInfo$InternetInitializeAutoProxyDll$InternetQueryOptionA$jsproxy.dll$wininet.dll
API String ID: 4184236387-3288637522
Opcode ID: 606f42a76f94bfec8ab23838f5364e068ad5f7ca1bddbfc8f05c004e9364ab74
Instruction ID: 2b89044c4d1fa97e4a93ad672681e0552d21f9dd0047828ba835c0180919aa9b
Opcode Fuzzy Hash: 606f42a76f94bfec8ab23838f5364e068ad5f7ca1bddbfc8f05c004e9364ab74
Instruction Fuzzy Hash: 52E14B71800129AFDB25EF64CC89ADEB7B9AF54305F4041EBF509A3291DB785E88DF24

Uniqueness

Uniqueness Score: -1.00%

Function 00644500 Relevance: 36.9, Strings: 29, Instructions: 678COMMON

Download Yara Rule

Strings

&, xrefs: 006448AA
P, xrefs: 00644876
K, xrefs: 006446E8
P, xrefs: 00644904
., xrefs: 00644707
*, xrefs: 0064473D
, xrefs: 00644830
=, xrefs: 00644718
+, xrefs: 006448E9
2, xrefs: 006448D8
#, xrefs: 0064486C
%, xrefs: 00644890
&, xrefs: 0064489A
+, xrefs: 006448E2
#, xrefs: 00644862
+, xrefs: 00644700
###, xrefs: 00644C1E
., xrefs: 0064471F
%, xrefs: 00644880
', xrefs: 006446EF
=, xrefs: 006448FA
U, xrefs: 006448B4
=, xrefs: 006448F0
', xrefs: 006448CE
', xrefs: 006448BE
F, xrefs: 006446D7
2, xrefs: 00644826
TREEVIEW, xrefs: 00644EC1
(, xrefs: 00644730

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: _memset$CapsDevice
String ID: $#$#$###$%$%$&$&$'$'$'$($*$+$+$+$.$.$2$2$=$=$=$F$K$P$P$TREEVIEW$U
API String ID: 4259712331-1572848309
Opcode ID: 029aa2a5590a31450cfd1a517c5eb389843472d0ae2eba93f2aa9959f5e9c58b
Instruction ID: 26a98f4255d575996a039936bf46db6046d671b1156a92118600f7e8cfc1dbc3
Opcode Fuzzy Hash: 029aa2a5590a31450cfd1a517c5eb389843472d0ae2eba93f2aa9959f5e9c58b
Instruction Fuzzy Hash: C052C6B0E0021A8BDB689F55CC957EEBAF2EF84300F1045AEE149AB781DF744A85DF54

Uniqueness

Uniqueness Score: -1.00%

Function 0048C587 Relevance: 25.1, APIs: 2, Strings: 12, Instructions: 589COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0048C58E
__wcstoui64.LIBCMT ref: 0048C64A

Part of subcall function 004B3C8A: _malloc.LIBCMT ref: 004B3CA8

Part of subcall function 004B4C5C: __CxxThrowException@8.LIBCMT ref: 004B4C72
Part of subcall function 004B4C5C: __EH_prolog3.LIBCMT ref: 004B4C7F

Strings

BannerStyle, xrefs: 0048C6D5
Controls, xrefs: 0048C8AB
SUF70Messages, xrefs: 0048CB95
Name, xrefs: 0048C67C
Languages, xrefs: 0048CB57
Screen, xrefs: 0048C5A8, 0048C5ED
Control, xrefs: 0048C8E9
Type, xrefs: 0048C626, 0048C90B
Event, xrefs: 0048C825
TemplateName, xrefs: 0048C721
Events, xrefs: 0048C7D3
OverrideProjTheme, xrefs: 0048C776

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: H_prolog3$Exception@8Throw__wcstoui64_malloc
String ID: BannerStyle$Control$Controls$Event$Events$Languages$Name$OverrideProjTheme$SUF70Messages$Screen$TemplateName$Type
API String ID: 656894965-1496283926
Opcode ID: adbfcfa7ba50de28cd8da4bb763e84f3468c5aea1286a758add6620df81d8375
Instruction ID: e2ceec6e78e82a4b372589e6120e03302e645cdcc8d116ce0fe9af776fdee5db
Opcode Fuzzy Hash: adbfcfa7ba50de28cd8da4bb763e84f3468c5aea1286a758add6620df81d8375
Instruction Fuzzy Hash: 17227471A00605DFCB14EF69C4D16AE7BE1BF05704B10892FF05ADB381DB389A45DBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00532231 Relevance: 24.8, APIs: 13, Strings: 1, Instructions: 340COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00532238

Part of subcall function 0051D395: FillRect.USER32(?,00000020), ref: 0051D3A9

Strings

d, xrefs: 00532290

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: FillH_prolog3Rect
String ID: d
API String ID: 1863035756-2564639436
Opcode ID: 109641c05fc1234c889fd8936556ff959c9cfc6cb5479d285a569becb4cc3750
Instruction ID: 7cf71ced5e7cc05471913a4018555806e493a5ad3420f147ccc02e3871bb8968
Opcode Fuzzy Hash: 109641c05fc1234c889fd8936556ff959c9cfc6cb5479d285a569becb4cc3750
Instruction Fuzzy Hash: 36C19B7190061AAFCF14DFA8CC959EEBFB5BF48310F10452AF551EA291C738DA51DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 005D656A Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 98timeCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 005D6571
GetLocalTime.KERNEL32(00000408,00000028,005D6911,?), ref: 005D6585
__snprintf.LIBCMT ref: 005D65C0
_strlen.LIBCMT ref: 005D65CC
_strlen.LIBCMT ref: 005D65E4
__snprintf.LIBCMT ref: 005D660F
_strlen.LIBCMT ref: 005D661B
_strlen.LIBCMT ref: 005D662E
__snprintf.LIBCMT ref: 005D6659
_strlen.LIBCMT ref: 005D6665

Strings

0%d, xrefs: 005D65B2, 005D6601, 005D664B

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: _strlen$__snprintf$H_prolog3_LocalTime
String ID: 0%d
API String ID: 2764676485-2030455076
Opcode ID: 4970c43f7d3216292b8033e34e97797c6d38c94478809dfbf031d517fdd216ac
Instruction ID: 408cd10bde44bc553a6376a0e6a6d495c2a4fd1263f7b1e2614ce7aa90374674
Opcode Fuzzy Hash: 4970c43f7d3216292b8033e34e97797c6d38c94478809dfbf031d517fdd216ac
Instruction Fuzzy Hash: 49318170D0010A6EDB01AFA8DC56DFEBBBEFF44705B40451BF500A3282DB78AD4687A5

Uniqueness

Uniqueness Score: -1.00%

Function 0044A1CC Relevance: 18.3, APIs: 12, Instructions: 346fileCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0044A1D6

Part of subcall function 00485930: __EH_prolog3.LIBCMT ref: 00485937
Part of subcall function 00485930: __time64.LIBCMT ref: 0048598D
Part of subcall function 00485930: __time64.LIBCMT ref: 00485993
Part of subcall function 00485930: __time64.LIBCMT ref: 00485999

Part of subcall function 0041E239: __mbsinc.LIBCMT ref: 0041E25A

_strlen.LIBCMT ref: 0044A263

Part of subcall function 00403C07: _strnlen.LIBCMT ref: 00403C37
Part of subcall function 00403C07: _memcpy_s.LIBCMT ref: 00403C6B

Part of subcall function 00405B76: __EH_prolog3.LIBCMT ref: 00405B7D

FindFirstFileA.KERNEL32(?,?,?,00000000,?), ref: 0044A2C1
IsWindow.USER32(?), ref: 0044A2D7
InterlockedIncrement.KERNEL32(?), ref: 0044A438
FindNextFileA.KERNEL32(000000FF,?), ref: 0044A4BE
FindClose.KERNEL32(000000FF), ref: 0044A4D2
FindFirstFileA.KERNEL32(?,?), ref: 0044A535
IsWindow.USER32(?), ref: 0044A59C

Part of subcall function 004014A6: _memcpy_s.LIBCMT ref: 004014F6

Part of subcall function 00475113: __EH_prolog3.LIBCMT ref: 0047511A

Part of subcall function 004B8882: IsWindow.USER32(?), ref: 004B8896

Part of subcall function 00449FCA: __EH_prolog3.LIBCMT ref: 00449FD1

InterlockedIncrement.KERNEL32(?), ref: 0044A65A
FindNextFileA.KERNEL32(00000000,00000010), ref: 0044A678
FindClose.KERNEL32(00000000), ref: 0044A687

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: Find$FileH_prolog3$Window__time64$CloseFirstIncrementInterlockedNext_memcpy_s$H_prolog3___mbsinc_strlen_strnlen
String ID:
API String ID: 968620008-0
Opcode ID: 0554961d7f6759f72fd1560f7a80a8bb58357d64459ff3222d7c0cf70b037335
Instruction ID: 077aed5ee25add7a01d95150901a5cd30f4a91839218a469bac76b62b0b7ce0a
Opcode Fuzzy Hash: 0554961d7f6759f72fd1560f7a80a8bb58357d64459ff3222d7c0cf70b037335
Instruction Fuzzy Hash: 5BE18C71900618DBDB25DFA8CC49BDE77B8AF15318F0402DEB419A62D2DB389E84CF65

Uniqueness

Uniqueness Score: -1.00%

Function 004C8661 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 429COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004C8668
_strlen.LIBCMT ref: 004C8727
_strlen.LIBCMT ref: 004C8731
_strlen.LIBCMT ref: 004C87A1
_memcpy_s.LIBCMT ref: 004C87E7

Part of subcall function 004B4AE6: __EH_prolog3.LIBCMT ref: 004B4AED

_strlen.LIBCMT ref: 004C87FC
_memcpy_s.LIBCMT ref: 004C8847

Part of subcall function 004B4C5C: __CxxThrowException@8.LIBCMT ref: 004B4C72
Part of subcall function 004B4C5C: __EH_prolog3.LIBCMT ref: 004B4C7F

PathRemoveFileSpecW.SHLWAPI(?,?,00000000,00000000,?,?,?,?,?,00000000,00000000,00000218), ref: 004C895E

Part of subcall function 004B4379: _wmemcpy_s.LIBCPMT ref: 004B43BD

Strings

, xrefs: 004C8B8B

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: _strlen$H_prolog3$_memcpy_s$Exception@8FilePathRemoveSpecThrow_wmemcpy_s
String ID:
API String ID: 1565231592-3916222277
Opcode ID: dc5b885059167bdfb66de8da1d07356e8572bdc1a22c39934d02a331e23f6957
Instruction ID: 39400909ded5966ca4e9e5b1b361c1bd5eff571311a8e45c49c752dee28b4919
Opcode Fuzzy Hash: dc5b885059167bdfb66de8da1d07356e8572bdc1a22c39934d02a331e23f6957
Instruction Fuzzy Hash: D402CE75A01206CFCF58DFA4C945FBEB7B5BF84315F14026EE511AB2A2DB389A01CB64

Uniqueness

Uniqueness Score: -1.00%

Function 004860CD Relevance: 9.2, APIs: 6, Instructions: 248fileCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 004860D7

Part of subcall function 00485930: __EH_prolog3.LIBCMT ref: 00485937
Part of subcall function 00485930: __time64.LIBCMT ref: 0048598D
Part of subcall function 00485930: __time64.LIBCMT ref: 00485993
Part of subcall function 00485930: __time64.LIBCMT ref: 00485999

Part of subcall function 00405B76: __EH_prolog3.LIBCMT ref: 00405B7D

FindFirstFileA.KERNEL32(?,?,00000000,00698DAC,00000000), ref: 0048617E

Part of subcall function 004850AA: PeekMessageA.USER32(?,00000000,00000000,00000000,00000000), ref: 004850DC

IsWindow.USER32(?), ref: 0048619B
InterlockedIncrement.KERNEL32(00000000), ref: 0048636A
FindNextFileA.KERNEL32(000000FF,?), ref: 004863F4
FindClose.KERNEL32(000000FF), ref: 0048640C

Part of subcall function 00485382: __EH_prolog3.LIBCMT ref: 00485389

Part of subcall function 004B8882: IsWindow.USER32(?), ref: 004B8896

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: FindH_prolog3__time64$FileWindow$CloseFirstH_prolog3_IncrementInterlockedMessageNextPeek
String ID:
API String ID: 499981334-0
Opcode ID: 648d4275f7f3c1845034083f7b4d3d312dfc6ceafe13cf993faa4f6d34bdf3cd
Instruction ID: 7494a8360f8e5c29ec65089434091a27dbf0108b0ef7a2a7593475d563dee931
Opcode Fuzzy Hash: 648d4275f7f3c1845034083f7b4d3d312dfc6ceafe13cf993faa4f6d34bdf3cd
Instruction Fuzzy Hash: 0FA18D71900618DBCB15EFA8CC45BDE77B8AF05324F0402DAB519A73D2DB389A84CF55

Uniqueness

Uniqueness Score: -1.00%

Function 005DA56E Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 213COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 005DA575

Part of subcall function 005D31F9: __EH_prolog3_catch.LIBCMT ref: 005D3200
Part of subcall function 005D31F9: TlsGetValue.KERNEL32(00000000,0000000C,005D68EE,00000408,005D2578,00000011,is5_GetHBITMAPDimensions,00000000), ref: 005D3217
Part of subcall function 005D31F9: TlsSetValue.KERNEL32(?,00000000), ref: 005D324E
Part of subcall function 005D31F9: GetLastError.KERNEL32(?,00000000), ref: 005D3258
Part of subcall function 005D31F9: __CxxThrowException@8.LIBCMT ref: 005D326A
Part of subcall function 005D31F9: RtlEnterCriticalSection.NTDLL(?), ref: 005D3273
Part of subcall function 005D31F9: RtlLeaveCriticalSection.NTDLL(?), ref: 005D3289

Strings

\lv, xrefs: 005DA761
\lv, xrefs: 005DA57F

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: CriticalSectionValue$EnterErrorException@8H_prolog3H_prolog3_catchLastLeaveThrow
String ID: \lv$\lv
API String ID: 3824262711-1248172524
Opcode ID: 11308860366b7c883d8f88fb7039b14e1742dd9f1ce92b642fe51a575e00848e
Instruction ID: 94b568a08275849e2ae8b7f4840a1345831ae3ea82473afeb9951e50fcf8cb66
Opcode Fuzzy Hash: 11308860366b7c883d8f88fb7039b14e1742dd9f1ce92b642fe51a575e00848e
Instruction Fuzzy Hash: AB819C35A0428ADBCF25DF2CC4511EE7FB2FF89314B29856BE8599B342D634D941CB82

Uniqueness

Uniqueness Score: -1.00%

Function 0044658E Relevance: 1.6, APIs: 1, Instructions: 55serviceCOMMON

Download Yara Rule

APIs

CreateServiceA.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004465F5

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: CreateService
String ID:
API String ID: 1592570254-0
Opcode ID: fcc468ca0262f4d24dddf22ef27b21f886faff025ed9febb6d27ccd9b66b1bc0
Instruction ID: 14e27b65de38494583534c202d89320e41258d1366f53594c3af0feef897a22e
Opcode Fuzzy Hash: fcc468ca0262f4d24dddf22ef27b21f886faff025ed9febb6d27ccd9b66b1bc0
Instruction Fuzzy Hash: BF118232200105FFEF125F65DD00AEB3BAAEF09354F06852AFD1591160D735D861EF55

Uniqueness

Uniqueness Score: -1.00%

Function 0044665D Relevance: 1.5, APIs: 1, Instructions: 20serviceCOMMON

Download Yara Rule

APIs

DeleteService.ADVAPI32(?), ref: 00446671

Part of subcall function 00446385: GetLastError.KERNEL32(?,?,004463C1,00000000,?,0044648E,?,00442845,00000004), ref: 00446392

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: DeleteErrorLastService
String ID:
API String ID: 2624721794-0
Opcode ID: 7b44eafab7cdb904cbeaf4d9293198b9d76f66c0df4276558a7801e48be1427d
Instruction ID: f87340a0c3915b5f4fa2438ffc14ac151fa7b20e61513ccc49f30c6027448dc0
Opcode Fuzzy Hash: 7b44eafab7cdb904cbeaf4d9293198b9d76f66c0df4276558a7801e48be1427d
Instruction Fuzzy Hash: A7D0A73125592005BB607A353C016D715898B02691B0B042BB80DC0144DE59CC428199

Uniqueness

Uniqueness Score: -1.00%

Function 005D0460 Relevance: 1.4, Strings: 1, Instructions: 180COMMON

Download Yara Rule

Strings

N@, xrefs: 005D0470

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID:
String ID: N@
API String ID: 0-1509896676
Opcode ID: 92e9a144b7047ce14b539b05f6d9118c1a7fbc1d7368d7adfc1bc9e5646efcc8
Instruction ID: 701dfd93812aa6a2f10aa8cb1683978420a17b58da22190379c75f13928cda00
Opcode Fuzzy Hash: 92e9a144b7047ce14b539b05f6d9118c1a7fbc1d7368d7adfc1bc9e5646efcc8
Instruction Fuzzy Hash: C16137729013158FCB28CF49D4846AABBF2BF84310F1AC5AFD9095B3A2D7B19955CB84

Uniqueness

Uniqueness Score: -1.00%

Function 00478318 Relevance: 189.4, APIs: 84, Strings: 24, Instructions: 439COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00478322

Part of subcall function 00459443: lua_getfield.LUA5.1(?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459455
Part of subcall function 00459443: lua_pushstring.LUA5.1(?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459460
Part of subcall function 00459443: lua_gettable.LUA5.1(?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459468
Part of subcall function 00459443: lua_remove.LUA5.1(?,000000FE,?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459470
Part of subcall function 00459443: lua_type.LUA5.1(?,000000FF,?,000000FE,?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459478
Part of subcall function 00459443: lua_pcall.LUA5.1(?,00000000,00000000,00000000), ref: 0045948B
Part of subcall function 00459443: lua_remove.LUA5.1(?,000000FF), ref: 0045949A

_memset.LIBCMT ref: 00478346
_memset.LIBCMT ref: 0047835D
GetVersionExA.KERNEL32 ref: 004783F0
GetVersionExA.KERNEL32(?), ref: 00478416
GetSystemMetrics.USER32(00000059), ref: 004784ED
GetSystemMetrics.USER32(00000057), ref: 004784F7
GetSystemMetrics.USER32(00000058), ref: 00478501
GetSystemMetrics.USER32(00000056), ref: 0047850B
lua_createtable.LUA5.1(?,00000000,00000000,00000000), ref: 0047852C
lua_pushstring.LUA5.1(?,MajorVersion,?,00699430,?,?,00000000,00000000,00000000), ref: 0047854E
lua_pushstring.LUA5.1(?,?,?,MajorVersion,?,00699430,?,?,00000000,00000000,00000000), ref: 0047855A
lua_settable.LUA5.1(?,000000FD,?,?,?,MajorVersion,?,00699430,?,?,00000000,00000000,00000000), ref: 00478564
lua_pushstring.LUA5.1(?,MinorVersion,?,00699430,?,?,000000FD,?,?,?,MajorVersion,?,00699430,?,?,00000000), ref: 00478586
lua_pushstring.LUA5.1(?,?), ref: 00478595

Part of subcall function 004593D3: lua_getfield.LUA5.1(?,FFFFD8EE,Application,?,?,00407717,?,00000000), ref: 004593E5
Part of subcall function 004593D3: lua_pushstring.LUA5.1(?,SetLastError,?,FFFFD8EE,Application,?,?,00407717,?,00000000), ref: 004593F0
Part of subcall function 004593D3: lua_gettable.LUA5.1(?,000000FE,?,SetLastError,?,FFFFD8EE,Application,?,?,00407717,?,00000000), ref: 004593F8
Part of subcall function 004593D3: lua_remove.LUA5.1(?,000000FE,?,000000FE,?,SetLastError,?,FFFFD8EE,Application,?,?,00407717,?,00000000), ref: 00459400
Part of subcall function 004593D3: lua_type.LUA5.1(?,000000FF,?,000000FE,?,000000FE,?,SetLastError,?,FFFFD8EE,Application,?,?,00407717,?,00000000), ref: 00459408
Part of subcall function 004593D3: lua_pushnumber.LUA5.1(?,?,?,?,?,?,?,?,?,?,?,00407717,?,00000000), ref: 0045941E
Part of subcall function 004593D3: lua_pcall.LUA5.1(?,00000001,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00407717), ref: 0045942A
Part of subcall function 004593D3: lua_remove.LUA5.1(?,000000FF,?,?,?,?,?,?,?,?,00407717,?,00000000), ref: 00459439

lua_pushnil.LUA5.1(?), ref: 00478953

Strings

SmallBusinessRestricted, xrefs: 0047884B
PlatformId, xrefs: 00478606
XPMediaCenterEdition, xrefs: 004788C9
ProductType, xrefs: 004786F2
ServicePackMinor, xrefs: 004786AB
ComputeServer, xrefs: 00478770
DataCenter, xrefs: 00478791
Personal, xrefs: 004787EE
BackOffice, xrefs: 00478739
Blade, xrefs: 00478752
MajorVersion, xrefs: 00478548
StarterEdition, xrefs: 004788E7
Server2003R2, xrefs: 004788A8
EmbeddedNT, xrefs: 004787D0
CSDVersion, xrefs: 00478646
Communications, xrefs: 0047888A
SmallBusiness, xrefs: 0047882D
Terminal, xrefs: 00478869
ServicePackMajor, xrefs: 00478664
TabletPCEdition, xrefs: 00478905
Enterprise, xrefs: 004787AF
SingleUserTerminalService, xrefs: 0047880C
MinorVersion, xrefs: 00478580
BuildNumber, xrefs: 004785CE

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: lua_pushstring.$MetricsSystemlua_remove.$Version_memsetlua_getfield.lua_gettable.lua_pcall.lua_type.$H_prolog3_lua_createtable.lua_pushnil.lua_pushnumber.lua_settable.
String ID: BackOffice$Blade$BuildNumber$CSDVersion$Communications$ComputeServer$DataCenter$EmbeddedNT$Enterprise$MajorVersion$MinorVersion$Personal$PlatformId$ProductType$Server2003R2$ServicePackMajor$ServicePackMinor$SingleUserTerminalService$SmallBusiness$SmallBusinessRestricted$StarterEdition$TabletPCEdition$Terminal$XPMediaCenterEdition
API String ID: 4198366811-4272276067
Opcode ID: fba31b90052455933ebeaf49e445128a3895119376b57364f4523a0a205c0366
Instruction ID: ca089eadf3be6d0a966c28e9d2eb6daac2bb1133f682b5891abd011e6012ac18
Opcode Fuzzy Hash: fba31b90052455933ebeaf49e445128a3895119376b57364f4523a0a205c0366
Instruction Fuzzy Hash: 82E13E71809A24AADB217F638C06FDE7A79AF5630AF00419EF10C75157DB385B818E69

Uniqueness

Uniqueness Score: -1.00%

Function 0041E503 Relevance: 93.1, APIs: 44, Strings: 9, Instructions: 398stringCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,242F57F1,?,?,SetupValues,00000000,006770A3,000000FF,?,?,?,0000000A,?,00000001), ref: 0041E545
GetFullPathNameA.KERNEL32(?,00000104,?,00000000,?,?,SetupValues,00000000,006770A3,000000FF,?,?,?,0000000A,?,00000001), ref: 0041E563
GetShortPathNameA.KERNEL32(?,?,00000104), ref: 0041E57C
__splitpath_s.LIBCMT ref: 0041E5A5
lstrcpy.KERNEL32(?,?), ref: 0041E5C1
lstrcat.KERNEL32(?,?), ref: 0041E5D7
lstrcat.KERNEL32(?,lua5.1.dll), ref: 0041E5E5
lstrcpy.KERNEL32(?,/c for /L %i in (1,1,30) do IF EXIST "), ref: 0041E5F3
lstrcat.KERNEL32(?,?), ref: 0041E603
lstrcat.KERNEL32(?,0069A128), ref: 0041E612
lstrcat.KERNEL32(?, del ), ref: 0041E620
lstrcat.KERNEL32(?,0069A128), ref: 0041E62A
lstrcat.KERNEL32(?,?), ref: 0041E63A
lstrcat.KERNEL32(?,0069A128), ref: 0041E644
lstrcat.KERNEL32(?, | del ), ref: 0041E652
lstrcat.KERNEL32(?,0069A128), ref: 0041E65C
lstrcat.KERNEL32(?,?), ref: 0041E66C
lstrcat.KERNEL32(?,0069A128), ref: 0041E676
lstrcpy.KERNEL32(?,/c del ), ref: 0041E684
lstrcat.KERNEL32(?,0069A128), ref: 0041E692
lstrcat.KERNEL32(?,?), ref: 0041E6A2
lstrcat.KERNEL32(?,0069A128), ref: 0041E6AC
lstrcpy.KERNEL32(?, | del ), ref: 0041E6BA
lstrcat.KERNEL32(?,0069A128), ref: 0041E6C8
lstrcat.KERNEL32(?,?), ref: 0041E6D8
lstrcat.KERNEL32(?,0069A128), ref: 0041E6E2
__splitpath_s.LIBCMT ref: 0041E701
lstrcpy.KERNEL32(?,?), ref: 0041E717
lstrcat.KERNEL32(?,?), ref: 0041E72B

Part of subcall function 00401BAB: __EH_prolog3.LIBCMT ref: 00401BB2

Part of subcall function 0041E239: __mbsinc.LIBCMT ref: 0041E25A

lstrcpy.KERNEL32(?,-00000010), ref: 0041E856
GetFullPathNameA.KERNEL32(?,00000104,?,00000000), ref: 0041E896
GetShortPathNameA.KERNEL32(?,?,00000104), ref: 0041E8A9
lstrcat.KERNEL32(?, | rmdir ), ref: 0041E8C3
lstrcat.KERNEL32(?,0069A128), ref: 0041E8CD
lstrcat.KERNEL32(?,?), ref: 0041E8DD
lstrcat.KERNEL32(?,0069A128), ref: 0041E8E7
lstrcat.KERNEL32(?, | rmdir ), ref: 0041E918
lstrcat.KERNEL32(?,0069A128), ref: 0041E922
lstrcat.KERNEL32(?,?), ref: 0041E931
lstrcat.KERNEL32(?,0069A128), ref: 0041E93B
lstrcat.KERNEL32(?, > NUL), ref: 0041E949
lstrcat.KERNEL32(?, > NUL), ref: 0041E957
GetEnvironmentVariableA.KERNEL32(ComSpec,?,00000104,?,0000005C,0000000A), ref: 0041E9AD
ShellExecuteA.SHELL32(00000000,00000000,?,?,00000000,00000000), ref: 0041E9E5

Strings

| del , xrefs: 0041E646, 0041E6AE
/c del , xrefs: 0041E678
SetupValues, xrefs: 0041E528
lua5.1.dll, xrefs: 0041E5D9
del , xrefs: 0041E614
| rmdir , xrefs: 0041E8B7, 0041E90C
ComSpec, xrefs: 0041E9A8
/c for /L %i in (1,1,30) do IF EXIST ", xrefs: 0041E5E7
> NUL, xrefs: 0041E93D, 0041E94B

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: lstrcat$lstrcpy$Name$Path$FullShort__splitpath_s$EnvironmentExecuteFileH_prolog3ModuleShellVariable__mbsinc
String ID: > NUL$ del $ | del $ | rmdir $/c del $/c for /L %i in (1,1,30) do IF EXIST "$ComSpec$SetupValues$lua5.1.dll
API String ID: 2024491441-2339238920
Opcode ID: a5dff28a414583209a07ac022cf3d5ea87a631bc0d4c0d44ef12197144a20c71
Instruction ID: 892ae718a925ea176d4b291da2811c508c19a23f12ed92721aa22e290b47de64
Opcode Fuzzy Hash: a5dff28a414583209a07ac022cf3d5ea87a631bc0d4c0d44ef12197144a20c71
Instruction Fuzzy Hash: 2EE1FCB290112CAFDB20DBA5DC85EDABBBCAF48314F0005E6E549E3141DA74AAD4CF64

Uniqueness

Uniqueness Score: -1.00%

Function 004625CC Relevance: 93.1, APIs: 45, Strings: 8, Instructions: 384COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004625D3

Part of subcall function 00401BAB: __EH_prolog3.LIBCMT ref: 00401BB2

Part of subcall function 0043C227: __EH_prolog3.LIBCMT ref: 0043C22E

lua_getfield.LUA5.1(00000000,FFFFD8EE,StatusDlg), ref: 004626C8
lua_pushstring.LUA5.1(00000000,SetTitle,00000000,FFFFD8EE,StatusDlg), ref: 004626D3
lua_gettable.LUA5.1(00000000,000000FE,00000000,SetTitle,00000000,FFFFD8EE,StatusDlg), ref: 004626DB
lua_remove.LUA5.1(00000000,000000FE,00000000,000000FE,00000000,SetTitle,00000000,FFFFD8EE,StatusDlg), ref: 004626E3
lua_type.LUA5.1(00000000,000000FF,00000000,000000FE,00000000,000000FE,00000000,SetTitle,00000000,FFFFD8EE,StatusDlg), ref: 004626EB
lua_pushstring.LUA5.1(00000000,?), ref: 004626FC
lua_pcall.LUA5.1(00000000,00000001,00000000,00000000,00000000,?), ref: 00462708
lua_remove.LUA5.1(00000000,000000FF), ref: 00462717
lua_getfield.LUA5.1(00000000,FFFFD8EE,StatusDlg), ref: 00462721
lua_pushstring.LUA5.1(00000000,SetMessage,00000000,FFFFD8EE,StatusDlg), ref: 0046272C
lua_gettable.LUA5.1(00000000,000000FE,00000000,SetMessage,00000000,FFFFD8EE,StatusDlg), ref: 00462734
lua_remove.LUA5.1(00000000,000000FE,00000000,000000FE,00000000,SetMessage,00000000,FFFFD8EE,StatusDlg), ref: 0046273C
lua_type.LUA5.1(00000000,000000FF,00000000,000000FE,00000000,000000FE,00000000,SetMessage,00000000,FFFFD8EE,StatusDlg), ref: 00462744
lua_pushstring.LUA5.1(00000000,00000000,?,?,00000037), ref: 0046277E
lua_pcall.LUA5.1(00000000,00000001,00000000,00000000,?,?,00000037), ref: 00462797
lua_remove.LUA5.1(00000000,000000FF), ref: 004627A6
lua_getfield.LUA5.1(00000000,FFFFD8EE,StatusDlg), ref: 004627B0
lua_pushstring.LUA5.1(00000000,SetMeterPos,00000000,FFFFD8EE,StatusDlg), ref: 004627BB
lua_gettable.LUA5.1(00000000,000000FE,00000000,SetMeterPos,00000000,FFFFD8EE,StatusDlg), ref: 004627C3
lua_remove.LUA5.1(00000000,000000FE,00000000,000000FE,00000000,SetMeterPos,00000000,FFFFD8EE,StatusDlg), ref: 004627CB
lua_type.LUA5.1(00000000,000000FF,00000000,000000FE,00000000,000000FE,00000000,SetMeterPos,00000000,FFFFD8EE,StatusDlg), ref: 004627D3
lua_pushnumber.LUA5.1(00000000), ref: 004627F6
lua_pcall.LUA5.1(00000000,00000001,00000000,00000000,00000000), ref: 00462802
lua_remove.LUA5.1(00000000,000000FF), ref: 00462811
lua_getfield.LUA5.1(00000000,FFFFD8EE,StatusDlg), ref: 0046281B
lua_pushstring.LUA5.1(00000000,IsCancelled,00000000,FFFFD8EE,StatusDlg), ref: 00462826
lua_gettable.LUA5.1(00000000,000000FE,00000000,IsCancelled,00000000,FFFFD8EE,StatusDlg), ref: 0046282E
lua_remove.LUA5.1(00000000,000000FE,00000000,000000FE,00000000,IsCancelled,00000000,FFFFD8EE,StatusDlg), ref: 00462836
lua_type.LUA5.1(00000000,FFFFD8EE,00000000,000000FE,00000000,000000FE,00000000,IsCancelled,00000000,FFFFD8EE,StatusDlg), ref: 00462840
lua_pcall.LUA5.1(00000000,00000000,00000001,00000000), ref: 00462854
lua_remove.LUA5.1(00000000,FFFFD8EE), ref: 00462862
lua_type.LUA5.1(00000000,FFFFD8EE), ref: 0046286C
lua_type.LUA5.1(00000000,00000000), ref: 004629BD
lua_settop.LUA5.1(00000000,000000FE), ref: 00462898

Part of subcall function 00459912: __EH_prolog3.LIBCMT ref: 00459919
Part of subcall function 00459912: lua_type.LUA5.1(?,?,00000000,00000000,0000000C,00407B22,?,00000002), ref: 00459949

lua_pushvalue.LUA5.1(00000000,000000FF), ref: 004628A9
lua_type.LUA5.1(00000000,000000FF,00000000,000000FF), ref: 004628B1
lua_pushstring.LUA5.1(00000000,?), ref: 004628C6
lua_pushnumber.LUA5.1(00000000,00000000,?), ref: 004628FB
lua_pushnumber.LUA5.1(00000000,?), ref: 0046292A
lua_pcall.LUA5.1(00000000,00000003,00000001,00000000,00000000,?), ref: 00462935
lua_tolstring.LUA5.1(00000000,000000FF,00000000), ref: 00462945
lua_settop.LUA5.1(00000000,000000FE), ref: 0046295D
lua_remove.LUA5.1(00000000,00000000,00000000,00000000), ref: 004629D4
lua_remove.LUA5.1(00000000,000000FF), ref: 004629E1

Strings

Deleting, xrefs: 004625E1
SetMeterPos, xrefs: 004627B5
SetMessage, xrefs: 00462726
__NOREPORT__, xrefs: 00462964
StatusDlg, xrefs: 004626B8, 004626BD, 0046271E, 004627AD, 00462818
IsCancelled, xrefs: 00462820
SetTitle, xrefs: 004626CD
MSG_DELETING, xrefs: 0046260C

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: lua_remove.$lua_type.$lua_pushstring.$lua_pcall.$H_prolog3lua_getfield.lua_gettable.$lua_pushnumber.$lua_settop.$lua_pushvalue.lua_tolstring.
String ID: Deleting$IsCancelled$MSG_DELETING$SetMessage$SetMeterPos$SetTitle$StatusDlg$__NOREPORT__
API String ID: 2464475924-4049856608
Opcode ID: 3e110dd7dcd37460bdc560726d9f197cc62998c786d5d70acb98167282fddbe1
Instruction ID: 4799a319ce2d263d2ec391f832f653a48ed384e294b1e496264e05adbbed37d3
Opcode Fuzzy Hash: 3e110dd7dcd37460bdc560726d9f197cc62998c786d5d70acb98167282fddbe1
Instruction Fuzzy Hash: 72C1C6719086167BDB14AF66CD42FDF36A4AF46335F10061EF430A62D2DF7CA60186AE

Uniqueness

Uniqueness Score: -1.00%

Function 004643BB Relevance: 77.5, APIs: 36, Strings: 8, Instructions: 467COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004643C5

Part of subcall function 00459443: lua_getfield.LUA5.1(?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459455
Part of subcall function 00459443: lua_pushstring.LUA5.1(?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459460
Part of subcall function 00459443: lua_gettable.LUA5.1(?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459468
Part of subcall function 00459443: lua_remove.LUA5.1(?,000000FE,?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459470
Part of subcall function 00459443: lua_type.LUA5.1(?,000000FF,?,000000FE,?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459478
Part of subcall function 00459443: lua_pcall.LUA5.1(?,00000000,00000000,00000000), ref: 0045948B
Part of subcall function 00459443: lua_remove.LUA5.1(?,000000FF), ref: 0045949A

Part of subcall function 004597A0: __EH_prolog3.LIBCMT ref: 004597A7
Part of subcall function 004597A0: lua_gettop.LUA5.1(?,00000000,00000000,00000008,004076D1,?,00000002,?), ref: 004597D3

Part of subcall function 00459852: __EH_prolog3.LIBCMT ref: 00459859
Part of subcall function 00459852: lua_tolstring.LUA5.1(?,?,00000000,00000000,00000000,0000000C,004082AF,?,00000002,?,00000001,?,00000002), ref: 0045988A

Part of subcall function 00401BAB: __EH_prolog3.LIBCMT ref: 00401BB2

lua_type.LUA5.1(?,00000002), ref: 0046440C
lua_type.LUA5.1(?,00000002), ref: 0046441B
lua_type.LUA5.1(?,00000003), ref: 00464449
lua_type.LUA5.1(?,00000003), ref: 00464458
lua_type.LUA5.1(?,00000004), ref: 0046447C
lua_type.LUA5.1(?,00000004), ref: 0046448D
lua_type.LUA5.1(?,00000005), ref: 004644B1
lua_type.LUA5.1(?,00000005), ref: 004644BF
lua_type.LUA5.1(?,00000006), ref: 004644E7
lua_type.LUA5.1(?,00000006), ref: 004644F5
lua_type.LUA5.1(?,00000007), ref: 00464523
lua_type.LUA5.1(?,00000007), ref: 00464531
lua_type.LUA5.1(?,00000008), ref: 0046455F
lua_type.LUA5.1(?,00000008), ref: 0046456D
lua_type.LUA5.1(?,00000009), ref: 00464592
lua_type.LUA5.1(?,00000009), ref: 004645A0
lua_type.LUA5.1(?,0000000A), ref: 004645D3
lua_type.LUA5.1(?,0000000A), ref: 004645E5
lua_type.LUA5.1(?,0000000A), ref: 004645F6
lua_next.LUA5.1(?,0000000A,?), ref: 0046460E
lua_tolstring.LUA5.1(?,000000FE,00000000), ref: 00464620
lua_pushnil.LUA5.1(?), ref: 00464607

Part of subcall function 004019B2: _strlen.LIBCMT ref: 004019C2

lua_toboolean.LUA5.1(?,000000FF,00000000), ref: 00464634
lua_settop.LUA5.1(?,000000FE,UnicodeEnvironment,Suspended,SeparateWOWVDM,NewProcessGroup,NewConsole,DefaultErrorMode,00000000), ref: 004646D2
lua_next.LUA5.1(?,0000000A,?,000000FE,UnicodeEnvironment,Suspended,SeparateWOWVDM,NewProcessGroup,NewConsole,DefaultErrorMode,00000000), ref: 004646D9
_memset.LIBCMT ref: 00464705
_memset.LIBCMT ref: 00464712

Part of subcall function 00451FEA: __EH_prolog3.LIBCMT ref: 00451FF1

lua_type.LUA5.1(?,0000000B), ref: 0046480B
lua_pushstring.LUA5.1(?,ErrorCode), ref: 0046481D
lua_pushnumber.LUA5.1(?,?,ErrorCode), ref: 00464829
lua_settable.LUA5.1(?,000000FD,?,?,ErrorCode), ref: 00464831
lua_pushstring.LUA5.1(?,ErrorMsg,?,000000FD,?,?,ErrorCode), ref: 0046483C
lua_pushstring.LUA5.1(?,?,?,ErrorMsg,?,000000FD,?,?,ErrorCode), ref: 00464845
lua_settable.LUA5.1(?,000000FD,?,?,?,ErrorMsg,?,000000FD,?,?,ErrorCode), ref: 0046484D
lua_pushnumber.LUA5.1(?,?,?), ref: 00464872

Strings

UnicodeEnvironment, xrefs: 004646B7
NewConsole, xrefs: 00464655
SeparateWOWVDM, xrefs: 00464686
NewProcessGroup, xrefs: 0046466C
ErrorMsg, xrefs: 00464836
DefaultErrorMode, xrefs: 0046463B
ErrorCode, xrefs: 00464817
Suspended, xrefs: 004646A0

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: lua_type.$H_prolog3$lua_pushstring.$_memsetlua_next.lua_pushnumber.lua_remove.lua_settable.lua_tolstring.$_strlenlua_getfield.lua_gettable.lua_gettop.lua_pcall.lua_pushnil.lua_settop.lua_toboolean.
String ID: DefaultErrorMode$ErrorCode$ErrorMsg$NewConsole$NewProcessGroup$SeparateWOWVDM$Suspended$UnicodeEnvironment
API String ID: 431716515-1771895760
Opcode ID: f5c9c18e4bed22d7121c33a99638c6f92f85098747fbe1709fa00c48dce7dab2
Instruction ID: 8d1e95e7449e80a959716473ac4a97f1fdcf4c0c94b79b99ad9d69d9bc814703
Opcode Fuzzy Hash: f5c9c18e4bed22d7121c33a99638c6f92f85098747fbe1709fa00c48dce7dab2
Instruction Fuzzy Hash: 1AE1C531904219AADB14EBA6DC52FEE7378AF12329F20011FF511B11D2EF7C6B45866E

Uniqueness

Uniqueness Score: -1.00%

Function 0047E518 Relevance: 72.2, APIs: 35, Strings: 6, Instructions: 458COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0047E522

Part of subcall function 00459443: lua_getfield.LUA5.1(?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459455
Part of subcall function 00459443: lua_pushstring.LUA5.1(?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459460
Part of subcall function 00459443: lua_gettable.LUA5.1(?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459468
Part of subcall function 00459443: lua_remove.LUA5.1(?,000000FE,?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459470
Part of subcall function 00459443: lua_type.LUA5.1(?,000000FF,?,000000FE,?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459478
Part of subcall function 00459443: lua_pcall.LUA5.1(?,00000000,00000000,00000000), ref: 0045948B
Part of subcall function 00459443: lua_remove.LUA5.1(?,000000FF), ref: 0045949A

Part of subcall function 004597A0: __EH_prolog3.LIBCMT ref: 004597A7
Part of subcall function 004597A0: lua_gettop.LUA5.1(?,00000000,00000000,00000008,004076D1,?,00000002,?), ref: 004597D3

Part of subcall function 00459852: __EH_prolog3.LIBCMT ref: 00459859
Part of subcall function 00459852: lua_tolstring.LUA5.1(?,?,00000000,00000000,00000000,0000000C,004082AF,?,00000002,?,00000001,?,00000002), ref: 0045988A

Part of subcall function 00401BAB: __EH_prolog3.LIBCMT ref: 00401BB2

Part of subcall function 004599E0: __EH_prolog3.LIBCMT ref: 004599E7
Part of subcall function 004599E0: lua_type.LUA5.1(?,?,00000000,00000000,0000000C,004085AC,?,?,00000024), ref: 00459A16

lua_pushnil.LUA5.1(?,?,00000002), ref: 0047E571
lua_next.LUA5.1(?,00000002,?,?,00000002), ref: 0047E579
lua_tolstring.LUA5.1(?,000000FE,00000000), ref: 0047E58D
_strlen.LIBCMT ref: 0047E59F
lua_tolstring.LUA5.1(?,000000FF,00000000,006A333C,00000000,00000000), ref: 0047E5B4
_strlen.LIBCMT ref: 0047E5C6
lua_settop.LUA5.1(?,000000FE,006A333C,00000000,00000000,006A333C,00000000,00000000), ref: 0047E5D9
lua_next.LUA5.1(?,00000002,?,000000FE,006A333C,00000000,00000000,006A333C,00000000,00000000), ref: 0047E5E1
lua_type.LUA5.1(?), ref: 0047E600
lua_type.LUA5.1(?,00000003), ref: 0047E60F
lua_type.LUA5.1(?,00000004), ref: 0047E636
lua_type.LUA5.1(?,00000004), ref: 0047E645
lua_type.LUA5.1(?,00000005), ref: 0047E66C
lua_type.LUA5.1(?,00000005), ref: 0047E67B
lua_type.LUA5.1(?,00000006,00000000), ref: 0047E6C9
lua_type.LUA5.1(?,00000006,00000000), ref: 0047E6DB
lua_pushnil.LUA5.1(?,?,00000006,00000000), ref: 0047E6F2
lua_next.LUA5.1(?,00000006,?,?,00000006,00000000), ref: 0047E6F9
lua_tolstring.LUA5.1(?,000000FF,00000000,UserName,00000000,?,?,?,?,?,?,?,00000000), ref: 0047E731
lua_tolstring.LUA5.1(?,000000FF,00000000,Password,UserName,00000000,?,?,?,?,?,?,?,00000000), ref: 0047E750
lua_settop.LUA5.1(?,000000FE,Password,UserName,00000000,?,?,?,?,?,?,?,00000000), ref: 0047E764
lua_next.LUA5.1(?,00000006,?,000000FE,Password,UserName,00000000,?,?,?,?,?,?,?,00000000), ref: 0047E76C
lua_tolstring.LUA5.1(?,000000FE,00000000,?,?,?,?,00000000), ref: 0047E70B

Part of subcall function 004019B2: _strlen.LIBCMT ref: 004019C2

lua_type.LUA5.1(?,00000007,00000000), ref: 0047E7A6
lua_type.LUA5.1(?,00000007,00000000), ref: 0047E7B9
lua_pushnil.LUA5.1(?,?,00000007,00000000), ref: 0047E7D1
lua_next.LUA5.1(?,00000007,?,?,00000007,00000000), ref: 0047E7D9
lua_tolstring.LUA5.1(?,000000FE,00000000,?,?,?,?,00000000), ref: 0047E7EA
lua_tolstring.LUA5.1(?,000000FF,00000000,PUserName,00000000,?,?,?,?,?,?,?,00000000), ref: 0047E810
lua_tolstring.LUA5.1(?,000000FF,00000000,PPassword,PUserName,00000000,?,?,?,?,?,?,?,00000000), ref: 0047E82F
lua_tolstring.LUA5.1(?,000000FF,00000000,PServerAddress,PPassword,PUserName,00000000,?,?,?,?,?,?,?,00000000), ref: 0047E84E
lua_settop.LUA5.1(?,000000FE,PServerAddress,PPassword,PUserName,00000000,?,?,?,?,?,?,?,00000000), ref: 0047E862
lua_next.LUA5.1(?,00000007,?,000000FE,PServerAddress,PPassword,PUserName,00000000,?,?,?,?,?,?,?,00000000), ref: 0047E86A
lua_pushstring.LUA5.1(?,006985B8,?,?,00000000), ref: 0047E9CA

Strings

PServerAddress, xrefs: 0047E839
UserName, xrefs: 0047E71C
PPassword, xrefs: 0047E81A
Password, xrefs: 0047E73B
PUserName, xrefs: 0047E7FB
P, xrefs: 0047E665

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: lua_type.$lua_tolstring.$lua_next.$H_prolog3$_strlenlua_pushnil.lua_settop.$lua_pushstring.lua_remove.$lua_getfield.lua_gettable.lua_gettop.lua_pcall.
String ID: P$PPassword$PServerAddress$PUserName$Password$UserName
API String ID: 994422194-2805187325
Opcode ID: e2981575ad5b46be1dcf52c5ef4f05fd66f21ffeed17adaa05e1db2336345d6e
Instruction ID: 822a3404e9fabf112b3aecc9270ed235ea44920ac481a42295c77f6a576fccfb
Opcode Fuzzy Hash: e2981575ad5b46be1dcf52c5ef4f05fd66f21ffeed17adaa05e1db2336345d6e
Instruction Fuzzy Hash: 53E1E662804114A6EB14BB67CC02FEE76299F56328F20425FF529761D3EF3C6B05866E

Uniqueness

Uniqueness Score: -1.00%

Function 0047A125 Relevance: 54.3, APIs: 4, Strings: 27, Instructions: 86COMMON

Download Yara Rule

APIs

luaL_openlib.LUA5.1(0040CD00,System,?,00000000), ref: 0047A2EF
lua_pushstring.LUA5.1(0040CD00,UserSIDError,0040CD00,System,?,00000000), ref: 0047A2FA
lua_pushnumber.LUA5.1(0040CD00,?,?,00000000), ref: 0047A308
lua_settable.LUA5.1(0040CD00,000000FD,0040CD00,?,?,00000000), ref: 0047A310

Strings

GetUserInfo, xrefs: 0047A1CA
UnregisterFont, xrefs: 0047A263
GetDate, xrefs: 0047A166
GetDefaultLangID, xrefs: 0047A17A
RegisterFont, xrefs: 0047A239
GetDisplayInfo, xrefs: 0047A18E
EnumerateProcesses, xrefs: 0047A152
RegisterActiveX, xrefs: 0047A22B
GetTime, xrefs: 0047A206
UserSIDError, xrefs: 0047A2F4
GetOSName, xrefs: 0047A1DE
GetLANInfo, xrefs: 0047A1A2
GetUserSID, xrefs: 0047A2E1
Is64BitOS, xrefs: 0047A271
System, xrefs: 0047A14C
IsSystemRestoreAvailable, xrefs: 0047A27F
Reboot, xrefs: 0047A21A
Wow64DisableFsRedirection, xrefs: 0047A2B7
GetMemoryInfo, xrefs: 0047A1B6
GetOSProductInfo, xrefs: 0047A2D3
Wow64RevertFsRedirection, xrefs: 0047A2C5
SetRestorePoint, xrefs: 0047A28D
GetOSVersionInfo, xrefs: 0047A1F2
RegisterTypeLib, xrefs: 0047A247
UnregisterActiveX, xrefs: 0047A255
TerminateProcess, xrefs: 0047A2A9
RemoveRestorePoint, xrefs: 0047A29B

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: L_openlib.lua_pushnumber.lua_pushstring.lua_settable.
String ID: EnumerateProcesses$GetDate$GetDefaultLangID$GetDisplayInfo$GetLANInfo$GetMemoryInfo$GetOSName$GetOSProductInfo$GetOSVersionInfo$GetTime$GetUserInfo$GetUserSID$Is64BitOS$IsSystemRestoreAvailable$Reboot$RegisterActiveX$RegisterFont$RegisterTypeLib$RemoveRestorePoint$SetRestorePoint$System$TerminateProcess$UnregisterActiveX$UnregisterFont$UserSIDError$Wow64DisableFsRedirection$Wow64RevertFsRedirection
API String ID: 1781497972-4283409349
Opcode ID: dfb6fbc200d954e4a3843397f710722638d8f37f9a8418976efd825af63dcf7b
Instruction ID: 651693c304be1120127a05c33b110fa806bda5e9d532c24d104d0639e0970fca
Opcode Fuzzy Hash: dfb6fbc200d954e4a3843397f710722638d8f37f9a8418976efd825af63dcf7b
Instruction Fuzzy Hash: 4341B2B0D05268DADB20EF95C9496DDBFB6FF02318F54C58AE0597B201C7B80E498F59

Uniqueness

Uniqueness Score: -1.00%

Function 004604C7 Relevance: 52.7, APIs: 25, Strings: 5, Instructions: 173COMMON

Download Yara Rule

APIs

Part of subcall function 00459443: lua_getfield.LUA5.1(?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459455
Part of subcall function 00459443: lua_pushstring.LUA5.1(?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459460
Part of subcall function 00459443: lua_gettable.LUA5.1(?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459468
Part of subcall function 00459443: lua_remove.LUA5.1(?,000000FE,?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459470
Part of subcall function 00459443: lua_type.LUA5.1(?,000000FF,?,000000FE,?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459478
Part of subcall function 00459443: lua_pcall.LUA5.1(?,00000000,00000000,00000000), ref: 0045948B
Part of subcall function 00459443: lua_remove.LUA5.1(?,000000FF), ref: 0045949A

Part of subcall function 004597A0: __EH_prolog3.LIBCMT ref: 004597A7
Part of subcall function 004597A0: lua_gettop.LUA5.1(?,00000000,00000000,00000008,004076D1,?,00000002,?), ref: 004597D3

Part of subcall function 004599E0: __EH_prolog3.LIBCMT ref: 004599E7
Part of subcall function 004599E0: lua_type.LUA5.1(?,?,00000000,00000000,0000000C,004085AC,?,?,00000024), ref: 00459A16

lua_pushstring.LUA5.1(?,Text,?,?), ref: 00460546
lua_gettable.LUA5.1(?,000000FE,?,Text,?,?), ref: 0046054E
lua_isstring.LUA5.1(?,?,?,000000FE,?,Text,?,?), ref: 00460558
lua_tolstring.LUA5.1(?,?,00000000,?,?,?,?,?,?), ref: 00460568

Part of subcall function 004019B2: _strlen.LIBCMT ref: 004019C2

lua_settop.LUA5.1(?,000000FE,?,?,?,?,?,?), ref: 0046057C
lua_pushstring.LUA5.1(?,Description,?,000000FE,?,?,?,?,?,?), ref: 00460587
lua_gettable.LUA5.1(?,000000FE,?,Description,?,000000FE,?,?,?,?,?,?), ref: 0046058F
lua_isstring.LUA5.1(?,?,?,000000FE,?,Description,?,000000FE,?,?,?,?,?,?), ref: 00460596
lua_tolstring.LUA5.1(?,?,00000000), ref: 004605A6
lua_settop.LUA5.1(?,000000FE,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004605BA
lua_pushstring.LUA5.1(?,Enabled,?,000000FE), ref: 004605C5
lua_gettable.LUA5.1(?,000000FE,?,Enabled,?,000000FE), ref: 004605CD
lua_type.LUA5.1(?,?,?,000000FE,?,Enabled,?,000000FE), ref: 004605D4
lua_toboolean.LUA5.1(?), ref: 004605E3
lua_settop.LUA5.1(?,000000FE), ref: 004605F0
lua_pushstring.LUA5.1(?,State,?,000000FE), ref: 004605FB
lua_gettable.LUA5.1(?,000000FE,?,State,?,000000FE), ref: 00460603
lua_isnumber.LUA5.1(?,?,?,000000FE,?,State,?,000000FE), ref: 0046060A
lua_tonumber.LUA5.1(?), ref: 00460618
lua_settop.LUA5.1(?,000000FE), ref: 0046062A
lua_pushstring.LUA5.1(?,Expanded,?,000000FE), ref: 00460635
lua_gettable.LUA5.1(?,000000FE,?,Expanded,?,000000FE), ref: 0046063D
lua_type.LUA5.1(?,?,?,000000FE,?,Expanded,?,000000FE), ref: 00460644
lua_toboolean.LUA5.1(?), ref: 00460653
lua_settop.LUA5.1(?,000000FE), ref: 00460660

Strings

Enabled, xrefs: 004605BF
Text, xrefs: 00460540
State, xrefs: 004605F5
Expanded, xrefs: 0046062F
Description, xrefs: 00460581

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: lua_gettable.lua_pushstring.$lua_settop.$lua_type.$H_prolog3lua_isstring.lua_remove.lua_toboolean.lua_tolstring.$_strlenlua_getfield.lua_gettop.lua_isnumber.lua_pcall.lua_tonumber.
String ID: Description$Enabled$Expanded$State$Text
API String ID: 1046252865-1133598597
Opcode ID: 29ab189ab1762ab8768c420648508e1f9546d63b9e80b691d8aa5b9bf12c96f2
Instruction ID: f581e461dcf535aac6c1a7f2c1fa94f4646b3e93058bcbd366264eba877e7385
Opcode Fuzzy Hash: 29ab189ab1762ab8768c420648508e1f9546d63b9e80b691d8aa5b9bf12c96f2
Instruction Fuzzy Hash: 0941806190992579DA167B678D43EDF265D9F4232AF20021BF820741C7EF2CAF1245BE

Uniqueness

Uniqueness Score: -1.00%

Function 004600D6 Relevance: 49.2, APIs: 24, Strings: 4, Instructions: 178COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004600DD

Part of subcall function 00459443: lua_getfield.LUA5.1(?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459455
Part of subcall function 00459443: lua_pushstring.LUA5.1(?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459460
Part of subcall function 00459443: lua_gettable.LUA5.1(?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459468
Part of subcall function 00459443: lua_remove.LUA5.1(?,000000FE,?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459470
Part of subcall function 00459443: lua_type.LUA5.1(?,000000FF,?,000000FE,?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459478
Part of subcall function 00459443: lua_pcall.LUA5.1(?,00000000,00000000,00000000), ref: 0045948B
Part of subcall function 00459443: lua_remove.LUA5.1(?,000000FF), ref: 0045949A

Part of subcall function 004597A0: __EH_prolog3.LIBCMT ref: 004597A7
Part of subcall function 004597A0: lua_gettop.LUA5.1(?,00000000,00000000,00000008,004076D1,?,00000002,?), ref: 004597D3

Part of subcall function 004599E0: __EH_prolog3.LIBCMT ref: 004599E7
Part of subcall function 004599E0: lua_type.LUA5.1(?,?,00000000,00000000,0000000C,004085AC,?,?,00000024), ref: 00459A16

lua_pushstring.LUA5.1(?,Text), ref: 00460137
lua_gettable.LUA5.1(?,000000FE,?,Text), ref: 0046013F
lua_isstring.LUA5.1(?,00000000,?,000000FE,?,Text), ref: 00460149
lua_tolstring.LUA5.1(?,00000000,00000000), ref: 00460159

Part of subcall function 00401BAB: __EH_prolog3.LIBCMT ref: 00401BB2

Part of subcall function 004A8898: __EH_prolog3.LIBCMT ref: 004A889F
Part of subcall function 004A8898: IsWindow.USER32(?), ref: 004A88B8
Part of subcall function 004A8898: SendMessageA.USER32(?,000000F0,00000000,00000000), ref: 004A88D3

lua_settop.LUA5.1(?,000000FE), ref: 0046018A
lua_pushstring.LUA5.1(?,Visible,?,000000FE), ref: 00460195
lua_gettable.LUA5.1(?,000000FE,?,Visible,?,000000FE), ref: 0046019D
lua_type.LUA5.1(?,00000000,?,000000FE,?,Visible,?,000000FE), ref: 004601A4
lua_toboolean.LUA5.1(?,00000000), ref: 004601B3
lua_settop.LUA5.1(?,000000FE), ref: 004601C5
lua_pushstring.LUA5.1(?,Enabled,?,000000FE), ref: 004601D0
lua_gettable.LUA5.1(?,000000FE,?,Enabled,?,000000FE), ref: 004601D8
lua_type.LUA5.1(?,00000000,?,000000FE,?,Enabled,?,000000FE), ref: 004601DF
lua_toboolean.LUA5.1(?,00000000), ref: 004601EE
lua_settop.LUA5.1(?,000000FE), ref: 00460200
lua_pushstring.LUA5.1(?,Checked,?,000000FE), ref: 0046020B
lua_gettable.LUA5.1(?,000000FE,?,Checked,?,000000FE), ref: 00460213
lua_type.LUA5.1(?,00000000,?,000000FE,?,Checked,?,000000FE), ref: 0046021A
lua_toboolean.LUA5.1(?,00000000), ref: 00460229
IsWindow.USER32(?), ref: 00460258
lua_settop.LUA5.1(?,000000FE), ref: 0046026B
IsWindow.USER32(?), ref: 00460289
InvalidateRect.USER32(?,00000000,00000001), ref: 004602B6

Strings

Checked, xrefs: 00460205
Enabled, xrefs: 004601CA
Visible, xrefs: 0046018F
Text, xrefs: 00460131

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: H_prolog3lua_gettable.lua_pushstring.lua_type.$lua_settop.$Windowlua_toboolean.$lua_remove.$InvalidateMessageRectSendlua_getfield.lua_gettop.lua_isstring.lua_pcall.lua_tolstring.
String ID: Checked$Enabled$Text$Visible
API String ID: 1695491083-2599746497
Opcode ID: d03642a93b93ce82652bb7554319685a6f4e59417fd5bb6a041f63623a7ddd1e
Instruction ID: f284be31e51a2e89de2d2d3c9ec864c5cd381a8585c58060ac881f28b69987a7
Opcode Fuzzy Hash: d03642a93b93ce82652bb7554319685a6f4e59417fd5bb6a041f63623a7ddd1e
Instruction Fuzzy Hash: 1C51B5316096117BDB157F678C46FAF36699F4232AF10025EF410662D3EF6CAE0186AE

Uniqueness

Uniqueness Score: -1.00%

Function 0046037E Relevance: 38.6, APIs: 17, Strings: 5, Instructions: 120COMMON

Download Yara Rule

APIs

Part of subcall function 00459443: lua_getfield.LUA5.1(?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459455
Part of subcall function 00459443: lua_pushstring.LUA5.1(?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459460
Part of subcall function 00459443: lua_gettable.LUA5.1(?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459468
Part of subcall function 00459443: lua_remove.LUA5.1(?,000000FE,?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459470
Part of subcall function 00459443: lua_type.LUA5.1(?,000000FF,?,000000FE,?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459478
Part of subcall function 00459443: lua_pcall.LUA5.1(?,00000000,00000000,00000000), ref: 0045948B
Part of subcall function 00459443: lua_remove.LUA5.1(?,000000FF), ref: 0045949A

Part of subcall function 004597A0: __EH_prolog3.LIBCMT ref: 004597A7
Part of subcall function 004597A0: lua_gettop.LUA5.1(?,00000000,00000000,00000008,004076D1,?,00000002,?), ref: 004597D3

lua_createtable.LUA5.1(?,00000000,00000000,00000000), ref: 004603F6
lua_pushstring.LUA5.1(?,Text,?,00000000,00000000,00000000), ref: 00460401
lua_pushstring.LUA5.1(?,?,?,Text,?,00000000,00000000,00000000), ref: 0046040A
lua_settable.LUA5.1(?,000000FD,?,?,?,Text,?,00000000,00000000,00000000), ref: 00460412
lua_pushstring.LUA5.1(?,Description,?,000000FD,?,?,?,Text,?,00000000,00000000,00000000), ref: 0046041D
lua_pushstring.LUA5.1(?,?,?,Description,?,000000FD,?,?,?,Text,?,00000000,00000000,00000000), ref: 00460426
lua_settable.LUA5.1(?,000000FD,?,?,?,Description,?,000000FD,?,?,?,Text,?,00000000,00000000,00000000), ref: 0046042E
lua_pushstring.LUA5.1(?,Enabled,?,000000FD,?,?,?,Description,?,000000FD,?,?,?,Text,?,00000000), ref: 00460439
lua_pushboolean.LUA5.1(?,00000000), ref: 00460443
lua_settable.LUA5.1(?,000000FD,?,00000000), ref: 0046044B
lua_pushstring.LUA5.1(?,State,?,000000FD,?,00000000), ref: 00460456
lua_pushnumber.LUA5.1(?,?,000000FD,?,00000000), ref: 00460472
lua_settable.LUA5.1(?,000000FD,?,?,000000FD,?,00000000), ref: 0046047A
lua_pushstring.LUA5.1(?,Expanded,?,000000FD,?,?,000000FD,?,00000000), ref: 00460485
lua_pushboolean.LUA5.1(?,?,?,Expanded,?,000000FD,?,?,000000FD,?,00000000), ref: 0046048E
lua_settable.LUA5.1(?,000000FD,?,?,?,Expanded,?,000000FD,?,?,000000FD,?,00000000), ref: 00460496
lua_pushnil.LUA5.1(?), ref: 004604B9

Strings

Enabled, xrefs: 00460433
Text, xrefs: 004603FB
State, xrefs: 00460450
Expanded, xrefs: 0046047F
Description, xrefs: 00460417

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: lua_pushstring.$lua_settable.$lua_pushboolean.lua_remove.$H_prolog3lua_createtable.lua_getfield.lua_gettable.lua_gettop.lua_pcall.lua_pushnil.lua_pushnumber.lua_type.
String ID: Description$Enabled$Expanded$State$Text
API String ID: 1313748715-1133598597
Opcode ID: 6944d100bd6ebaa7cab3306f93a4be329ff3d9f1f5485da60846aeacc6eb75e1
Instruction ID: c93647555eefa6c71e5f01bfa4a0d76709558db8d1de06f9f3bec6df5f5e263e
Opcode Fuzzy Hash: 6944d100bd6ebaa7cab3306f93a4be329ff3d9f1f5485da60846aeacc6eb75e1
Instruction Fuzzy Hash: 54318221509A21BAE6127F678C07FDF3158AF4632AF10421AF510A50C7AF6DBB1246BE

Uniqueness

Uniqueness Score: -1.00%

Function 0045E554 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 191COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0045E55B

Part of subcall function 00459443: lua_getfield.LUA5.1(?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459455
Part of subcall function 00459443: lua_pushstring.LUA5.1(?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459460
Part of subcall function 00459443: lua_gettable.LUA5.1(?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459468
Part of subcall function 00459443: lua_remove.LUA5.1(?,000000FE,?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459470
Part of subcall function 00459443: lua_type.LUA5.1(?,000000FF,?,000000FE,?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459478
Part of subcall function 00459443: lua_pcall.LUA5.1(?,00000000,00000000,00000000), ref: 0045948B
Part of subcall function 00459443: lua_remove.LUA5.1(?,000000FF), ref: 0045949A

Part of subcall function 004597A0: __EH_prolog3.LIBCMT ref: 004597A7
Part of subcall function 004597A0: lua_gettop.LUA5.1(?,00000000,00000000,00000008,004076D1,?,00000002,?), ref: 004597D3

Part of subcall function 004599E0: __EH_prolog3.LIBCMT ref: 004599E7
Part of subcall function 004599E0: lua_type.LUA5.1(?,?,00000000,00000000,0000000C,004085AC,?,?,00000024), ref: 00459A16

lua_pushstring.LUA5.1(?,Text), ref: 0045E5B7
lua_gettable.LUA5.1(?,000000FE,?,Text), ref: 0045E5BF
lua_isstring.LUA5.1(?,?,?,000000FE,?,Text), ref: 0045E5C9
lua_tolstring.LUA5.1(?,?,00000000), ref: 0045E5D9

Part of subcall function 00401BAB: __EH_prolog3.LIBCMT ref: 00401BB2

lua_settop.LUA5.1(?,000000FE), ref: 0045E60A
lua_pushstring.LUA5.1(?,Visible,?,000000FE), ref: 0045E615
lua_gettable.LUA5.1(?,000000FE,?,Visible,?,000000FE), ref: 0045E61D
lua_type.LUA5.1(?,?,?,000000FE,?,Visible,?,000000FE), ref: 0045E624
lua_toboolean.LUA5.1(?), ref: 0045E638
lua_settop.LUA5.1(?,000000FE), ref: 0045E64B
lua_pushstring.LUA5.1(?,Enabled,?,000000FE), ref: 0045E656
lua_gettable.LUA5.1(?,000000FE,?,Enabled,?,000000FE), ref: 0045E65E
lua_type.LUA5.1(?,?,?,000000FE,?,Enabled,?,000000FE), ref: 0045E665
lua_toboolean.LUA5.1(?), ref: 0045E679
lua_settop.LUA5.1(?,000000FE), ref: 0045E68C
IsWindow.USER32(?), ref: 0045E74E
InvalidateRect.USER32(?,-00000018,00000001), ref: 0045E76C

Strings

Enabled, xrefs: 0045E650
Visible, xrefs: 0045E60F
Text, xrefs: 0045E5AE

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: H_prolog3lua_gettable.lua_pushstring.lua_type.$lua_settop.$lua_remove.lua_toboolean.$InvalidateRectWindowlua_getfield.lua_gettop.lua_isstring.lua_pcall.lua_tolstring.
String ID: Enabled$Text$Visible
API String ID: 2468856768-1258828939
Opcode ID: dcbd6a7b5041cc1e82de44cc7e3ebfa37e03bf53a1fbb3d02b762165ecedc583
Instruction ID: 2a7065115142950cc221c4680cad670c768e77f056a6e18e5564fd83030f3d81
Opcode Fuzzy Hash: dcbd6a7b5041cc1e82de44cc7e3ebfa37e03bf53a1fbb3d02b762165ecedc583
Instruction Fuzzy Hash: 3A61F471904100AFCB14EF6ACC85EBF77B9AF45325F10416EF414AB293DB38AE058B69

Uniqueness

Uniqueness Score: -1.00%

Function 00476309 Relevance: 36.9, APIs: 19, Strings: 2, Instructions: 162COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00476310

Part of subcall function 00459443: lua_getfield.LUA5.1(?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459455
Part of subcall function 00459443: lua_pushstring.LUA5.1(?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459460
Part of subcall function 00459443: lua_gettable.LUA5.1(?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459468
Part of subcall function 00459443: lua_remove.LUA5.1(?,000000FE,?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459470
Part of subcall function 00459443: lua_type.LUA5.1(?,000000FF,?,000000FE,?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459478
Part of subcall function 00459443: lua_pcall.LUA5.1(?,00000000,00000000,00000000), ref: 0045948B
Part of subcall function 00459443: lua_remove.LUA5.1(?,000000FF), ref: 0045949A

Part of subcall function 004597A0: __EH_prolog3.LIBCMT ref: 004597A7
Part of subcall function 004597A0: lua_gettop.LUA5.1(?,00000000,00000000,00000008,004076D1,?,00000002,?), ref: 004597D3

Part of subcall function 00459852: __EH_prolog3.LIBCMT ref: 00459859
Part of subcall function 00459852: lua_tolstring.LUA5.1(?,?,00000000,00000000,00000000,0000000C,004082AF,?,00000002,?,00000001,?,00000002), ref: 0045988A

Part of subcall function 00401BAB: __EH_prolog3.LIBCMT ref: 00401BB2

lua_type.LUA5.1(?,00000003), ref: 0047635D
lua_type.LUA5.1(?,00000004), ref: 0047637E
lua_getfield.LUA5.1(?,FFFFD8EE,string), ref: 004763B7
lua_pushstring.LUA5.1(?,find,?,FFFFD8EE,string), ref: 004763C2
lua_gettable.LUA5.1(?,000000FE,?,find,?,FFFFD8EE,string), ref: 004763CA
lua_remove.LUA5.1(?,000000FE,?,000000FE,?,find,?,FFFFD8EE,string), ref: 004763D2
lua_type.LUA5.1(?,000000FF,?,000000FE,?,000000FE,?,find,?,FFFFD8EE,string), ref: 004763DA
lua_pushstring.LUA5.1(?,?), ref: 004763EF
lua_pushstring.LUA5.1(?,?,?,?), ref: 004763F8
lua_pushnumber.LUA5.1(?,?,?), ref: 00476407
lua_pushboolean.LUA5.1(?,00000001,?,?,?), ref: 0047640E
lua_pcall.LUA5.1(?,00000004,00000002,00000000,?,00000001,?,?,?), ref: 0047641A
lua_pushnumber.LUA5.1(?,?,00000B54), ref: 00476497

Strings

string, xrefs: 004763AC
find, xrefs: 004763BC

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: H_prolog3lua_pushstring.lua_type.$lua_remove.$lua_getfield.lua_gettable.lua_pcall.lua_pushnumber.$lua_gettop.lua_pushboolean.lua_tolstring.
String ID: find$string
API String ID: 1562589319-714750175
Opcode ID: 27a139f434685931d386e87cf4d2f280be8d3f85a09b071000b6106c2035d280
Instruction ID: c7b549c2b511f1680fc9e8ff777c6d7aa84b2b7013c0c8b28b4d1b96d469939c
Opcode Fuzzy Hash: 27a139f434685931d386e87cf4d2f280be8d3f85a09b071000b6106c2035d280
Instruction Fuzzy Hash: 35418F21809926B5DA157A6A8C03EEF36259F5233AF60471FF025751D7EF2C6B0241AE

Uniqueness

Uniqueness Score: -1.00%

Function 0046C57D Relevance: 33.4, APIs: 16, Strings: 3, Instructions: 186libraryloaderCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0046C584

Part of subcall function 00459443: lua_getfield.LUA5.1(?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459455
Part of subcall function 00459443: lua_pushstring.LUA5.1(?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459460
Part of subcall function 00459443: lua_gettable.LUA5.1(?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459468
Part of subcall function 00459443: lua_remove.LUA5.1(?,000000FE,?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459470
Part of subcall function 00459443: lua_type.LUA5.1(?,000000FF,?,000000FE,?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459478
Part of subcall function 00459443: lua_pcall.LUA5.1(?,00000000,00000000,00000000), ref: 0045948B
Part of subcall function 00459443: lua_remove.LUA5.1(?,000000FF), ref: 0045949A

Part of subcall function 004597A0: __EH_prolog3.LIBCMT ref: 004597A7
Part of subcall function 004597A0: lua_gettop.LUA5.1(?,00000000,00000000,00000008,004076D1,?,00000002,?), ref: 004597D3

Part of subcall function 00459852: __EH_prolog3.LIBCMT ref: 00459859
Part of subcall function 00459852: lua_tolstring.LUA5.1(?,?,00000000,00000000,00000000,0000000C,004082AF,?,00000002,?,00000001,?,00000002), ref: 0045988A

Part of subcall function 00401BAB: __EH_prolog3.LIBCMT ref: 00401BB2

GetProcAddress.KERNEL32(00000000,MsiEnumPatchesA), ref: 0046C5CC

Part of subcall function 00405435: _strnlen.LIBCMT ref: 0040544E

_malloc.LIBCMT ref: 0046C661

Part of subcall function 005B4B83: __FF_MSGBANNER.LIBCMT ref: 005B4B9C
Part of subcall function 005B4B83: __NMSG_WRITE.LIBCMT ref: 005B4BA3
Part of subcall function 005B4B83: RtlAllocateHeap.NTDLL(00000000,00000001,00000001), ref: 005B4BC8

_memset.LIBCMT ref: 0046C676

Part of subcall function 004019B2: _strlen.LIBCMT ref: 004019C2

_free.LIBCMT ref: 0046C6A4

Part of subcall function 005B4C17: RtlFreeHeap.NTDLL(00000000,00000000,?,005C092F,00000000,?,005C4E2D,?,00000001,?,?,005C4363,00000018,00738D88,0000000C,005C43F3), ref: 005B4C2D
Part of subcall function 005B4C17: GetLastError.KERNEL32(00000000,?,005C092F,00000000,?,005C4E2D,?,00000001,?,?,005C4363,00000018,00738D88,0000000C,005C43F3,?), ref: 005B4C3F

lua_createtable.LUA5.1(?,00000000,00000000,000000FF), ref: 0046C6BA
lua_pushnumber.LUA5.1(?,?,?,000000FF), ref: 0046C6DC
lua_createtable.LUA5.1(?,00000000,00000000,?,?,?,000000FF), ref: 0046C6E4
lua_pushstring.LUA5.1(?,PatchCode,?,00000000,00000000,?,?,?,000000FF), ref: 0046C6EF
lua_pushstring.LUA5.1(?,?,?,PatchCode,?,00000000,00000000,?,?,?,000000FF), ref: 0046C6F8
lua_settable.LUA5.1(?,000000FD,?,?,?,PatchCode,?,00000000,00000000,?,?,?,000000FF), ref: 0046C700
lua_pushstring.LUA5.1(?,TransformList,?,000000FD,?,?,?,PatchCode,?,00000000,00000000,?,?,?,000000FF), ref: 0046C70B
lua_pushstring.LUA5.1(?,00000000,?,TransformList,?,000000FD,?,?,?,PatchCode,?,00000000,00000000,?), ref: 0046C714
lua_settable.LUA5.1(?,000000FD), ref: 0046C71F
lua_settable.LUA5.1(?,000000FD,?,000000FD), ref: 0046C727
lua_pushnil.LUA5.1(?,?,?,?,?,?,?,?,?,?,0000002C), ref: 0046C79D

Strings

TransformList, xrefs: 0046C705
MsiEnumPatchesA, xrefs: 0046C5C6
PatchCode, xrefs: 0046C6E9

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: lua_pushstring.$H_prolog3$lua_settable.$Heaplua_createtable.lua_remove.$AddressAllocateErrorFreeLastProc_free_malloc_memset_strlen_strnlenlua_getfield.lua_gettable.lua_gettop.lua_pcall.lua_pushnil.lua_pushnumber.lua_tolstring.lua_type.
String ID: MsiEnumPatchesA$PatchCode$TransformList
API String ID: 2133518626-2687235862
Opcode ID: b2eeebed8aa83fca936270feecf5cec8eb67b7bfd5ebdc36faa9c6ac4d0b0b43
Instruction ID: c973a458384c421d543e03cd1ac9cc13fede592807036721cc0db5903f5fc963
Opcode Fuzzy Hash: b2eeebed8aa83fca936270feecf5cec8eb67b7bfd5ebdc36faa9c6ac4d0b0b43
Instruction Fuzzy Hash: 6C518C71C04109AEDF00EFA5CC929FEBA78AF15319F20412EF511721D2EB7C6A459B6A

Uniqueness

Uniqueness Score: -1.00%

Function 0046C1D0 Relevance: 33.4, APIs: 16, Strings: 3, Instructions: 172libraryloaderCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0046C1D7

Part of subcall function 00459443: lua_getfield.LUA5.1(?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459455
Part of subcall function 00459443: lua_pushstring.LUA5.1(?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459460
Part of subcall function 00459443: lua_gettable.LUA5.1(?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459468
Part of subcall function 00459443: lua_remove.LUA5.1(?,000000FE,?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459470
Part of subcall function 00459443: lua_type.LUA5.1(?,000000FF,?,000000FE,?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459478
Part of subcall function 00459443: lua_pcall.LUA5.1(?,00000000,00000000,00000000), ref: 0045948B
Part of subcall function 00459443: lua_remove.LUA5.1(?,000000FF), ref: 0045949A

Part of subcall function 004597A0: __EH_prolog3.LIBCMT ref: 004597A7
Part of subcall function 004597A0: lua_gettop.LUA5.1(?,00000000,00000000,00000008,004076D1,?,00000002,?), ref: 004597D3

Part of subcall function 00459852: __EH_prolog3.LIBCMT ref: 00459859
Part of subcall function 00459852: lua_tolstring.LUA5.1(?,?,00000000,00000000,00000000,0000000C,004082AF,?,00000002,?,00000001,?,00000002), ref: 0045988A

Part of subcall function 00401BAB: __EH_prolog3.LIBCMT ref: 00401BB2

GetProcAddress.KERNEL32(00000000,MsiGetFeatureInfoA), ref: 0046C250
_malloc.LIBCMT ref: 0046C2AF
_malloc.LIBCMT ref: 0046C2B9
_memset.LIBCMT ref: 0046C2D0
_memset.LIBCMT ref: 0046C2DC
_free.LIBCMT ref: 0046C312
_free.LIBCMT ref: 0046C320
lua_createtable.LUA5.1(?,00000000,00000000), ref: 0046C329
lua_pushstring.LUA5.1(?,Title,?,00000000,00000000), ref: 0046C334
lua_pushstring.LUA5.1(?,00000000,?,Title,?,00000000,00000000), ref: 0046C33D
lua_settable.LUA5.1(?,000000FD,?,00000000,?,Title,?,00000000,00000000), ref: 0046C345
lua_pushstring.LUA5.1(?,Description,?,000000FD,?,00000000,?,Title,?,00000000,00000000), ref: 0046C350
lua_pushstring.LUA5.1(?,00000000,?,Description,?,000000FD,?,00000000,?,Title,?,00000000,00000000), ref: 0046C359
lua_settable.LUA5.1(?,000000FD,?,00000000,?,Description,?,000000FD,?,00000000,?,Title,?,00000000,00000000), ref: 0046C361
lua_pushnil.LUA5.1(?), ref: 0046C3A6

Strings

Title, xrefs: 0046C32E
Description, xrefs: 0046C34A
MsiGetFeatureInfoA, xrefs: 0046C24A

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: lua_pushstring.$H_prolog3$_free_malloc_memsetlua_remove.lua_settable.$AddressProclua_createtable.lua_getfield.lua_gettable.lua_gettop.lua_pcall.lua_pushnil.lua_tolstring.lua_type.
String ID: Description$MsiGetFeatureInfoA$Title
API String ID: 3318367934-1217384030
Opcode ID: 78f17d0a94f44d829a41ca590364ad89a468b8e82280692d9bf4cf9728bf5080
Instruction ID: 332201f746e81777cc85c237a02401d42fb5d16d94876f0d4af26ef22ab59397
Opcode Fuzzy Hash: 78f17d0a94f44d829a41ca590364ad89a468b8e82280692d9bf4cf9728bf5080
Instruction Fuzzy Hash: 46518D71C00209AACF11BBF5DC86DFEBB79AF45314F20461AF911B2293EA395A41CB65

Uniqueness

Uniqueness Score: -1.00%

Function 0047A457 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 156COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0047A45E

Part of subcall function 00459443: lua_getfield.LUA5.1(?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459455
Part of subcall function 00459443: lua_pushstring.LUA5.1(?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459460
Part of subcall function 00459443: lua_gettable.LUA5.1(?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459468
Part of subcall function 00459443: lua_remove.LUA5.1(?,000000FE,?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459470
Part of subcall function 00459443: lua_type.LUA5.1(?,000000FF,?,000000FE,?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459478
Part of subcall function 00459443: lua_pcall.LUA5.1(?,00000000,00000000,00000000), ref: 0045948B
Part of subcall function 00459443: lua_remove.LUA5.1(?,000000FF), ref: 0045949A

Part of subcall function 004597A0: __EH_prolog3.LIBCMT ref: 004597A7
Part of subcall function 004597A0: lua_gettop.LUA5.1(?,00000000,00000000,00000008,004076D1,?,00000002,?), ref: 004597D3

Part of subcall function 004599E0: __EH_prolog3.LIBCMT ref: 004599E7
Part of subcall function 004599E0: lua_type.LUA5.1(?,?,00000000,00000000,0000000C,004085AC,?,?,00000024), ref: 00459A16

Part of subcall function 00459852: __EH_prolog3.LIBCMT ref: 00459859
Part of subcall function 00459852: lua_tolstring.LUA5.1(?,?,00000000,00000000,00000000,0000000C,004082AF,?,00000002,?,00000001,?,00000002), ref: 0045988A

Part of subcall function 00401BAB: __EH_prolog3.LIBCMT ref: 00401BB2

lua_type.LUA5.1(?,00000003), ref: 0047A49C
lua_type.LUA5.1(?,00000004), ref: 0047A4C2
lua_getfield.LUA5.1(?,FFFFD8EE,table,?,?,?,?,?,?,?,?,00000018), ref: 0047A514
lua_pushstring.LUA5.1(?,concat,?,FFFFD8EE,table,?,?,?,?,?,?,?,?,00000018), ref: 0047A51F
lua_gettable.LUA5.1(?,000000FE,?,concat,?,FFFFD8EE,table,?,?,?,?,?,?,?,?,00000018), ref: 0047A527
lua_remove.LUA5.1(?,000000FE,?,000000FE,?,concat,?,FFFFD8EE,table), ref: 0047A52F
lua_type.LUA5.1(?,?,?,000000FE,?,000000FE,?,concat,?,FFFFD8EE,table), ref: 0047A536
lua_pushvalue.LUA5.1(?,00000001), ref: 0047A549
lua_pushstring.LUA5.1(?,?,?,00000001), ref: 0047A552
lua_pushnumber.LUA5.1(?,?,00000001), ref: 0047A561
lua_pushnumber.LUA5.1(?), ref: 0047A578
lua_pcall.LUA5.1(?,00000004,00000001,00000000), ref: 0047A587
lua_pushstring.LUA5.1(?,?,?,00000B54), ref: 0047A5E5

Strings

concat, xrefs: 0047A519
table, xrefs: 0047A509

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: H_prolog3lua_type.$lua_pushstring.$lua_remove.$lua_getfield.lua_gettable.lua_pcall.lua_pushnumber.$lua_gettop.lua_pushvalue.lua_tolstring.
String ID: concat$table
API String ID: 2763045376-3852859565
Opcode ID: f334c298e4b8d4a2b813a0121e1f02ea525bcf25178cbf61419aefbc7405e901
Instruction ID: 729378e8562547643f47e3168c5e5db5af8a3d494ff60f24c949d963e8eba723
Opcode Fuzzy Hash: f334c298e4b8d4a2b813a0121e1f02ea525bcf25178cbf61419aefbc7405e901
Instruction Fuzzy Hash: AC41D521804915B6DB117B668C43FEF3628AF5232AF20421FF110751C7EF7D6B1586AE

Uniqueness

Uniqueness Score: -1.00%

Function 004A02D8 Relevance: 33.3, APIs: 22, Instructions: 315COMMON

Download Yara Rule

APIs

GetTextExtentPoint32A.GDI32(8BBF5050,0069A5D0,00000001,?), ref: 004A0351
GetTextExtentPoint32A.GDI32(8BBF5050,006AA73C,00000001,?), ref: 004A036C
GetTextExtentPoint32A.GDI32(8BBF5050,006AA73C,00000001,?), ref: 004A038A
GetTextExtentPoint32A.GDI32(8BBF5050,006AA738,00000001,?), ref: 004A039F
GetTextExtentPoint32A.GDI32(8BBF5050,006AA734,00000001,?), ref: 004A03BA
GetTextExtentPoint32A.GDI32(8BBF5050,006AA734,00000001,?), ref: 004A03D8
GetTextExtentPoint32A.GDI32(8BBF5050,0069A5D0,00000001,?), ref: 004A03EF
GetTextExtentPoint32A.GDI32(8BBF5050,006AA73C,00000001,?), ref: 004A040A

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: ExtentPoint32Text
String ID:
API String ID: 223599850-0
Opcode ID: 2b15d5efccecaab91ab110344de1f98632080ca6b4bfb4185b45a256f479e95f
Instruction ID: c7b0f8824267e47ffa9be9d6f7f49696779b508a72a934f96a39fd8dd8f7d195
Opcode Fuzzy Hash: 2b15d5efccecaab91ab110344de1f98632080ca6b4bfb4185b45a256f479e95f
Instruction Fuzzy Hash: DDC1C1B5E0021EAFCB01DF98C9818EEBBFABB19300B118117E915F2250D775AE55DFA1

Uniqueness

Uniqueness Score: -1.00%

Function 004163DE Relevance: 31.8, APIs: 13, Strings: 5, Instructions: 266COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 004163E8
_fseek.LIBCMT ref: 00416488
_fseek.LIBCMT ref: 004164A2
__fread_nolock.LIBCMT ref: 004164E8
_fseek.LIBCMT ref: 0041653C
__fread_nolock.LIBCMT ref: 00416580
__fassign.LIBCMT ref: 0041658E

Part of subcall function 00413663: __EH_prolog3.LIBCMT ref: 0041366A

__fassign.LIBCMT ref: 004165AC

Part of subcall function 005B7CE6: __wcstombs_l_helper.LIBCMT ref: 005B7CF6

Part of subcall function 00405435: _strnlen.LIBCMT ref: 0040544E

_fseek.LIBCMT ref: 0041665A
__fread_nolock.LIBCMT ref: 0041667C
__fassign.LIBCMT ref: 004166C1
_sprintf.LIBCMT ref: 00416727
_sprintf.LIBCMT ref: 004165DE

Part of subcall function 004019B2: _strlen.LIBCMT ref: 004019C2

Strings

%s%d wide chars to %d bytes, xrefs: 004165D8
UTF-8 BOM + , xrefs: 00416639
%s%d bytes, xrefs: 00416721
UTF-16LE BOM + , xrefs: 00416514
UTF-8, xrefs: 004166BB

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: _fseek$__fassign__fread_nolock$_sprintf$H_prolog3H_prolog3___wcstombs_l_helper_strlen_strnlen
String ID: %s%d bytes$%s%d wide chars to %d bytes$UTF-16LE BOM + $UTF-8$UTF-8 BOM +
API String ID: 3796706425-57846469
Opcode ID: 45885c1336fc052a10f8630d6336c53a0d7d78b4887261a67af970b60002fade
Instruction ID: 88dbf6717b2063eba7f152900f0f85e004359ee4b10710b10789509c591bcce3
Opcode Fuzzy Hash: 45885c1336fc052a10f8630d6336c53a0d7d78b4887261a67af970b60002fade
Instruction Fuzzy Hash: 9791A171E00218AEDF249B74CC46FEEBBB9AF45314F0041DAF50DB2292DA359E848F65

Uniqueness

Uniqueness Score: -1.00%

Function 0048A08A Relevance: 30.2, APIs: 1, Strings: 16, Instructions: 426COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0048A091

Strings

TBTXTY, xrefs: 0048A315
CstClrs, xrefs: 0048A12E
FTSEP, xrefs: 0048A2AF
TBTXTX, xrefs: 0048A2E2
Fonts, xrefs: 0048A3FA
ScreenW, xrefs: 0048A348
ScreenH, xrefs: 0048A37B
BDIMG, xrefs: 0048A216
HDSEP, xrefs: 0048A27C
StyleData, xrefs: 0048A0B9, 0048A0FE
FontData, xrefs: 0048A41C, 0048A43E, 0048A460, 0048A485, 0048A4AA
BDFILL, xrefs: 0048A249
CstFnts, xrefs: 0048A3AE
SBIMG, xrefs: 0048A1E3
TBIMG, xrefs: 0048A1B0
CAOff, xrefs: 0048A4EA

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: H_prolog3
String ID: BDFILL$BDIMG$CAOff$CstClrs$CstFnts$FTSEP$FontData$Fonts$HDSEP$SBIMG$ScreenH$ScreenW$StyleData$TBIMG$TBTXTX$TBTXTY
API String ID: 431132790-1466213234
Opcode ID: a9887410c176001072c0b38770bf919faa8f6480463712542dfc3399cc363307
Instruction ID: b24a68273a000412876dc90f14d1328d2e240432259003874619c87eb7d62898
Opcode Fuzzy Hash: a9887410c176001072c0b38770bf919faa8f6480463712542dfc3399cc363307
Instruction Fuzzy Hash: EBF1D570500248EFC704EF69C891AEEBBF4BF15308F14856FF45997291DB78AA44CB95

Uniqueness

Uniqueness Score: -1.00%

Function 0046C038 Relevance: 29.9, APIs: 13, Strings: 4, Instructions: 133libraryloaderCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0046C03F

Part of subcall function 00459443: lua_getfield.LUA5.1(?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459455
Part of subcall function 00459443: lua_pushstring.LUA5.1(?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459460
Part of subcall function 00459443: lua_gettable.LUA5.1(?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459468
Part of subcall function 00459443: lua_remove.LUA5.1(?,000000FE,?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459470
Part of subcall function 00459443: lua_type.LUA5.1(?,000000FF,?,000000FE,?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459478
Part of subcall function 00459443: lua_pcall.LUA5.1(?,00000000,00000000,00000000), ref: 0045948B
Part of subcall function 00459443: lua_remove.LUA5.1(?,000000FF), ref: 0045949A

Part of subcall function 004597A0: __EH_prolog3.LIBCMT ref: 004597A7
Part of subcall function 004597A0: lua_gettop.LUA5.1(?,00000000,00000000,00000008,004076D1,?,00000002,?), ref: 004597D3

Part of subcall function 00459852: __EH_prolog3.LIBCMT ref: 00459859
Part of subcall function 00459852: lua_tolstring.LUA5.1(?,?,00000000,00000000,00000000,0000000C,004082AF,?,00000002,?,00000001,?,00000002), ref: 0045988A

Part of subcall function 00401BAB: __EH_prolog3.LIBCMT ref: 00401BB2

GetProcAddress.KERNEL32(00000000,MsiGetShortcutTargetA), ref: 0046C080

Part of subcall function 00405435: _strnlen.LIBCMT ref: 0040544E

lua_createtable.LUA5.1(?,00000000,00000000,000000FF,000000FF,000000FF), ref: 0046C116
lua_pushstring.LUA5.1(?,ProductCode,?,00000000,00000000,000000FF,000000FF,000000FF), ref: 0046C121
lua_pushstring.LUA5.1(?,000000FF,?,ProductCode,?,00000000,00000000,000000FF,000000FF,000000FF), ref: 0046C12A
lua_settable.LUA5.1(?,000000FD,?,000000FF,?,ProductCode,?,00000000,00000000,000000FF,000000FF,000000FF), ref: 0046C132
lua_pushstring.LUA5.1(?,FeatureId,?,000000FD,?,000000FF,?,ProductCode,?,00000000,00000000,000000FF,000000FF,000000FF), ref: 0046C13D
lua_pushstring.LUA5.1(?,?,?,FeatureId,?,000000FD,?,000000FF,?,ProductCode,?,00000000,00000000,000000FF,000000FF,000000FF), ref: 0046C146
lua_settable.LUA5.1(?,000000FD,?,?,?,FeatureId,?,000000FD,?,000000FF,?,ProductCode,?,00000000,00000000,000000FF), ref: 0046C14E
lua_pushstring.LUA5.1(?,ComponentCode,?,000000FD,?,?,?,FeatureId,?,000000FD,?,000000FF,?,ProductCode,?,00000000), ref: 0046C159
lua_pushstring.LUA5.1(?,?), ref: 0046C165
lua_settable.LUA5.1(?,000000FD,?,?), ref: 0046C16D
lua_pushnil.LUA5.1(?), ref: 0046C1B6

Strings

ComponentCode, xrefs: 0046C153
ProductCode, xrefs: 0046C11B
FeatureId, xrefs: 0046C137
MsiGetShortcutTargetA, xrefs: 0046C07A

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: lua_pushstring.$H_prolog3$lua_settable.$lua_remove.$AddressProc_strnlenlua_createtable.lua_getfield.lua_gettable.lua_gettop.lua_pcall.lua_pushnil.lua_tolstring.lua_type.
String ID: ComponentCode$FeatureId$MsiGetShortcutTargetA$ProductCode
API String ID: 654485782-3671626826
Opcode ID: 08a6e8885ec5c1f1cb12d683aef864db011b737212b0346eec4d3d908810f9e8
Instruction ID: a7f2cd46e842152db73f185060fea67f7e885aa9e7e59e1fb710ed679d5408cf
Opcode Fuzzy Hash: 08a6e8885ec5c1f1cb12d683aef864db011b737212b0346eec4d3d908810f9e8
Instruction Fuzzy Hash: 99418031804615AADB01BBA6CC96EFF76349F52729F50022EF421762D3EE3C5A01967A

Uniqueness

Uniqueness Score: -1.00%

Function 0047A60B Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 125COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0047A612

Part of subcall function 00459443: lua_getfield.LUA5.1(?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459455
Part of subcall function 00459443: lua_pushstring.LUA5.1(?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459460
Part of subcall function 00459443: lua_gettable.LUA5.1(?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459468
Part of subcall function 00459443: lua_remove.LUA5.1(?,000000FE,?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459470
Part of subcall function 00459443: lua_type.LUA5.1(?,000000FF,?,000000FE,?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459478
Part of subcall function 00459443: lua_pcall.LUA5.1(?,00000000,00000000,00000000), ref: 0045948B
Part of subcall function 00459443: lua_remove.LUA5.1(?,000000FF), ref: 0045949A

Part of subcall function 004597A0: __EH_prolog3.LIBCMT ref: 004597A7
Part of subcall function 004597A0: lua_gettop.LUA5.1(?,00000000,00000000,00000008,004076D1,?,00000002,?), ref: 004597D3

Part of subcall function 004599E0: __EH_prolog3.LIBCMT ref: 004599E7
Part of subcall function 004599E0: lua_type.LUA5.1(?,?,00000000,00000000,0000000C,004085AC,?,?,00000024), ref: 00459A16

lua_type.LUA5.1(?,00000002,?,00000001,?,00000001,?,?,?,?,?,0000000C), ref: 0047A63C
lua_type.LUA5.1(?,00000002), ref: 0047A64C
lua_type.LUA5.1(?,00000002), ref: 0047A65A
lua_getfield.LUA5.1(?,FFFFD8EE,table), ref: 0047A685
lua_pushstring.LUA5.1(?,sort,?,FFFFD8EE,table), ref: 0047A690
lua_gettable.LUA5.1(?,000000FE,?,sort,?,FFFFD8EE,table), ref: 0047A698
lua_remove.LUA5.1(?,000000FE,?,000000FE,?,sort,?,FFFFD8EE,table), ref: 0047A6A0
lua_type.LUA5.1(?,000000FF,?,000000FE,?,000000FE,?,sort,?,FFFFD8EE,table), ref: 0047A6A8
lua_pushvalue.LUA5.1(?,00000001), ref: 0047A6B7
lua_pushvalue.LUA5.1(?,00000002), ref: 0047A6C9
lua_pcall.LUA5.1(?,00000001,00000000,00000000), ref: 0047A6D6
lua_type.LUA5.1(?,00000002), ref: 0047A6FE
lua_type.LUA5.1(?,00000002), ref: 0047A70D
lua_remove.LUA5.1(?,000000FF), ref: 0047A723

Strings

table, xrefs: 0047A67A
sort, xrefs: 0047A68A

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: lua_type.$lua_remove.$H_prolog3$lua_getfield.lua_gettable.lua_pcall.lua_pushstring.lua_pushvalue.$lua_gettop.
String ID: sort$table
API String ID: 3434745935-659178806
Opcode ID: f55190642582b034b9f691aec5fbf36227eedc32975e74e9a7802254d07cbe1f
Instruction ID: a079384774385243334ef706f7c4630cb4ff085ccddf974d8c4a86bfc47fe3f8
Opcode Fuzzy Hash: f55190642582b034b9f691aec5fbf36227eedc32975e74e9a7802254d07cbe1f
Instruction Fuzzy Hash: 3031D22160D61539EA28366A5C47FEF12288F5237EF64820FF424A51C3EE6C7F5240BE

Uniqueness

Uniqueness Score: -1.00%

Function 0045E145 Relevance: 28.2, APIs: 15, Strings: 1, Instructions: 238COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0045E14F

Part of subcall function 00459443: lua_getfield.LUA5.1(?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459455
Part of subcall function 00459443: lua_pushstring.LUA5.1(?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459460
Part of subcall function 00459443: lua_gettable.LUA5.1(?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459468
Part of subcall function 00459443: lua_remove.LUA5.1(?,000000FE,?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459470
Part of subcall function 00459443: lua_type.LUA5.1(?,000000FF,?,000000FE,?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459478
Part of subcall function 00459443: lua_pcall.LUA5.1(?,00000000,00000000,00000000), ref: 0045948B
Part of subcall function 00459443: lua_remove.LUA5.1(?,000000FF), ref: 0045949A

lua_pushnil.LUA5.1(?,?,00000A8F,00000260), ref: 0045E178
lua_pushnil.LUA5.1(?,?,00000003,0000000A), ref: 0045E1D4
lua_next.LUA5.1(?,00000003,?,?,00000003,0000000A), ref: 0045E1DC
lua_type.LUA5.1(?,00000005,?,?,?,00000000,?,?,?,?,?,?,?,0000000A), ref: 0045E22F
lua_type.LUA5.1(?,00000005,?,?,?,00000000,?,?,?,?,?,?,?,0000000A), ref: 0045E23E
lua_type.LUA5.1(?,00000006,?,?,?,00000000,?,?,?,?,?,?,?,0000000A), ref: 0045E25C
lua_type.LUA5.1(?,00000006,?,?,?,00000000,?,?,?,?,?,?,?,0000000A), ref: 0045E26B
lua_type.LUA5.1(?,00000007,?,?,?,00000000,?,?,?,?,?,?,?,0000000A), ref: 0045E289
lua_type.LUA5.1(?,00000007,?,?,?,00000000,?,?,?,?,?,?,?,0000000A), ref: 0045E298

Part of subcall function 004593D3: lua_getfield.LUA5.1(?,FFFFD8EE,Application,?,?,00407717,?,00000000), ref: 004593E5
Part of subcall function 004593D3: lua_pushstring.LUA5.1(?,SetLastError,?,FFFFD8EE,Application,?,?,00407717,?,00000000), ref: 004593F0
Part of subcall function 004593D3: lua_gettable.LUA5.1(?,000000FE,?,SetLastError,?,FFFFD8EE,Application,?,?,00407717,?,00000000), ref: 004593F8
Part of subcall function 004593D3: lua_remove.LUA5.1(?,000000FE,?,000000FE,?,SetLastError,?,FFFFD8EE,Application,?,?,00407717,?,00000000), ref: 00459400
Part of subcall function 004593D3: lua_type.LUA5.1(?,000000FF,?,000000FE,?,000000FE,?,SetLastError,?,FFFFD8EE,Application,?,?,00407717,?,00000000), ref: 00459408
Part of subcall function 004593D3: lua_pushnumber.LUA5.1(?,?,?,?,?,?,?,?,?,?,?,00407717,?,00000000), ref: 0045941E
Part of subcall function 004593D3: lua_pcall.LUA5.1(?,00000001,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00407717), ref: 0045942A
Part of subcall function 004593D3: lua_remove.LUA5.1(?,000000FF,?,?,?,?,?,?,?,?,00407717,?,00000000), ref: 00459439

Strings

CANCEL, xrefs: 0045E355, 0045E35A, 0045E362

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: lua_type.$lua_remove.$lua_getfield.lua_gettable.lua_pcall.lua_pushnil.lua_pushstring.$H_prolog3lua_next.lua_pushnumber.
String ID: CANCEL
API String ID: 1121822986-2800616180
Opcode ID: 867cc3a0f5ab3008c997e907d93be17899ab25b816bcc57899a7ff1b163c14e5
Instruction ID: 37e720578c5f2fc1c70d12af50fcc7e46d1cfd8ecfd47baafa11523edcaf63bb
Opcode Fuzzy Hash: 867cc3a0f5ab3008c997e907d93be17899ab25b816bcc57899a7ff1b163c14e5
Instruction Fuzzy Hash: A871F731909214B9EB19B666CC07FEF76689F12315F20015FF911761C3EE7C6B0A866E

Uniqueness

Uniqueness Score: -1.00%

Function 0048854B Relevance: 28.2, APIs: 13, Strings: 3, Instructions: 151windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00488552
GetDC.USER32(?), ref: 0048856D
CreateHalftonePalette.GDI32(?,00000000), ref: 0048857E
ReleaseDC.USER32(?,?), ref: 00488593
GetSystemMenu.USER32(?,00000000), ref: 0048859E
RemoveMenu.USER32(?,0000F000,00000000,00000000), ref: 004885C4
RemoveMenu.USER32(?,0000F030,00000000), ref: 004885D0
RemoveMenu.USER32(?,0000F020,00000000), ref: 004885DC
RemoveMenu.USER32(?,0000F120,00000000), ref: 004885E8
ModifyMenuA.USER32(?,0000F060,00000001,00000000,00000000), ref: 0048861D
RemoveMenu.USER32(?,00000001,00000400), ref: 0048862D
RemoveMenu.USER32(?,00000001,00000400), ref: 00488639
_strlen.LIBCMT ref: 00488683

Strings

.ini, xrefs: 004886B8
_DisableCloseButton, xrefs: 004885F0
\irsetup.skin, xrefs: 0048867D, 00488682, 0048868A

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: Menu$Remove$CreateH_prolog3HalftoneModifyPaletteReleaseSystem_strlen
String ID: .ini$\irsetup.skin$_DisableCloseButton
API String ID: 1932109235-2821109618
Opcode ID: bda68505ea16c8607c5d0b049c1e90069847d078455ad39c877f05b3863ff4f0
Instruction ID: 40072daacc08c0f9f9c2a752e5a4e5e2f0efc07153967998846ec6dfb7f039ea
Opcode Fuzzy Hash: bda68505ea16c8607c5d0b049c1e90069847d078455ad39c877f05b3863ff4f0
Instruction Fuzzy Hash: 64519F71900205ABDB10ABB4CD46FAE7BAABF00314F14456EF515BB5E2CF78A900CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00476601 Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 123COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00476608

Part of subcall function 00459443: lua_getfield.LUA5.1(?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459455
Part of subcall function 00459443: lua_pushstring.LUA5.1(?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459460
Part of subcall function 00459443: lua_gettable.LUA5.1(?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459468
Part of subcall function 00459443: lua_remove.LUA5.1(?,000000FE,?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459470
Part of subcall function 00459443: lua_type.LUA5.1(?,000000FF,?,000000FE,?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459478
Part of subcall function 00459443: lua_pcall.LUA5.1(?,00000000,00000000,00000000), ref: 0045948B
Part of subcall function 00459443: lua_remove.LUA5.1(?,000000FF), ref: 0045949A

Part of subcall function 004597A0: __EH_prolog3.LIBCMT ref: 004597A7
Part of subcall function 004597A0: lua_gettop.LUA5.1(?,00000000,00000000,00000008,004076D1,?,00000002,?), ref: 004597D3

Part of subcall function 00459852: __EH_prolog3.LIBCMT ref: 00459859
Part of subcall function 00459852: lua_tolstring.LUA5.1(?,?,00000000,00000000,00000000,0000000C,004082AF,?,00000002,?,00000001,?,00000002), ref: 0045988A

Part of subcall function 00401BAB: __EH_prolog3.LIBCMT ref: 00401BB2

lua_getfield.LUA5.1(?,FFFFD8EE,string), ref: 00476677
lua_pushstring.LUA5.1(?,sub,?,FFFFD8EE,string), ref: 00476682
lua_gettable.LUA5.1(?,000000FE,?,sub,?,FFFFD8EE,string), ref: 0047668A
lua_remove.LUA5.1(?,000000FE,?,000000FE,?,sub,?,FFFFD8EE,string), ref: 00476692
lua_type.LUA5.1(?,000000FF,?,000000FE,?,000000FE,?,sub,?,FFFFD8EE,string), ref: 0047669A
lua_pushstring.LUA5.1(?,?), ref: 004766AB
lua_pushnumber.LUA5.1(?,?,?), ref: 004766B7
lua_pushnumber.LUA5.1(?,?), ref: 004766C9
lua_pcall.LUA5.1(?,00000003,00000001,00000000,?,?), ref: 004766D4
lua_pushstring.LUA5.1(?,?,?,00000B54), ref: 00476731

Strings

string, xrefs: 00476668
sub, xrefs: 0047667C

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: H_prolog3lua_pushstring.$lua_remove.$lua_getfield.lua_gettable.lua_pcall.lua_pushnumber.lua_type.$lua_gettop.lua_tolstring.
String ID: string$sub
API String ID: 2420918779-840957247
Opcode ID: 1ab2a4fc334032bd4e05942922ee8a8d2bf0f6dddc943eb54ba08a9d30faafee
Instruction ID: c741ae442bacf06beb6974f6fa366705d07439002c83e0b6e86d99caf6ce0dfe
Opcode Fuzzy Hash: 1ab2a4fc334032bd4e05942922ee8a8d2bf0f6dddc943eb54ba08a9d30faafee
Instruction Fuzzy Hash: A1311830908815B6CB157B668D43EEF36269F42319F60421FF431762C7DE3C2B0282AE

Uniqueness

Uniqueness Score: -1.00%

Function 004764BE Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 113COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004764C5

Part of subcall function 00459443: lua_getfield.LUA5.1(?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459455
Part of subcall function 00459443: lua_pushstring.LUA5.1(?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459460
Part of subcall function 00459443: lua_gettable.LUA5.1(?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459468
Part of subcall function 00459443: lua_remove.LUA5.1(?,000000FE,?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459470
Part of subcall function 00459443: lua_type.LUA5.1(?,000000FF,?,000000FE,?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459478
Part of subcall function 00459443: lua_pcall.LUA5.1(?,00000000,00000000,00000000), ref: 0045948B
Part of subcall function 00459443: lua_remove.LUA5.1(?,000000FF), ref: 0045949A

Part of subcall function 004597A0: __EH_prolog3.LIBCMT ref: 004597A7
Part of subcall function 004597A0: lua_gettop.LUA5.1(?,00000000,00000000,00000008,004076D1,?,00000002,?), ref: 004597D3

Part of subcall function 00459852: __EH_prolog3.LIBCMT ref: 00459859
Part of subcall function 00459852: lua_tolstring.LUA5.1(?,?,00000000,00000000,00000000,0000000C,004082AF,?,00000002,?,00000001,?,00000002), ref: 0045988A

Part of subcall function 00401BAB: __EH_prolog3.LIBCMT ref: 00401BB2

lua_getfield.LUA5.1(?,FFFFD8EE,string), ref: 00476521
lua_pushstring.LUA5.1(?,sub,?,FFFFD8EE,string), ref: 0047652C
lua_gettable.LUA5.1(?,000000FE,?,sub,?,FFFFD8EE,string), ref: 00476534
lua_remove.LUA5.1(?,000000FE,?,000000FE,?,sub,?,FFFFD8EE,string), ref: 0047653C
lua_type.LUA5.1(?,000000FF,?,000000FE,?,000000FE,?,sub,?,FFFFD8EE,string), ref: 00476544
lua_pushstring.LUA5.1(?,?), ref: 00476555
lua_pushnumber.LUA5.1(?,?,?), ref: 00476560
lua_pushnumber.LUA5.1(?,?), ref: 0047656F
lua_pcall.LUA5.1(?,00000003,00000001,00000000,?,?), ref: 0047657B
lua_tolstring.LUA5.1(?,000000FF,00000000), ref: 004765A5
lua_remove.LUA5.1(?,000000FF,00000000), ref: 004765B9
lua_remove.LUA5.1(?,000000FF), ref: 004765C3
lua_pushstring.LUA5.1(?,?,?,00000B54), ref: 004765DA

Strings

string, xrefs: 00476512
sub, xrefs: 00476526

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: lua_remove.$H_prolog3lua_pushstring.$lua_getfield.lua_gettable.lua_pcall.lua_pushnumber.lua_tolstring.lua_type.$lua_gettop.
String ID: string$sub
API String ID: 739098303-840957247
Opcode ID: 8ca6110a9fe8f9b3f25d1b7a59d5bf1d1bf29ce844803788db609b00468a439c
Instruction ID: 1acc04b04f938ad394cc40b145fb0c1beef07f6fdeed691572ec4d10448d3648
Opcode Fuzzy Hash: 8ca6110a9fe8f9b3f25d1b7a59d5bf1d1bf29ce844803788db609b00468a439c
Instruction Fuzzy Hash: 9A310730909915B2DA117B668C43FEE31159F1232AF60461FF430751D7DE6D3B0542BE

Uniqueness

Uniqueness Score: -1.00%

Function 0048A5E6 Relevance: 26.5, APIs: 1, Strings: 14, Instructions: 260COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0048A5ED

Part of subcall function 004150D3: __EH_prolog3.LIBCMT ref: 004150DA

Part of subcall function 00401BAB: __EH_prolog3.LIBCMT ref: 00401BB2

Part of subcall function 004414FE: __EH_prolog3.LIBCMT ref: 00441505

Part of subcall function 00489D6A: __EH_prolog3.LIBCMT ref: 00489D71

Part of subcall function 00441614: __EH_prolog3.LIBCMT ref: 0044161B

Part of subcall function 004150D3: _strlen.LIBCMT ref: 00415183
Part of subcall function 004150D3: _strlen.LIBCMT ref: 00415210
Part of subcall function 004150D3: _strlen.LIBCMT ref: 00415231

Part of subcall function 00489C67: __EH_prolog3.LIBCMT ref: 00489C6E

Strings

TBTXTY, xrefs: 0048A8A3
CstClrs, xrefs: 0048A623
FTSEP, xrefs: 0048A796
TBTXTX, xrefs: 0048A871
Fonts, xrefs: 0048A7FD
ScreenW, xrefs: 0048A8D5
ScreenH, xrefs: 0048A907
BDIMG, xrefs: 0048A6FF
HDSEP, xrefs: 0048A764
StyleData, xrefs: 0048A60D
BDFILL, xrefs: 0048A732
CstFnts, xrefs: 0048A7C8
SBIMG, xrefs: 0048A6CC
TBIMG, xrefs: 0048A699

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: H_prolog3$_strlen
String ID: BDFILL$BDIMG$CstClrs$CstFnts$FTSEP$Fonts$HDSEP$SBIMG$ScreenH$ScreenW$StyleData$TBIMG$TBTXTX$TBTXTY
API String ID: 3239654323-2045141102
Opcode ID: 2620617e622f2057962bd5b7a64754a1eed7a6bf336116be529e5434488403d3
Instruction ID: 01c08598fef3520bf03dc9c758177b8d0310cde44e156d9744eaa0b036d1fb8c
Opcode Fuzzy Hash: 2620617e622f2057962bd5b7a64754a1eed7a6bf336116be529e5434488403d3
Instruction Fuzzy Hash: 04A19270500288FFCB04EB79C851EED7BB8AF11308F14455EB56A672E2DB78AB48C795

Uniqueness

Uniqueness Score: -1.00%

Function 00474082 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 123COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00474089

Part of subcall function 00459443: lua_getfield.LUA5.1(?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459455
Part of subcall function 00459443: lua_pushstring.LUA5.1(?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459460
Part of subcall function 00459443: lua_gettable.LUA5.1(?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459468
Part of subcall function 00459443: lua_remove.LUA5.1(?,000000FE,?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459470
Part of subcall function 00459443: lua_type.LUA5.1(?,000000FF,?,000000FE,?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459478
Part of subcall function 00459443: lua_pcall.LUA5.1(?,00000000,00000000,00000000), ref: 0045948B
Part of subcall function 00459443: lua_remove.LUA5.1(?,000000FF), ref: 0045949A

Part of subcall function 004597A0: __EH_prolog3.LIBCMT ref: 004597A7
Part of subcall function 004597A0: lua_gettop.LUA5.1(?,00000000,00000000,00000008,004076D1,?,00000002,?), ref: 004597D3

Part of subcall function 004599E0: __EH_prolog3.LIBCMT ref: 004599E7
Part of subcall function 004599E0: lua_type.LUA5.1(?,?,00000000,00000000,0000000C,004085AC,?,?,00000024), ref: 00459A16

lua_pushstring.LUA5.1(?,Text), ref: 004740E4
lua_gettable.LUA5.1(?,000000FE,?,Text), ref: 004740EC
lua_isstring.LUA5.1(?,000000FF,?,000000FE,?,Text), ref: 004740F4
lua_tolstring.LUA5.1(?,000000FF,00000000), ref: 00474104

Part of subcall function 00401BAB: __EH_prolog3.LIBCMT ref: 00401BB2

lua_settop.LUA5.1(?,000000FE), ref: 00474147
lua_pushstring.LUA5.1(?,Visible,?,000000FE), ref: 00474152
lua_gettable.LUA5.1(?,000000FE,?,Visible,?,000000FE), ref: 0047415A
lua_type.LUA5.1(?,000000FF,?,000000FE,?,Visible,?,000000FE), ref: 00474162
lua_toboolean.LUA5.1(?,000000FF), ref: 00474172
lua_settop.LUA5.1(?,000000FE), ref: 0047418D
IsWindow.USER32(?), ref: 004741AB
RedrawWindow.USER32(?,00000000,00000000,00000105), ref: 004741D2

Strings

Visible, xrefs: 0047414C
Text, xrefs: 004740DC

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: H_prolog3$lua_gettable.lua_pushstring.lua_type.$Windowlua_remove.lua_settop.$Redrawlua_getfield.lua_gettop.lua_isstring.lua_pcall.lua_toboolean.lua_tolstring.
String ID: Text$Visible
API String ID: 3329575268-2024253636
Opcode ID: da15b1a1aa47b293cecce73a964996910093aea52ce3f15b9b3759f0e453c8da
Instruction ID: b33fb3f4a4071cfcdc984f3dfaa21ba9b3df6314bfe2800ab63a70f5495af573
Opcode Fuzzy Hash: da15b1a1aa47b293cecce73a964996910093aea52ce3f15b9b3759f0e453c8da
Instruction Fuzzy Hash: 0831D771908111ABCB15BF668C86EBE3279AF42735F50435EF8247A1D3DF3C6D008A69

Uniqueness

Uniqueness Score: -1.00%

Function 0046A3C1 Relevance: 26.4, APIs: 12, Strings: 3, Instructions: 113libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00459443: lua_getfield.LUA5.1(?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459455
Part of subcall function 00459443: lua_pushstring.LUA5.1(?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459460
Part of subcall function 00459443: lua_gettable.LUA5.1(?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459468
Part of subcall function 00459443: lua_remove.LUA5.1(?,000000FE,?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459470
Part of subcall function 00459443: lua_type.LUA5.1(?,000000FF,?,000000FE,?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459478
Part of subcall function 00459443: lua_pcall.LUA5.1(?,00000000,00000000,00000000), ref: 0045948B
Part of subcall function 00459443: lua_remove.LUA5.1(?,000000FF), ref: 0045949A

Part of subcall function 004597A0: __EH_prolog3.LIBCMT ref: 004597A7
Part of subcall function 004597A0: lua_gettop.LUA5.1(?,00000000,00000000,00000008,004076D1,?,00000002,?), ref: 004597D3

lua_type.LUA5.1(?,00000002,?,00000001,?,00000001,?), ref: 0046A3F8
lua_type.LUA5.1(?,00000002), ref: 0046A408
GetProcAddress.KERNEL32(00000000,MsiSetInternalUI), ref: 0046A43A
lua_createtable.LUA5.1(?,00000000,00000000), ref: 0046A453
lua_pushstring.LUA5.1(?,PreviousInterface,?,00000000,00000000), ref: 0046A45E
lua_pushnumber.LUA5.1(?,?,00000000,00000000), ref: 0046A46D
lua_settable.LUA5.1(?,000000FD,?,?,00000000,00000000), ref: 0046A475
lua_pushstring.LUA5.1(?,PreviousWindowHandle,?,000000FD,?,?,00000000,00000000), ref: 0046A480
lua_pushnumber.LUA5.1(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0046A495
lua_pushnil.LUA5.1(?,?,?,?,?,?,?,?,?,?,00000000), ref: 0046A4A0
lua_settable.LUA5.1(?,000000FD,?,?,?,?,?,?,?,?,?,00000000), ref: 0046A4A9
lua_pushnil.LUA5.1(?), ref: 0046A4D3

Strings

PreviousWindowHandle, xrefs: 0046A47A
MsiSetInternalUI, xrefs: 0046A434
PreviousInterface, xrefs: 0046A458

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: lua_pushstring.lua_type.$lua_pushnil.lua_pushnumber.lua_remove.lua_settable.$AddressH_prolog3Proclua_createtable.lua_getfield.lua_gettable.lua_gettop.lua_pcall.
String ID: MsiSetInternalUI$PreviousInterface$PreviousWindowHandle
API String ID: 2704171997-46935026
Opcode ID: 8b384ffcd3f58a95fde6f5cace056d15ee1f47a9f10f934fcf533fe58a7b0ceb
Instruction ID: 28c8c3a23f819620be5e5fb6aeb083c1c34e6726e28d015fb74702eece21acf9
Opcode Fuzzy Hash: 8b384ffcd3f58a95fde6f5cace056d15ee1f47a9f10f934fcf533fe58a7b0ceb
Instruction Fuzzy Hash: 2731D531809A14B9D7117F669C0BDDE36689F0232AF20454BF410B10C7FEBD6B558A6F

Uniqueness

Uniqueness Score: -1.00%

Function 00418503 Relevance: 24.7, APIs: 1, Strings: 13, Instructions: 246COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0041853B

Part of subcall function 00401BAB: __EH_prolog3.LIBCMT ref: 00401BB2

Strings

Windows Server 2008, xrefs: 004185FE
Windows Vista, xrefs: 004185CF
Any Future OS, xrefs: 0041868B
(or newer), xrefs: 00418832
(No SP), xrefs: 00418803
Windows XP, xrefs: 00418571
Windows Server 2003, xrefs: 004185A0
None, xrefs: 004186BA
All, xrefs: 004186E9
Windows 7, xrefs: 0041862D
Windows Server 2008 R2, xrefs: 0041865C
SP%d, xrefs: 004187D4
Unknown, xrefs: 00418542

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: H_prolog3
String ID: (No SP)$ (or newer)$ SP%d$All$Any Future OS$None$Unknown$Windows 7$Windows Server 2003$Windows Server 2008$Windows Server 2008 R2$Windows Vista$Windows XP
API String ID: 431132790-1951351909
Opcode ID: 7d7949f1c222d791e5fa6620ea9f3269ef888967e30cecc9650422592fb2f088
Instruction ID: c102b485ada45b4dd02179fe7e11188ef3d93e85a2b5413e3a668c9482a12bcb
Opcode Fuzzy Hash: 7d7949f1c222d791e5fa6620ea9f3269ef888967e30cecc9650422592fb2f088
Instruction Fuzzy Hash: DCA14C70A00119EBDF04EBE5CD92AFE777ABF40718F90055EB121772D2DBB82A059B45

Uniqueness

Uniqueness Score: -1.00%

Function 00418534 Relevance: 24.7, APIs: 1, Strings: 13, Instructions: 227COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0041853B

Part of subcall function 00401BAB: __EH_prolog3.LIBCMT ref: 00401BB2

Strings

Windows Server 2008, xrefs: 004185FE
Windows Vista, xrefs: 004185CF
Any Future OS, xrefs: 0041868B
(or newer), xrefs: 00418832
(No SP), xrefs: 00418803
Windows XP, xrefs: 00418571
Windows Server 2003, xrefs: 004185A0
None, xrefs: 004186BA
All, xrefs: 004186E9
Windows 7, xrefs: 0041862D
Windows Server 2008 R2, xrefs: 0041865C
SP%d, xrefs: 004187D4
Unknown, xrefs: 00418542

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: H_prolog3
String ID: (No SP)$ (or newer)$ SP%d$All$Any Future OS$None$Unknown$Windows 7$Windows Server 2003$Windows Server 2008$Windows Server 2008 R2$Windows Vista$Windows XP
API String ID: 431132790-1951351909
Opcode ID: f55b7eef662e8fd5a7d792ba09cf5ba8f609ccec20d9d975134947241c6a6ed9
Instruction ID: ac6c26443bddacdbfff2cf84929eda08a93c3b9c436042f8103cc21ff0f42f3b
Opcode Fuzzy Hash: f55b7eef662e8fd5a7d792ba09cf5ba8f609ccec20d9d975134947241c6a6ed9
Instruction Fuzzy Hash: CB913970A00119EBDF04EBE5CD92BFEB6B9BF44718F90055EB121772D2DBB82A049B45

Uniqueness

Uniqueness Score: -1.00%

Function 004760DF Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 99COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004760E6

Part of subcall function 00459443: lua_getfield.LUA5.1(?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459455
Part of subcall function 00459443: lua_pushstring.LUA5.1(?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459460
Part of subcall function 00459443: lua_gettable.LUA5.1(?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459468
Part of subcall function 00459443: lua_remove.LUA5.1(?,000000FE,?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459470
Part of subcall function 00459443: lua_type.LUA5.1(?,000000FF,?,000000FE,?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459478
Part of subcall function 00459443: lua_pcall.LUA5.1(?,00000000,00000000,00000000), ref: 0045948B
Part of subcall function 00459443: lua_remove.LUA5.1(?,000000FF), ref: 0045949A

Part of subcall function 004597A0: __EH_prolog3.LIBCMT ref: 004597A7
Part of subcall function 004597A0: lua_gettop.LUA5.1(?,00000000,00000000,00000008,004076D1,?,00000002,?), ref: 004597D3

Part of subcall function 00459852: __EH_prolog3.LIBCMT ref: 00459859
Part of subcall function 00459852: lua_tolstring.LUA5.1(?,?,00000000,00000000,00000000,0000000C,004082AF,?,00000002,?,00000001,?,00000002), ref: 0045988A

Part of subcall function 00401BAB: __EH_prolog3.LIBCMT ref: 00401BB2

lua_getfield.LUA5.1(?,FFFFD8EE,string), ref: 00476130
lua_pushstring.LUA5.1(?,lower,?,FFFFD8EE,string), ref: 0047613B
lua_gettable.LUA5.1(?,000000FE,?,lower,?,FFFFD8EE,string), ref: 00476143
lua_remove.LUA5.1(?,000000FE,?,000000FE,?,lower,?,FFFFD8EE,string), ref: 0047614B
lua_type.LUA5.1(?,000000FF,?,000000FE,?,000000FE,?,lower,?,FFFFD8EE,string), ref: 00476153
lua_pushstring.LUA5.1(?,?), ref: 00476164
lua_pcall.LUA5.1(?,00000001,00000001,00000000,?,?), ref: 0047616E
lua_tolstring.LUA5.1(?,000000FF,00000000), ref: 00476198
lua_remove.LUA5.1(?,000000FF,00000000), ref: 004761AC
lua_remove.LUA5.1(?,000000FF), ref: 004761B6
lua_pushstring.LUA5.1(?,?,?,00000B54), ref: 004761CD

Strings

lower, xrefs: 00476135
string, xrefs: 00476122

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: lua_remove.$H_prolog3lua_pushstring.$lua_getfield.lua_gettable.lua_pcall.lua_tolstring.lua_type.$lua_gettop.
String ID: lower$string
API String ID: 2578256382-1832601466
Opcode ID: 0bbf009903d023b02ab90b4e469bc4e3da1777ac23d8b98483b61f14175d6793
Instruction ID: d8c817d094db9fc3bd46a44aee96dbc3d44f9042de995e5d4375bbf5802fa746
Opcode Fuzzy Hash: 0bbf009903d023b02ab90b4e469bc4e3da1777ac23d8b98483b61f14175d6793
Instruction Fuzzy Hash: 1E21E12190981576DA017AA68D42FEF311ADF1232EFA4431BB431721D7DE2C2F0A41BE

Uniqueness

Uniqueness Score: -1.00%

Function 004761F4 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 99COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004761FB

Part of subcall function 00459443: lua_getfield.LUA5.1(?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459455
Part of subcall function 00459443: lua_pushstring.LUA5.1(?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459460
Part of subcall function 00459443: lua_gettable.LUA5.1(?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459468
Part of subcall function 00459443: lua_remove.LUA5.1(?,000000FE,?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459470
Part of subcall function 00459443: lua_type.LUA5.1(?,000000FF,?,000000FE,?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459478
Part of subcall function 00459443: lua_pcall.LUA5.1(?,00000000,00000000,00000000), ref: 0045948B
Part of subcall function 00459443: lua_remove.LUA5.1(?,000000FF), ref: 0045949A

Part of subcall function 004597A0: __EH_prolog3.LIBCMT ref: 004597A7
Part of subcall function 004597A0: lua_gettop.LUA5.1(?,00000000,00000000,00000008,004076D1,?,00000002,?), ref: 004597D3

Part of subcall function 00459852: __EH_prolog3.LIBCMT ref: 00459859
Part of subcall function 00459852: lua_tolstring.LUA5.1(?,?,00000000,00000000,00000000,0000000C,004082AF,?,00000002,?,00000001,?,00000002), ref: 0045988A

Part of subcall function 00401BAB: __EH_prolog3.LIBCMT ref: 00401BB2

lua_getfield.LUA5.1(?,FFFFD8EE,string), ref: 00476245
lua_pushstring.LUA5.1(?,upper,?,FFFFD8EE,string), ref: 00476250
lua_gettable.LUA5.1(?,000000FE,?,upper,?,FFFFD8EE,string), ref: 00476258
lua_remove.LUA5.1(?,000000FE,?,000000FE,?,upper,?,FFFFD8EE,string), ref: 00476260
lua_type.LUA5.1(?,000000FF,?,000000FE,?,000000FE,?,upper,?,FFFFD8EE,string), ref: 00476268
lua_pushstring.LUA5.1(?,?), ref: 00476279
lua_pcall.LUA5.1(?,00000001,00000001,00000000,?,?), ref: 00476283
lua_tolstring.LUA5.1(?,000000FF,00000000), ref: 004762AD
lua_remove.LUA5.1(?,000000FF,00000000), ref: 004762C1
lua_remove.LUA5.1(?,000000FF), ref: 004762CB
lua_pushstring.LUA5.1(?,?,?,00000B54), ref: 004762E2

Strings

string, xrefs: 00476237
upper, xrefs: 0047624A

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: lua_remove.$H_prolog3lua_pushstring.$lua_getfield.lua_gettable.lua_pcall.lua_tolstring.lua_type.$lua_gettop.
String ID: string$upper
API String ID: 2578256382-3686168835
Opcode ID: 52a1ba911ea83d90a63660a3c0ed3a89cae9551f20ee656187dfe752018c64e6
Instruction ID: 5dd6ced2a2f96a8709847fe05ba91b953df642c1a39833d93c808350270ea6da
Opcode Fuzzy Hash: 52a1ba911ea83d90a63660a3c0ed3a89cae9551f20ee656187dfe752018c64e6
Instruction Fuzzy Hash: F921F36190982976DA117AA68C42FEF31199F1232EF60435BF431721D7DE2C2F0641BE

Uniqueness

Uniqueness Score: -1.00%

Function 0045E48E Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 75COMMON

Download Yara Rule

APIs

Part of subcall function 00459443: lua_getfield.LUA5.1(?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459455
Part of subcall function 00459443: lua_pushstring.LUA5.1(?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459460
Part of subcall function 00459443: lua_gettable.LUA5.1(?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459468
Part of subcall function 00459443: lua_remove.LUA5.1(?,000000FE,?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459470
Part of subcall function 00459443: lua_type.LUA5.1(?,000000FF,?,000000FE,?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459478
Part of subcall function 00459443: lua_pcall.LUA5.1(?,00000000,00000000,00000000), ref: 0045948B
Part of subcall function 00459443: lua_remove.LUA5.1(?,000000FF), ref: 0045949A

Part of subcall function 004597A0: __EH_prolog3.LIBCMT ref: 004597A7
Part of subcall function 004597A0: lua_gettop.LUA5.1(?,00000000,00000000,00000008,004076D1,?,00000002,?), ref: 004597D3

lua_createtable.LUA5.1(?,00000000,00000000), ref: 0045E4D6
lua_pushstring.LUA5.1(?,Text,?,00000000,00000000), ref: 0045E4E1
lua_pushstring.LUA5.1(?,?,?,Text,?,00000000,00000000), ref: 0045E4EA
lua_settable.LUA5.1(?,000000FD,?,?,?,Text,?,00000000,00000000), ref: 0045E4F2
lua_pushstring.LUA5.1(?,Visible,?,000000FD,?,?,?,Text,?,00000000,00000000), ref: 0045E4FD
lua_pushboolean.LUA5.1(?,?,?,Visible,?,000000FD,?,?,?,Text,?,00000000,00000000), ref: 0045E506
lua_settable.LUA5.1(?,000000FD,?,?,?,Visible,?,000000FD,?,?,?,Text,?,00000000,00000000), ref: 0045E50E
lua_pushstring.LUA5.1(?,Enabled,?,000000FD,?,?,?,Visible,?,000000FD,?,?,?,Text,?,00000000), ref: 0045E519
lua_pushboolean.LUA5.1(?,?), ref: 0045E525
lua_settable.LUA5.1(?,000000FD,?,?), ref: 0045E52D
lua_pushnil.LUA5.1(?), ref: 0045E547

Strings

Enabled, xrefs: 0045E513
Visible, xrefs: 0045E4F7
Text, xrefs: 0045E4DB

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: lua_pushstring.$lua_settable.$lua_pushboolean.lua_remove.$H_prolog3lua_createtable.lua_getfield.lua_gettable.lua_gettop.lua_pcall.lua_pushnil.lua_type.
String ID: Enabled$Text$Visible
API String ID: 3799973209-1258828939
Opcode ID: 051eda2af53097124cb278c6a91307d189c3b1c025535384f653004ac57ddfcb
Instruction ID: 825a8f75a6255a7c3cc1c566085d0e7618f0f6c063896b62d9b2026ba8801a75
Opcode Fuzzy Hash: 051eda2af53097124cb278c6a91307d189c3b1c025535384f653004ac57ddfcb
Instruction Fuzzy Hash: 6C118E32409A21BADA127E678C03FCF26199F0632AF10021EF514740C7AF6D7B0242BE

Uniqueness

Uniqueness Score: -1.00%

Function 0045204D Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 273COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00452054

Part of subcall function 004019B2: _strlen.LIBCMT ref: 004019C2

Strings

CreateProcessWithLogonW, xrefs: 00452218
A bad pointer has been used., xrefs: 00452069
Advapi32.dll, xrefs: 00452202

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: H_prolog3_strlen
String ID: A bad pointer has been used.$Advapi32.dll$CreateProcessWithLogonW
API String ID: 782648989-4276160095
Opcode ID: c9b9f9e8bf8eb93798e9cba910c580d904ec00765437bfcf8e952729a42d8a07
Instruction ID: 5a01151bb554aea6482553f4779d2a11d8590217cae0bc2ee3f03dba2be7bda2
Opcode Fuzzy Hash: c9b9f9e8bf8eb93798e9cba910c580d904ec00765437bfcf8e952729a42d8a07
Instruction Fuzzy Hash: 2BA1AE71800208EFCB15DFA9CD45AAEBBB5FF09315F14411FF910B62A2DB789944CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 0047018C Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 188COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00470193

Part of subcall function 00459443: lua_getfield.LUA5.1(?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459455
Part of subcall function 00459443: lua_pushstring.LUA5.1(?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459460
Part of subcall function 00459443: lua_gettable.LUA5.1(?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459468
Part of subcall function 00459443: lua_remove.LUA5.1(?,000000FE,?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459470
Part of subcall function 00459443: lua_type.LUA5.1(?,000000FF,?,000000FE,?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459478
Part of subcall function 00459443: lua_pcall.LUA5.1(?,00000000,00000000,00000000), ref: 0045948B
Part of subcall function 00459443: lua_remove.LUA5.1(?,000000FF), ref: 0045949A

Part of subcall function 004597A0: __EH_prolog3.LIBCMT ref: 004597A7
Part of subcall function 004597A0: lua_gettop.LUA5.1(?,00000000,00000000,00000008,004076D1,?,00000002,?), ref: 004597D3

Part of subcall function 00459852: __EH_prolog3.LIBCMT ref: 00459859
Part of subcall function 00459852: lua_tolstring.LUA5.1(?,?,00000000,00000000,00000000,0000000C,004082AF,?,00000002,?,00000001,?,00000002), ref: 0045988A

Part of subcall function 00401BAB: __EH_prolog3.LIBCMT ref: 00401BB2

lua_type.LUA5.1(?,00000002), ref: 004701DA
lua_type.LUA5.1(?,00000002), ref: 004701E9

Part of subcall function 004019B2: _strlen.LIBCMT ref: 004019C2

lua_type.LUA5.1(?,00000003), ref: 00470217
lua_type.LUA5.1(?,00000003), ref: 0047022A
lua_pushnil.LUA5.1(?,?,00000003), ref: 00470242
lua_next.LUA5.1(?,00000003,?,?,00000003), ref: 0047024A
lua_tonumber.LUA5.1(?,000000FE), ref: 0047025E
lua_tolstring.LUA5.1(?,000000FF,00000000,?,000000FE), ref: 0047026A
_strlen.LIBCMT ref: 0047027C
lua_settop.LUA5.1(?,000000FE,006A333C,00000000,00000000), ref: 0047028F
lua_next.LUA5.1(?,00000003,?,000000FE,006A333C,00000000,00000000), ref: 00470297

Strings

I, xrefs: 00470360

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: lua_type.$H_prolog3$_strlenlua_next.lua_remove.lua_tolstring.$lua_getfield.lua_gettable.lua_gettop.lua_pcall.lua_pushnil.lua_pushstring.lua_settop.lua_tonumber.
String ID: I
API String ID: 1513353274-517184014
Opcode ID: 173dab58629844aaf4ce248e6121166c3139417fd16e6036ad108765569909ac
Instruction ID: 7952d8d8e5506a93917375c2c267faf28ae85828bc702c03e3360924aa2bef79
Opcode Fuzzy Hash: 173dab58629844aaf4ce248e6121166c3139417fd16e6036ad108765569909ac
Instruction Fuzzy Hash: E451D472804105EADB05EBA9CC42BFF7678AF11728F14425FF425B62D3DE3C6A04827A

Uniqueness

Uniqueness Score: -1.00%

Function 0047A392 Relevance: 22.8, APIs: 11, Strings: 2, Instructions: 80COMMON

Download Yara Rule

APIs

Part of subcall function 00459443: lua_getfield.LUA5.1(?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459455
Part of subcall function 00459443: lua_pushstring.LUA5.1(?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459460
Part of subcall function 00459443: lua_gettable.LUA5.1(?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459468
Part of subcall function 00459443: lua_remove.LUA5.1(?,000000FE,?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459470
Part of subcall function 00459443: lua_type.LUA5.1(?,000000FF,?,000000FE,?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459478
Part of subcall function 00459443: lua_pcall.LUA5.1(?,00000000,00000000,00000000), ref: 0045948B
Part of subcall function 00459443: lua_remove.LUA5.1(?,000000FF), ref: 0045949A

Part of subcall function 004597A0: __EH_prolog3.LIBCMT ref: 004597A7
Part of subcall function 004597A0: lua_gettop.LUA5.1(?,00000000,00000000,00000008,004076D1,?,00000002,?), ref: 004597D3

Part of subcall function 004599E0: __EH_prolog3.LIBCMT ref: 004599E7
Part of subcall function 004599E0: lua_type.LUA5.1(?,?,00000000,00000000,0000000C,004085AC,?,?,00000024), ref: 00459A16

lua_getfield.LUA5.1(?,FFFFD8EE,table,?,00000001,?,00000003,?), ref: 0047A3BB
lua_pushstring.LUA5.1(?,insert,?,FFFFD8EE,table,?,00000001,?,00000003,?), ref: 0047A3C6
lua_gettable.LUA5.1(?,000000FE,?,insert,?,FFFFD8EE,table,?,00000001,?,00000003,?), ref: 0047A3CE
lua_remove.LUA5.1(?,000000FE,?,000000FE,?,insert,?,FFFFD8EE,table,?,00000001,?,00000003,?), ref: 0047A3D6
lua_type.LUA5.1(?,000000FF,?,000000FE,?,000000FE,?,insert,?,FFFFD8EE,table,?,00000001,?,00000003,?), ref: 0047A3DE
lua_pushvalue.LUA5.1(?,00000001), ref: 0047A3EE
lua_pushvalue.LUA5.1(?,00000002,?,00000001), ref: 0047A3F6
lua_pushvalue.LUA5.1(?,00000003,?,00000002,?,00000001), ref: 0047A3FE
lua_pcall.LUA5.1(?,00000003,00000000,00000000,?,00000003,?,00000002,?,00000001), ref: 0047A40A
lua_remove.LUA5.1(?,000000FF), ref: 0047A432
lua_remove.LUA5.1(?,000000FF), ref: 0047A43C

Strings

table, xrefs: 0047A3B0
insert, xrefs: 0047A3C0

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: lua_remove.$lua_pushvalue.lua_type.$H_prolog3lua_getfield.lua_gettable.lua_pcall.lua_pushstring.$lua_gettop.
String ID: insert$table
API String ID: 3930532097-2640480790
Opcode ID: c6dcd18112f68fdb0b11d56df03f55cf28ae34e2ceff18d38f8a62fd1250aac0
Instruction ID: 9ce1574715025ebb06485de8299a7057103cd0dd73f1c5d5e9e245df7a70f8f7
Opcode Fuzzy Hash: c6dcd18112f68fdb0b11d56df03f55cf28ae34e2ceff18d38f8a62fd1250aac0
Instruction Fuzzy Hash: F7115E2124DA2531E5223A275C47FDE11098F1372FF60821BF524752C7AE8E2B1241FF

Uniqueness

Uniqueness Score: -1.00%

Function 0046A55B Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 160libraryCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0046A565

Part of subcall function 00401BAB: __EH_prolog3.LIBCMT ref: 00401BB2

Part of subcall function 0045198A: __EH_prolog3.LIBCMT ref: 00451991

_strlen.LIBCMT ref: 0046A666

Part of subcall function 00403C07: _strnlen.LIBCMT ref: 00403C37
Part of subcall function 00403C07: _memcpy_s.LIBCMT ref: 00403C6B

GetFileAttributesA.KERNEL32(?,\msi.dll,00000000,NONE,00000003,?,?,?,?,00000001,00000000,00000124,00406088,00000000,00000008), ref: 0046A681
LoadLibraryA.KERNEL32(msi.dll,00000003,?,?,?,?,00000001,00000000,00000124,00406088,00000000,00000008), ref: 0046A6BD
GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,?,?,?,00000001,00000000,00000124,00406088,00000000,00000008), ref: 0046A6DA
FreeLibrary.KERNEL32(?,?,?,?,?,00000001,00000000,00000124,00406088,00000000,00000008), ref: 0046A75D
GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0046A773

Part of subcall function 00405AB7: __mbsinc.LIBCMT ref: 00405AF2

Strings

msi.dll, xrefs: 0046A6B8
Software\Microsoft\Windows\CurrentVersion\Installer, xrefs: 0046A5F0
NONE, xrefs: 0046A5C1, 0046A5C6, 0046A61C
\msi.dll, xrefs: 0046A65C, 0046A661, 0046A66E
InstallerLocation, xrefs: 0046A5D9

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: FileH_prolog3Library$AttributesDirectoryFreeH_prolog3_LoadModuleNameSystem__mbsinc_memcpy_s_strlen_strnlen
String ID: InstallerLocation$NONE$Software\Microsoft\Windows\CurrentVersion\Installer$\msi.dll$msi.dll
API String ID: 3869650526-3461350423
Opcode ID: 3f15ebf9e1e3fb15390a88a787854da8d6f84940e1ff5b952d3380169ac6746e
Instruction ID: eb28d908747ea0b48ba96ae4b783b69686a504933810538d78eee2cb551ddb9f
Opcode Fuzzy Hash: 3f15ebf9e1e3fb15390a88a787854da8d6f84940e1ff5b952d3380169ac6746e
Instruction Fuzzy Hash: 435193719002189BDB14EB69CC96BDDB7B8AF15314F0041EEB509B32D2DA385F44CFA6

Uniqueness

Uniqueness Score: -1.00%

Function 004065D1 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 142COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004065D8
lua_createtable.LUA5.1(?,00000000,00000000,00000000,00000020), ref: 00406601
lua_setfield.LUA5.1(?,FFFFD8EE,_CommandLineArgs), ref: 00406778

Part of subcall function 00401BAB: __EH_prolog3.LIBCMT ref: 00401BB2

lua_pushnumber.LUA5.1(?), ref: 00406726
lua_pushstring.LUA5.1(?,?,?), ref: 00406734
lua_settable.LUA5.1(?,000000FD,?,?,?), ref: 00406741

Strings

__IRSID, xrefs: 004066BC
__IRTSS, xrefs: 004066F3
__IRAFN, xrefs: 00406646
__IRAOFF, xrefs: 00406681
_CommandLineArgs, xrefs: 00406768
__IRCT, xrefs: 004067A4

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: H_prolog3$lua_createtable.lua_pushnumber.lua_pushstring.lua_setfield.lua_settable.
String ID: _CommandLineArgs$__IRAFN$__IRAOFF$__IRCT$__IRSID$__IRTSS
API String ID: 1988043533-4248917902
Opcode ID: fa214d7008065ca1ca5b6c40969339079b8068e9173eac46ba3c476ab6d74e86
Instruction ID: da490879e7f7349399ede81a8a5137e6d3253ac756d2c41856d1ecccf98340c1
Opcode Fuzzy Hash: fa214d7008065ca1ca5b6c40969339079b8068e9173eac46ba3c476ab6d74e86
Instruction Fuzzy Hash: E451A130911119ABCF04EBF5CC56BEEBBB5AF14318F10026EF516B72D2DA782A04C769

Uniqueness

Uniqueness Score: -1.00%

Function 00458292 Relevance: 21.1, APIs: 2, Strings: 10, Instructions: 120COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00458299

Part of subcall function 004C32AC: ActivateActCtx.KERNEL32(?,?), ref: 004C32CF

Part of subcall function 00401BAB: __EH_prolog3.LIBCMT ref: 00401BB2

_strlen.LIBCMT ref: 00458366

Strings

MSG_STATUS_REQUEST_COMPLETE, xrefs: 0045833A
MSG_RESOLVING_HOST_NAME, xrefs: 00458311
MSG_HOST_NAME_RESOLVED, xrefs: 0045830A
MSG_CONNECTED_TO_SERVER, xrefs: 004582FC
MSG_STATUS_HANDLE_CREATED, xrefs: 00458360, 00458365, 0045836D
MSG_CONNECTING_TO_SERVER, xrefs: 00458303
MSG_CONNECTION_CLOSED, xrefs: 00458318
MSG_REDIRECTING, xrefs: 00458333
MSG_STATUS_HANDLE_CLOSING, xrefs: 0045834D
MSG_CLOSING_CONNECTION, xrefs: 004582F5

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: H_prolog3$Activate_strlen
String ID: MSG_CLOSING_CONNECTION$MSG_CONNECTED_TO_SERVER$MSG_CONNECTING_TO_SERVER$MSG_CONNECTION_CLOSED$MSG_HOST_NAME_RESOLVED$MSG_REDIRECTING$MSG_RESOLVING_HOST_NAME$MSG_STATUS_HANDLE_CLOSING$MSG_STATUS_HANDLE_CREATED$MSG_STATUS_REQUEST_COMPLETE
API String ID: 1677763243-282160135
Opcode ID: 57cc1ab846bcda8443e760bc9b82ca43f50dc2129d15bb35378458df7ea3e0d7
Instruction ID: b293a6f9f0b33b19a40e04def689747989984da8e08655cb4b614111275d4468
Opcode Fuzzy Hash: 57cc1ab846bcda8443e760bc9b82ca43f50dc2129d15bb35378458df7ea3e0d7
Instruction Fuzzy Hash: 9841D931800124DBCB24AE59C4456AF7A65AF12B61F14817FFC05BB392CE7D9E48CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 004485DD Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 106windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004B8BAB: GetParent.USER32(?), ref: 004B8BC0
Part of subcall function 004B8BAB: GetParent.USER32(?), ref: 004B8BCF
Part of subcall function 004B8BAB: GetParent.USER32(?), ref: 004B8BE5
Part of subcall function 004B8BAB: SetFocus.USER32(?,00000000), ref: 004B8BFB

InvalidateRect.USER32(?,00000000,00000001), ref: 00448617
GetWindowRect.USER32(?,?), ref: 00448642
InvalidateRect.USER32(?,00000000,00000001), ref: 0044865C
GetSubMenu.USER32(?,00000000), ref: 00448665
SendMessageA.USER32(?,?,?,?), ref: 00448688
TrackPopupMenuEx.USER32(?,00000182,?,?,?,00000000), ref: 004486A3
InvalidateRect.USER32(?,00000000,00000001), ref: 004486B8
PostMessageA.USER32(?,00000111,?,00000000), ref: 004486D0

Strings

open, xrefs: 00448708

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: Rect$InvalidateParent$MenuMessage$FocusPopupPostSendTrackWindow
String ID: open
API String ID: 577789284-2758837156
Opcode ID: 7621bca52037fc5e48a5be5535deea00ba2356ce8c3f08fdd1756df9b167aa18
Instruction ID: 266640d36b1d0ad21ae578210f4ff98eb18b192f7d1b272ed0120053fcd0249c
Opcode Fuzzy Hash: 7621bca52037fc5e48a5be5535deea00ba2356ce8c3f08fdd1756df9b167aa18
Instruction Fuzzy Hash: 5E412771800608AFDB219FA5DC49AEFFFF9FF89700F10441EE64AA2250DB755A41DB64

Uniqueness

Uniqueness Score: -1.00%

Function 0047C1ED Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 92COMMON

Download Yara Rule

APIs

Part of subcall function 00459443: lua_getfield.LUA5.1(?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459455
Part of subcall function 00459443: lua_pushstring.LUA5.1(?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459460
Part of subcall function 00459443: lua_gettable.LUA5.1(?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459468
Part of subcall function 00459443: lua_remove.LUA5.1(?,000000FE,?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459470
Part of subcall function 00459443: lua_type.LUA5.1(?,000000FF,?,000000FE,?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459478
Part of subcall function 00459443: lua_pcall.LUA5.1(?,00000000,00000000,00000000), ref: 0045948B
Part of subcall function 00459443: lua_remove.LUA5.1(?,000000FF), ref: 0045949A

Part of subcall function 004597A0: __EH_prolog3.LIBCMT ref: 004597A7
Part of subcall function 004597A0: lua_gettop.LUA5.1(?,00000000,00000000,00000008,004076D1,?,00000002,?), ref: 004597D3

IsWindow.USER32(00000000), ref: 0047C235
GetWindowRect.USER32(?,?), ref: 0047C24C
lua_createtable.LUA5.1(?,00000000,00000000), ref: 0047C255
lua_pushstring.LUA5.1(?,Width,?,00000000,00000000), ref: 0047C260
lua_pushnumber.LUA5.1(?,?,00000000,00000000), ref: 0047C278
lua_settable.LUA5.1(?,000000FD,?,?,00000000,00000000), ref: 0047C280
lua_pushstring.LUA5.1(?,Height,?,000000FD,?,?,00000000,00000000), ref: 0047C28B
lua_pushnumber.LUA5.1(?,?,?,?,?,?,?,00000000,00000000), ref: 0047C2A3
lua_settable.LUA5.1(?,000000FD,?,?,?,?,?,?,?,00000000,00000000), ref: 0047C2AB
lua_pushnil.LUA5.1(?), ref: 0047C2CD

Strings

Width, xrefs: 0047C25A
Height, xrefs: 0047C285

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: lua_pushstring.$Windowlua_pushnumber.lua_remove.lua_settable.$H_prolog3Rectlua_createtable.lua_getfield.lua_gettable.lua_gettop.lua_pcall.lua_pushnil.lua_type.
String ID: Height$Width
API String ID: 1097245944-1965321196
Opcode ID: fc2665bdb6ec03b2c7a7927188f98645c1d1364426276bd34cc7ddf276052971
Instruction ID: 8741271c9f1a0be4ceedf802db20e2736d0531f486da7431057a2719d3a6f74d
Opcode Fuzzy Hash: fc2665bdb6ec03b2c7a7927188f98645c1d1364426276bd34cc7ddf276052971
Instruction Fuzzy Hash: 08215271C04515BACB00AFAB8C46DEFBBB8EF45305F10415EF410A6192DB786B018BAE

Uniqueness

Uniqueness Score: -1.00%

Function 0045E3D4 Relevance: 19.3, APIs: 1, Strings: 10, Instructions: 41COMMON

Download Yara Rule

APIs

luaL_openlib.LUA5.1(?,Dialog,?,00000000), ref: 0045E478

Strings

Dialog, xrefs: 0045E3F4
Input, xrefs: 0045E416
MaskedInput, xrefs: 0045E424
ComboBox, xrefs: 0045E46A
Message, xrefs: 0045E432
PasswordInput, xrefs: 0045E440
FileBrowse, xrefs: 0045E3FA
TimedMessage, xrefs: 0045E45C
FolderBrowse, xrefs: 0045E408
SplashImage, xrefs: 0045E44E

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: L_openlib.
String ID: ComboBox$Dialog$FileBrowse$FolderBrowse$Input$MaskedInput$Message$PasswordInput$SplashImage$TimedMessage
API String ID: 3969157368-2997221968
Opcode ID: 709ede42ecfb3ba58cce8c849a7c569857a7f2c17d59cdc64646c49af6259e12
Instruction ID: 0225d071e258d977ffe7e67952668b86ec97579c40bd9db43188a44d647f5fe9
Opcode Fuzzy Hash: 709ede42ecfb3ba58cce8c849a7c569857a7f2c17d59cdc64646c49af6259e12
Instruction Fuzzy Hash: 2C11A4B0D012899B8B14EFD5E94949DBFF1EF46309B50811AD4156B206DBF89A0DCF58

Uniqueness

Uniqueness Score: -1.00%

Function 00480390 Relevance: 19.3, APIs: 1, Strings: 10, Instructions: 41COMMON

Download Yara Rule

APIs

luaL_openlib.LUA5.1(00000005,HTTP,?,00000000), ref: 00480434

Strings

GetFileSizeSecure, xrefs: 00480426
SubmitSecure, xrefs: 004803E0
GetHTTPErrorInfo, xrefs: 0048040A
TestConnection, xrefs: 004803EE
Download, xrefs: 004803B6
HTTP, xrefs: 004803B0
DownloadSecure, xrefs: 004803D2
GetFileSize, xrefs: 00480418
Submit, xrefs: 004803C4
GetConnectionState, xrefs: 004803FC

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: L_openlib.
String ID: Download$DownloadSecure$GetConnectionState$GetFileSize$GetFileSizeSecure$GetHTTPErrorInfo$HTTP$Submit$SubmitSecure$TestConnection
API String ID: 3969157368-168128308
Opcode ID: 2ded5155874c10e9db52bdc877c34f1e81e7301e33b5675a6a3fa94953521bcd
Instruction ID: 4116e2d36faf3f4323e369a3ea931c524ac1f5f5fa8b7122bcad7448b82124d8
Opcode Fuzzy Hash: 2ded5155874c10e9db52bdc877c34f1e81e7301e33b5675a6a3fa94953521bcd
Instruction Fuzzy Hash: 1511DCB0D04249AA8B04EFD5DD894DDBFF5EB0A308F54805EE4197B200D7B85E098F98

Uniqueness

Uniqueness Score: -1.00%

Function 00420480 Relevance: 17.9, APIs: 1, Strings: 9, Instructions: 386COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00420487

Strings

FontDesc, xrefs: 004207FF, 00420814
File added to uninstall list: , xrefs: 004208D9, 00420910
File, xrefs: 0042064E
UnregisterCOM, xrefs: 00420741, 00420756
UninstallFiles, xrefs: 00420612, 00420627
BackupFile, xrefs: 0042084B, 00420860
UnregisterFont, xrefs: 004207A0, 004207B5
DecrementUsageCount, xrefs: 004206E2, 004206F7
Filename, xrefs: 00420679

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: H_prolog3
String ID: BackupFile$DecrementUsageCount$File$File added to uninstall list: $Filename$FontDesc$UninstallFiles$UnregisterCOM$UnregisterFont
API String ID: 431132790-3341397462
Opcode ID: 27352409fcd1095a7f4791ae86641fdbe7772040a0ff8fd6f20cfd7fff37b31c
Instruction ID: 3f0bbbb89b0eedb2c5d4205137c6be9a879ec4627445e3937c284754dd5d5763
Opcode Fuzzy Hash: 27352409fcd1095a7f4791ae86641fdbe7772040a0ff8fd6f20cfd7fff37b31c
Instruction Fuzzy Hash: 55E185B0A00715AFCF24EF65D8919AEBBF5BF04704B00452FF156A7782D738A944CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0043641B Relevance: 17.8, APIs: 4, Strings: 6, Instructions: 334windowCOMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 0043645D
MessageBoxA.USER32(?,00000000,?), ref: 004365AC

Part of subcall function 00403F67: __EH_prolog3.LIBCMT ref: 00403F71

_strlen.LIBCMT ref: 004366EB

Strings

Extract dependency file: , xrefs: 0043683E
ERR_MEMORY_ALLOCATE_DECOMPRESS, xrefs: 004364BA, 00436582
x, xrefs: 004365D2
%s%s, xrefs: 004368F5
ERR_CREATE_FOLDER, xrefs: 004368CB
MSG_ERROR, xrefs: 00436551, 0043692D

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: _strlen$H_prolog3Message
String ID: %s%s$ERR_CREATE_FOLDER$ERR_MEMORY_ALLOCATE_DECOMPRESS$Extract dependency file: $MSG_ERROR$x
API String ID: 1482627676-3512040138
Opcode ID: ef614544570dfb15f242129696be554e3b6c460235b131232ce18ba5d0adb352
Instruction ID: 9c84799ddd4049540f47d508d98b5116ec5f7dcf9f8d4a7f8fb4de6df4373ee4
Opcode Fuzzy Hash: ef614544570dfb15f242129696be554e3b6c460235b131232ce18ba5d0adb352
Instruction Fuzzy Hash: BBE16DB09001199FDB24DB69CC81DEEB7B5AF09318F0041EEF299A7291DBB856C4CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0048C0C4 Relevance: 17.7, APIs: 1, Strings: 9, Instructions: 163COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0048C0CB

Part of subcall function 004150D3: __EH_prolog3.LIBCMT ref: 004150DA

Part of subcall function 004150D3: _strlen.LIBCMT ref: 00415183
Part of subcall function 004150D3: _strlen.LIBCMT ref: 00415210
Part of subcall function 004150D3: _strlen.LIBCMT ref: 00415231

Part of subcall function 004150D3: _strlen.LIBCMT ref: 00415255
Part of subcall function 004150D3: _strlen.LIBCMT ref: 00415275

Part of subcall function 004150D3: _strlen.LIBCMT ref: 004152C8
Part of subcall function 004150D3: _strlen.LIBCMT ref: 004152F3

Part of subcall function 004150D3: _strlen.LIBCMT ref: 00415322

Part of subcall function 004150D3: _strlen.LIBCMT ref: 0041534C

Part of subcall function 0048A5E6: __EH_prolog3.LIBCMT ref: 0048A5ED

Part of subcall function 004B4C5C: __CxxThrowException@8.LIBCMT ref: 004B4C72
Part of subcall function 004B4C5C: __EH_prolog3.LIBCMT ref: 004B4C7F

Strings

BannerStyle, xrefs: 0048C158
Controls, xrefs: 0048C1CF
Name, xrefs: 0048C132
Languages, xrefs: 0048C242
Screen, xrefs: 0048C0F6
Type, xrefs: 0048C123
TemplateName, xrefs: 0048C167
Events, xrefs: 0048C1AB
OverrideProjTheme, xrefs: 0048C18D

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: _strlen$H_prolog3$Exception@8Throw
String ID: BannerStyle$Controls$Events$Languages$Name$OverrideProjTheme$Screen$TemplateName$Type
API String ID: 32230-2848213552
Opcode ID: 1a4803a54e5577d08e9a5b7fe3cef438beab834c4f31f35237efc29e5bb3b348
Instruction ID: 8945123a02e45ac0537e730ba8b8f2ea55a2cbeb62d65e47211fefc2c7d08795
Opcode Fuzzy Hash: 1a4803a54e5577d08e9a5b7fe3cef438beab834c4f31f35237efc29e5bb3b348
Instruction Fuzzy Hash: 73515270700604ABDF14BFA2CC96FAF7766AF84704F14482EB5165B2D2CA78DD44CB68

Uniqueness

Uniqueness Score: -1.00%

Function 0043C227 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 149COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0043C22E
__EH_prolog3.LIBCMT ref: 0043C2C6
__EH_prolog3.LIBCMT ref: 0043C33E
lua_settop.LUA5.1(00000000,00000000,00000000,00000000,00000000,00000008,00404284,?,?,00000010,00000000,00000000,00000000,00000000,000000B8), ref: 0043C35B
lua_getfield.LUA5.1(00000000,FFFFD8EE,_tblErrorMessages,00000000,00000000,00000000,00000000,00000000,00000008,00404284,?,?,00000010,00000000,00000000,00000000), ref: 0043C36B
lua_pushnumber.LUA5.1(00000000), ref: 0043C37A
lua_pushstring.LUA5.1(00000000,00000000), ref: 0043C3A6
lua_settable.LUA5.1(00000000,000000FD), ref: 0043C3BB
lua_settop.LUA5.1(00000000,000000FE,00000000,000000FD), ref: 0043C3C3

Strings

_tblErrorMessages, xrefs: 0043C360

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: H_prolog3$lua_settop.$lua_getfield.lua_pushnumber.lua_pushstring.lua_settable.
String ID: _tblErrorMessages
API String ID: 1535972423-1976560367
Opcode ID: 9c2edc19b31d900021f5398fb18231fba6807c1c686a60488621cf3d0cb3882f
Instruction ID: 3f372db97cb08f57c7b2e31498ebfdbc3dbcdbe9c7c39bbba98084ddc76a6b58
Opcode Fuzzy Hash: 9c2edc19b31d900021f5398fb18231fba6807c1c686a60488621cf3d0cb3882f
Instruction Fuzzy Hash: 8B51B4319005159BCB14BFA5CC92BAE7761AF54328F14825EFC25BB3D2DB38EA01C799

Uniqueness

Uniqueness Score: -1.00%

Function 0042416C Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 69libraryloaderCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00424173
LoadLibraryA.KERNEL32(?,00000010), ref: 00424189
LoadLibraryExA.KERNEL32(?,00000000,00000008), ref: 0042419B
GetLastError.KERNEL32 ref: 004241A7
GetProcAddress.KERNEL32(00000000,DllRegisterServer), ref: 004241C3
GetLastError.KERNEL32 ref: 004241CD
FreeLibrary.KERNEL32(00000000), ref: 004241DC
GetLastError.KERNEL32 ref: 00424228

Strings

DllRegisterServer, xrefs: 004241BD
Error 0x%08x: %s, xrefs: 00424210

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: ErrorLastLibrary$Load$AddressFreeH_prolog3Proc
String ID: DllRegisterServer$Error 0x%08x: %s
API String ID: 2791918730-2078401348
Opcode ID: fe21490a5083d16746194e94ca339dec9b360b6bb9569119aae99aecd7e250b7
Instruction ID: ca29723023c3009df0fcd32cf0205036390a2c6323b71ad5980b07a26fb1433d
Opcode Fuzzy Hash: fe21490a5083d16746194e94ca339dec9b360b6bb9569119aae99aecd7e250b7
Instruction Fuzzy Hash: 1421D474A04224ABCB11EFB0EC499BE7BBAFF94314F50481BF81297250DB744A41CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00496450 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 196COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00496457
GetSystemMetrics.USER32(00000006), ref: 004964F4
GetSystemMetrics.USER32(00000006), ref: 00496570
GetSystemMetrics.USER32(00000006), ref: 004965ED

Part of subcall function 00401BAB: __EH_prolog3.LIBCMT ref: 00401BB2

Part of subcall function 0043A2C6: __EH_prolog3.LIBCMT ref: 0043A2CD

Part of subcall function 004AADE0: __EH_prolog3.LIBCMT ref: 004AADE7

Part of subcall function 0041D1E5: __EH_prolog3.LIBCMT ref: 0041D1EC
Part of subcall function 0041D1E5: GetDC.USER32(?), ref: 0041D1FE
Part of subcall function 0041D1E5: ReleaseDC.USER32(?,?), ref: 0041D24B

GetSystemMetrics.USER32(00000006), ref: 0049666A

Strings

IDS_CTRL_BUTTON_CANCEL, xrefs: 004964AD
IDS_CTRL_BUTTON_NEXT, xrefs: 00496529
IDS_CTRL_BUTTON_HELP, xrefs: 00496623
IDS_CTRL_BUTTON_BACK, xrefs: 004965A6

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: H_prolog3MetricsSystem$H_prolog3_Release
String ID: IDS_CTRL_BUTTON_BACK$IDS_CTRL_BUTTON_CANCEL$IDS_CTRL_BUTTON_HELP$IDS_CTRL_BUTTON_NEXT
API String ID: 2337561883-2679619293
Opcode ID: aea3f30f620ee430f4cd490c2cef775861516a6c3cf0df4e124f3f5df823fb76
Instruction ID: dacb96f3d907ff78cd6654527cf1c10a838a91f693e4c3db82b083d2d4a040a7
Opcode Fuzzy Hash: aea3f30f620ee430f4cd490c2cef775861516a6c3cf0df4e124f3f5df823fb76
Instruction Fuzzy Hash: 81714171D10209ABDF04EFA9D942AEEBBB9AF09714F15006EF405B7281DB35AD04CB79

Uniqueness

Uniqueness Score: -1.00%

Function 00440437 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 191COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0044043E

Part of subcall function 00401BAB: __EH_prolog3.LIBCMT ref: 00401BB2

Part of subcall function 0043FE81: __EH_prolog3.LIBCMT ref: 0043FE88

Part of subcall function 004B3C8A: _malloc.LIBCMT ref: 004B3CA8

Strings

-- These actions are performed is an error occurs while the setup is uninstalling files., xrefs: 00440530
On Uninstall Error, xrefs: 00440500, 00440505, 0044053D
-- Call this function at the end after all other On Shutdown actions.-- This will cause the system to be rebooted, if needed.-- Defined in _SUF70_Global_Functions.lua-- Do not edit this script unless you know what your are doingg_HandleSystemReboot(), xrefs: 0044066B
number e_ErrorCode, string e_ErrorMsgID, xrefs: 00440557
On Startup, xrefs: 00440450, 00440455, 0044048C
On Shutdown, xrefs: 00440621, 00440626, 00440662
On Post Uninstall, xrefs: 004405C5, 004405CA, 00440609
On Pre Uninstall, xrefs: 004404A4, 004404A9, 004404E8

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: H_prolog3$_malloc
String ID: -- Call this function at the end after all other On Shutdown actions.-- This will cause the system to be rebooted, if needed.-- Defined in _SUF70_Global_Functions.lua-- Do not edit this script unless you know what your are doingg_HandleSystemReboot()$-- These actions are performed is an error occurs while the setup is uninstalling files.$On Post Uninstall$On Pre Uninstall$On Shutdown$On Startup$On Uninstall Error$number e_ErrorCode, string e_ErrorMsgID
API String ID: 1683881009-2834748795
Opcode ID: 8895d1a870984f1ff0115e0c73eab63ac1f5b8206e8e41c9ac30c498ff878175
Instruction ID: 5ee4dc75249451a88e22b05e6e2831f9c3373cd36716a81e22132418c7824edc
Opcode Fuzzy Hash: 8895d1a870984f1ff0115e0c73eab63ac1f5b8206e8e41c9ac30c498ff878175
Instruction Fuzzy Hash: 08611971D00205A6EF14EFA589926EE76B59F84714F04423FE916B72D2DF3C5A02CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 0041265B Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 159COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00412662
_strlen.LIBCMT ref: 00412698
__mbclen.LIBCMT ref: 00412757
_strlen.LIBCMT ref: 0041279D
__mbclen.LIBCMT ref: 004127AF
__fassign.LIBCMT ref: 004127BE
__fassign.LIBCMT ref: 00412773

Part of subcall function 00405435: _strnlen.LIBCMT ref: 0040544E

Strings

<&>'", xrefs: 00412673
<&>, xrefs: 0041267C

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: __fassign__mbclen_strlen$H_prolog3_strnlen
String ID: <&>$<&>'"
API String ID: 1644595256-3047967720
Opcode ID: 2eb814653d6967a6e65e73a8d62414f0a4aa7a28e0d6bc5c03392ac5c5837d2c
Instruction ID: 45206bfe4ad5b1227749fb290dde60c0ecc0ca1701281b812fef9b253ded9fd5
Opcode Fuzzy Hash: 2eb814653d6967a6e65e73a8d62414f0a4aa7a28e0d6bc5c03392ac5c5837d2c
Instruction Fuzzy Hash: DD510171C4010A8BCF24AF68DA456EFBB75BE46310F54041BE460F2291D7BC9DA7876D

Uniqueness

Uniqueness Score: -1.00%

Function 0049A27D Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 136COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0049A284

Part of subcall function 00496368: __EH_prolog3.LIBCMT ref: 0049636F

Part of subcall function 00401BAB: __EH_prolog3.LIBCMT ref: 00401BB2

Part of subcall function 0048CD71: __EH_prolog3.LIBCMT ref: 0048CD78

Part of subcall function 004014A6: _memcpy_s.LIBCMT ref: 004014F6

Strings

IDS_CTRL_STATICTEXT_BODY, xrefs: 0049A310
Please select the program features that you want to install., xrefs: 0049A299
Category%.3d, xrefs: 0049A366
IDS_CTRL_STATICTEXT_SPACEREQUIRED, xrefs: 0049A2DE
Total space required: %SpaceRequired%, xrefs: 0049A2CB
IDS_CTRL_STATICTEXT_TOPINSTRUCTIONS, xrefs: 0049A2AD
IDS_CTRL_CATEGORY_DESCRIPTION_%.3d, xrefs: 0049A3BF
IDS_CTRL_CATEGORY_NAME_%.3d, xrefs: 0049A357

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: H_prolog3$_memcpy_s
String ID: Category%.3d$IDS_CTRL_CATEGORY_DESCRIPTION_%.3d$IDS_CTRL_CATEGORY_NAME_%.3d$IDS_CTRL_STATICTEXT_BODY$IDS_CTRL_STATICTEXT_SPACEREQUIRED$IDS_CTRL_STATICTEXT_TOPINSTRUCTIONS$Please select the program features that you want to install.$Total space required: %SpaceRequired%
API String ID: 1663610674-3265531184
Opcode ID: 4b89a72568a3e44c7cc7d66b2523adec20b6c82185f28b87b13eba42f16980ff
Instruction ID: 7013d80e246c6d59c9ed0f0603be6d7f2ecc3302ca025aeb199a268cd1795471
Opcode Fuzzy Hash: 4b89a72568a3e44c7cc7d66b2523adec20b6c82185f28b87b13eba42f16980ff
Instruction Fuzzy Hash: 28415471D00209AFCF04EFA9CD53AAE7BB5AF45314F10461EF025772D2CB385A018BA9

Uniqueness

Uniqueness Score: -1.00%

Function 00482191 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 108libraryloaderCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00482198
GetFileAttributesA.KERNEL32(?,00000008,004260E8,?,00000000,00000040,0042D002,?,00000004,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 0048220C
LoadLibraryA.KERNEL32(?,?,00000000,00000040,0042D002,?,00000004,00000000,00000000,00000000,00000000,?,00000000,00000000,?,00000000), ref: 0048221A
GetProcAddress.KERNEL32(00000000,irPlg_Action_RegisterActions), ref: 0048223E
GetProcAddress.KERNEL32(00000000,irPlg_GetSDKVersion), ref: 00482249
lua_settop.LUA5.1(00000000,00000000,?,00000000,00000040,0042D002,?,00000004,00000000,00000000,00000000,00000000,?,00000000,00000000,?), ref: 00482280
FreeLibrary.KERNEL32(00000000,?,00000000,00000040,0042D002,?,00000004,00000000,00000000,00000000,00000000,?,00000000,00000000,?,00000000), ref: 004822C9

Strings

irPlg_GetSDKVersion, xrefs: 00482240
irPlg_Action_RegisterActions, xrefs: 00482238

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: AddressLibraryProc$AttributesFileFreeH_prolog3Loadlua_settop.
String ID: irPlg_Action_RegisterActions$irPlg_GetSDKVersion
API String ID: 3972953969-3379117294
Opcode ID: 9648d20a421a73487f6195061607b826dca88f536efd9a51142e199f19660cdd
Instruction ID: 60f7698ad5c936744705cd1f6c2e3e9859f774ebc44bd8c6defc04e5863b7075
Opcode Fuzzy Hash: 9648d20a421a73487f6195061607b826dca88f536efd9a51142e199f19660cdd
Instruction Fuzzy Hash: 7F411671500205DBCF10FFA4CE846AFBBB1BF40314F204A2FE52663291CBB89A41CB55

Uniqueness

Uniqueness Score: -1.00%

Function 00496368 Relevance: 15.8, APIs: 1, Strings: 8, Instructions: 69COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0049636F

Part of subcall function 0048D9F9: __EH_prolog3.LIBCMT ref: 0048DA00

Part of subcall function 00401BAB: __EH_prolog3.LIBCMT ref: 00401BB2

Part of subcall function 0048CD71: __EH_prolog3.LIBCMT ref: 0048CD78

Strings

IDS_CTRL_BUTTON_CANCEL, xrefs: 004963F8
IDS_CTRL_BUTTON_NEXT, xrefs: 00496399
IDS_CTRL_BUTTON_HELP, xrefs: 0049642B
< Back, xrefs: 004963B5
Cancel, xrefs: 004963E8
IDS_CTRL_BUTTON_BACK, xrefs: 004963C5
Next >, xrefs: 00496385
Help, xrefs: 0049641B

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: H_prolog3
String ID: < Back$Cancel$Help$IDS_CTRL_BUTTON_BACK$IDS_CTRL_BUTTON_CANCEL$IDS_CTRL_BUTTON_HELP$IDS_CTRL_BUTTON_NEXT$Next >
API String ID: 431132790-298686068
Opcode ID: 969f29a5ecc8bc231155cfd21fa1f3b2198c7f1bfc87c498c0e8f376718f5f14
Instruction ID: 15ee14df58623d4d9940f5b22fc6f43e3b37781d71e8442a90612c588c1ae9e4
Opcode Fuzzy Hash: 969f29a5ecc8bc231155cfd21fa1f3b2198c7f1bfc87c498c0e8f376718f5f14
Instruction Fuzzy Hash: D2215770A54705BBCF08BF99C95395D7EB59F46B24F20471EB025732D1CB781A018ABA

Uniqueness

Uniqueness Score: -1.00%

Function 00646590 Relevance: 15.8, APIs: 2, Strings: 7, Instructions: 65COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 006465E6
RtlInitializeCriticalSection.NTDLL(00767670), ref: 00646657

Strings

KERNEL32.DLL, xrefs: 0064660C
SHLWAPI.DLL, xrefs: 006465F0
MSCTF.DLL, xrefs: 00646644
USER32.DLL, xrefs: 0064661A
GDI32.DLL, xrefs: 00646628
COMCTL32.DLL, xrefs: 006465FE
WININET.DLL, xrefs: 00646636

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: CriticalInitializeSection_memset
String ID: COMCTL32.DLL$GDI32.DLL$KERNEL32.DLL$MSCTF.DLL$SHLWAPI.DLL$USER32.DLL$WININET.DLL
API String ID: 453477542-3335732458
Opcode ID: e7117a400a0d3b99813a4fd02da3a1a1c78a6efa2d883ce0c40b0ec455d5899e
Instruction ID: 650f7a9a6abedcde619ee26e5918c06273316d013f6f6d212b940610e05af3da
Opcode Fuzzy Hash: e7117a400a0d3b99813a4fd02da3a1a1c78a6efa2d883ce0c40b0ec455d5899e
Instruction Fuzzy Hash: 8E116071790B14ABDB55EB54DC13F6D76EBAB46F04F00810DF616AB2C1DBB83900468E

Uniqueness

Uniqueness Score: -1.00%

Function 0047C10F Relevance: 15.1, APIs: 10, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 00459443: lua_getfield.LUA5.1(?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459455
Part of subcall function 00459443: lua_pushstring.LUA5.1(?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459460
Part of subcall function 00459443: lua_gettable.LUA5.1(?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459468
Part of subcall function 00459443: lua_remove.LUA5.1(?,000000FE,?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459470
Part of subcall function 00459443: lua_type.LUA5.1(?,000000FF,?,000000FE,?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459478
Part of subcall function 00459443: lua_pcall.LUA5.1(?,00000000,00000000,00000000), ref: 0045948B
Part of subcall function 00459443: lua_remove.LUA5.1(?,000000FF), ref: 0045949A

IsWindow.USER32(00000000), ref: 0047C14F
GetWindowRect.USER32(?,?), ref: 0047C166
lua_createtable.LUA5.1(?,00000000,00000000), ref: 0047C16F
lua_pushstring.LUA5.1(?,0069937C,?,00000000,00000000), ref: 0047C17A
lua_pushnumber.LUA5.1(?,?,00000000,00000000), ref: 0047C189
lua_settable.LUA5.1(?,000000FD,?,?,00000000,00000000), ref: 0047C191
lua_pushstring.LUA5.1(?,00699378,?,000000FD,?,?,00000000,00000000), ref: 0047C19C
lua_pushnumber.LUA5.1(?,?,?,?,?,?,?,00000000,00000000), ref: 0047C1AB
lua_settable.LUA5.1(?,000000FD,?,?,?,?,?,?,?,00000000,00000000), ref: 0047C1B3
lua_pushnil.LUA5.1(?), ref: 0047C1D5

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: lua_pushstring.$Windowlua_pushnumber.lua_remove.lua_settable.$Rectlua_createtable.lua_getfield.lua_gettable.lua_pcall.lua_pushnil.lua_type.
String ID:
API String ID: 2785713775-0
Opcode ID: 7c74fcd30a2da32914f66b1cbffbd6c7df6edadee0fa8d1cc4744f2b3700b2cd
Instruction ID: f4ed8d39498f739ee9eac02e542bd623d53c035cd1c74215fbc693553a9d1710
Opcode Fuzzy Hash: 7c74fcd30a2da32914f66b1cbffbd6c7df6edadee0fa8d1cc4744f2b3700b2cd
Instruction Fuzzy Hash: F3216071808515BADB01BF6A8C46DEF7AB8EF46315F10011FF405A1193DB796B0286BA

Uniqueness

Uniqueness Score: -1.00%

Function 005DC410 Relevance: 14.4, APIs: 2, Strings: 6, Instructions: 380COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 005DC41A

Part of subcall function 005F77A3: IsBadHugeWritePtr.KERNEL32(00000000,?), ref: 005F77E1

_memset.LIBCMT ref: 005DC88B

Strings

(, xrefs: 005DC4C8
\lv, xrefs: 005DC7F0
M, xrefs: 005DC4A7
^, xrefs: 005DC502
, xrefs: 005DC8BF
B, xrefs: 005DC49A

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: H_prolog3_HugeWrite_memset
String ID: $($B$M$\lv$^
API String ID: 1514083307-1211750330
Opcode ID: 3cc05cd3c345f053c3da581f0d6819f8f803837c825c7505514331f2f10be948
Instruction ID: ebe2065a70eff08c5bec86504809b92a064ddffa36fe483375dc10a3c45fad23
Opcode Fuzzy Hash: 3cc05cd3c345f053c3da581f0d6819f8f803837c825c7505514331f2f10be948
Instruction Fuzzy Hash: 21F12CB190412A8BCF348F28CC947A9BFB5BB85305F1445DBE609A7391DB719E84CF19

Uniqueness

Uniqueness Score: -1.00%

Function 00404445 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 206COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 0040444F
_malloc.LIBCMT ref: 00404499

Part of subcall function 005B4B83: __FF_MSGBANNER.LIBCMT ref: 005B4B9C
Part of subcall function 005B4B83: __NMSG_WRITE.LIBCMT ref: 005B4BA3
Part of subcall function 005B4B83: RtlAllocateHeap.NTDLL(00000000,00000001,00000001), ref: 005B4BC8

_free.LIBCMT ref: 004044F1

Part of subcall function 004C1EF8: GetFileSize.KERNEL32(?,00000001,?,?,?,?,0040389E,EDB88320,?,00008020,00000000,00000024), ref: 004C1F09
Part of subcall function 004C1EF8: GetLastError.KERNEL32(00008DD8,?,?,?,?,0040389E,EDB88320,?,00008020,00000000,00000024), ref: 004C1F1E
Part of subcall function 004C1EF8: GetLastError.KERNEL32(?,?,?,?,?,0040389E,EDB88320,?,00008020,00000000,00000024), ref: 004C1F27

SetFileAttributesA.KERNEL32(?,00000080,?,00008020,00000000,00000000,00000084), ref: 00404515
_free.LIBCMT ref: 00404534

Part of subcall function 005B4C17: RtlFreeHeap.NTDLL(00000000,00000000,?,005C092F,00000000,?,005C4E2D,?,00000001,?,?,005C4363,00000018,00738D88,0000000C,005C43F3), ref: 005B4C2D
Part of subcall function 005B4C17: GetLastError.KERNEL32(00000000,?,005C092F,00000000,?,005C4E2D,?,00000001,?,?,005C4363,00000018,00738D88,0000000C,005C43F3,?), ref: 005B4C3F

Part of subcall function 004C1FA7: FindCloseChangeNotification.KERNEL32(?,?,00008DD8,004038C7,EDB88320,?,00008020,00000000,00000024), ref: 004C1FB8
Part of subcall function 004C1FA7: GetLastError.KERNEL32(?,?,00008DD8,004038C7,EDB88320,?,00008020,00000000,00000024), ref: 004C1FDC

Part of subcall function 004C213C: __EH_prolog3_catch_GS.LIBCMT ref: 004C2146

Part of subcall function 004278AD: __EH_prolog3.LIBCMT ref: 004278B4

Strings

INSTALL_STAGE_INSTALLING_FILES, xrefs: 0040468A

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: ErrorLast$FileHeap_free$AllocateAttributesChangeCloseFindFreeH_prolog3H_prolog3_catchH_prolog3_catch_NotificationSize_malloc
String ID: INSTALL_STAGE_INSTALLING_FILES
API String ID: 2178687078-3727005748
Opcode ID: 3f080b6ba11eba8dd17cb64c249b1465a0a373d1d6e90dbb3ee94ad0acd6a9f3
Instruction ID: f288ca90aa31a7394a7700207a16a75297dd20f140c9c7a058658ba951c4de41
Opcode Fuzzy Hash: 3f080b6ba11eba8dd17cb64c249b1465a0a373d1d6e90dbb3ee94ad0acd6a9f3
Instruction Fuzzy Hash: D4815970D00219EBCF14EFA5C991AEDBBB1BF49314F20816EE525B3292EB785A44CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0041C491 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 125COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0041C498

Part of subcall function 00401BAB: __EH_prolog3.LIBCMT ref: 00401BB2

Part of subcall function 004410F9: __EH_prolog3.LIBCMT ref: 00441100

Strings

FontDesc, xrefs: 0041C5B5
File, xrefs: 0041C49F
UnregisterCOM, xrefs: 0041C54D
BackupFile, xrefs: 0041C5E9
UnregisterFont, xrefs: 0041C581
DecrementUsageCount, xrefs: 0041C519
Filename, xrefs: 0041C4E6

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: H_prolog3
String ID: BackupFile$DecrementUsageCount$File$Filename$FontDesc$UnregisterCOM$UnregisterFont
API String ID: 431132790-3749589439
Opcode ID: 5cb8527918d772ac1ae0efbb5a872338a0c4fd5140d61a6e8293b8928bf43b19
Instruction ID: 9d263249d14f005a7befdbe2ec71271420f83eb7f3aabcd341a4de16a3814c01
Opcode Fuzzy Hash: 5cb8527918d772ac1ae0efbb5a872338a0c4fd5140d61a6e8293b8928bf43b19
Instruction Fuzzy Hash: 4A41AFB2800508ABDB04EFA1DD929FD7778EF11324F60436EB436A71E1EB746B488795

Uniqueness

Uniqueness Score: -1.00%

Function 0041C326 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 105COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0041C32D

Part of subcall function 004150D3: __EH_prolog3.LIBCMT ref: 004150DA

Part of subcall function 00401BAB: __EH_prolog3.LIBCMT ref: 00401BB2

Part of subcall function 004414FE: __EH_prolog3.LIBCMT ref: 00441505

Strings

FontDesc, xrefs: 0041C41A
File, xrefs: 0041C33E
UnregisterCOM, xrefs: 0041C3B6
BackupFile, xrefs: 0041C44D
UnregisterFont, xrefs: 0041C3E8
DecrementUsageCount, xrefs: 0041C384
Filename, xrefs: 0041C351

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: H_prolog3
String ID: BackupFile$DecrementUsageCount$File$Filename$FontDesc$UnregisterCOM$UnregisterFont
API String ID: 431132790-3749589439
Opcode ID: 7539b8cbffacafb98a22847d250950b45e5a82240905a9fdc9c189d610be773a
Instruction ID: 3f72acdb672835a07ae89cdfb03212aedbf373820b14fc6704ee29c0b555f672
Opcode Fuzzy Hash: 7539b8cbffacafb98a22847d250950b45e5a82240905a9fdc9c189d610be773a
Instruction Fuzzy Hash: 664195B1900108EBDB04EFA5CD92EEE7779EF50318F10452EB525672E2DB786748C798

Uniqueness

Uniqueness Score: -1.00%

Function 0045A33B Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 92COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0045A342

Part of subcall function 00459443: lua_getfield.LUA5.1(?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459455
Part of subcall function 00459443: lua_pushstring.LUA5.1(?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459460
Part of subcall function 00459443: lua_gettable.LUA5.1(?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459468
Part of subcall function 00459443: lua_remove.LUA5.1(?,000000FE,?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459470
Part of subcall function 00459443: lua_type.LUA5.1(?,000000FF,?,000000FE,?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459478
Part of subcall function 00459443: lua_pcall.LUA5.1(?,00000000,00000000,00000000), ref: 0045948B
Part of subcall function 00459443: lua_remove.LUA5.1(?,000000FF), ref: 0045949A

Part of subcall function 004597A0: __EH_prolog3.LIBCMT ref: 004597A7
Part of subcall function 004597A0: lua_gettop.LUA5.1(?,00000000,00000000,00000008,004076D1,?,00000002,?), ref: 004597D3

Part of subcall function 00459852: __EH_prolog3.LIBCMT ref: 00459859
Part of subcall function 00459852: lua_tolstring.LUA5.1(?,?,00000000,00000000,00000000,0000000C,004082AF,?,00000002,?,00000001,?,00000002), ref: 0045988A

Part of subcall function 00401BAB: __EH_prolog3.LIBCMT ref: 00401BB2

Part of subcall function 00459710: __EH_prolog3.LIBCMT ref: 00459717

GetFileAttributesA.KERNEL32(?), ref: 0045A3B2
lua_getfield.LUA5.1(?,FFFFD8EE,dofile), ref: 0045A3CF
lua_type.LUA5.1(?,000000FF,?,FFFFD8EE,dofile), ref: 0045A3D7
lua_pushstring.LUA5.1(?,?), ref: 0045A3E8
lua_pcall.LUA5.1(?,00000001,00000000,00000000,?,?), ref: 0045A3F4

Strings

dofile, xrefs: 0045A3C4

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: H_prolog3$lua_getfield.lua_pcall.lua_pushstring.lua_remove.lua_type.$AttributesFilelua_gettable.lua_gettop.lua_tolstring.
String ID: dofile
API String ID: 1843175922-2485052799
Opcode ID: b39950976c1a19d1b5cd1c175ad07a9c61bbffb7debacc19bc1e0ed5fb0ba619
Instruction ID: 0a65f4c66ae19f5b5882bc3f81d4754bf9e2002989c93603c923f483c7c726e5
Opcode Fuzzy Hash: b39950976c1a19d1b5cd1c175ad07a9c61bbffb7debacc19bc1e0ed5fb0ba619
Instruction Fuzzy Hash: F321B631818511A6DB15A7A9DC46FEE36249F1232EF60031FF421B62D3DF7C6A1582AE

Uniqueness

Uniqueness Score: -1.00%

Function 004A2315 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 59COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004A231C

Part of subcall function 00401BAB: __EH_prolog3.LIBCMT ref: 00401BB2

Strings

Insert your text here..., xrefs: 004A2386
Option, xrefs: 004A237F
Your text goes here., xrefs: 004A238D
Button %.2d, xrefs: 004A239A
GroupBox, xrefs: 004A236B
Button, xrefs: 004A23AA
Option %.2d, xrefs: 004A2378

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: H_prolog3
String ID: Button$Button %.2d$GroupBox$Insert your text here...$Option$Option %.2d$Your text goes here.
API String ID: 431132790-2605563474
Opcode ID: 8251b2babbee11e7f2369678ad3dbb68e729c6a684f0d1c8b9071e0d7146f9e3
Instruction ID: e0603779bd5550da5164d39b48d0ed04ce2771eda240f7afc5deedcd14d07fd1
Opcode Fuzzy Hash: 8251b2babbee11e7f2369678ad3dbb68e729c6a684f0d1c8b9071e0d7146f9e3
Instruction Fuzzy Hash: A501C620240705AACF14AE3C8E4AB7E26A2FB73350F914117AC05662DACBFD9C00AB1D

Uniqueness

Uniqueness Score: -1.00%

Function 0047C07F Relevance: 14.0, APIs: 1, Strings: 7, Instructions: 35COMMON

Download Yara Rule

APIs

luaL_openlib.LUA5.1(00000005,UninstallData,00000005,00000000), ref: 0047C0F9

Strings

GetConfigurationFile, xrefs: 0047C0B3
AddItem, xrefs: 0047C0A5
GetItem, xrefs: 0047C0CF
UninstallData, xrefs: 0047C09F
SetConfigurationFile, xrefs: 0047C0C1
GetItemList, xrefs: 0047C0DD
RemoveItem, xrefs: 0047C0EB

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: L_openlib.
String ID: AddItem$GetConfigurationFile$GetItem$GetItemList$RemoveItem$SetConfigurationFile$UninstallData
API String ID: 3969157368-271183543
Opcode ID: 62edbdbb42dab6a155e021b74246dc72a6b1ce1cc67482e36e4bd1decde3074f
Instruction ID: 6e0edccd8660a2da1ed03675fa6f6f88dc6d9ced741e864bbbbf9b88a24124ba
Opcode Fuzzy Hash: 62edbdbb42dab6a155e021b74246dc72a6b1ce1cc67482e36e4bd1decde3074f
Instruction Fuzzy Hash: 4801E5B0D00208AB8B04EFA9D84A5DEBFF1FB09308F50805EE2257B240D7B45A088F98

Uniqueness

Uniqueness Score: -1.00%

Function 004703A7 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 242sleepCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 004703B1

Part of subcall function 00459443: lua_getfield.LUA5.1(?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459455
Part of subcall function 00459443: lua_pushstring.LUA5.1(?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459460
Part of subcall function 00459443: lua_gettable.LUA5.1(?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459468
Part of subcall function 00459443: lua_remove.LUA5.1(?,000000FE,?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459470
Part of subcall function 00459443: lua_type.LUA5.1(?,000000FF,?,000000FE,?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459478
Part of subcall function 00459443: lua_pcall.LUA5.1(?,00000000,00000000,00000000), ref: 0045948B
Part of subcall function 00459443: lua_remove.LUA5.1(?,000000FF), ref: 0045949A

Part of subcall function 004597A0: __EH_prolog3.LIBCMT ref: 004597A7
Part of subcall function 004597A0: lua_gettop.LUA5.1(?,00000000,00000000,00000008,004076D1,?,00000002,?), ref: 004597D3

Part of subcall function 00459852: __EH_prolog3.LIBCMT ref: 00459859
Part of subcall function 00459852: lua_tolstring.LUA5.1(?,?,00000000,00000000,00000000,0000000C,004082AF,?,00000002,?,00000001,?,00000002), ref: 0045988A

Part of subcall function 00401BAB: __EH_prolog3.LIBCMT ref: 00401BB2

lua_type.LUA5.1(?,00000002), ref: 004703F7
lua_type.LUA5.1(?,00000002), ref: 00470406
lua_type.LUA5.1(?,00000003), ref: 0047042C
lua_type.LUA5.1(?,00000003), ref: 0047043A
Sleep.KERNEL32(000003E8,0000003B,00000003,?,?,?,?,?,?,?,?,?,?,?,?,00000084), ref: 004705BF

Part of subcall function 004019B2: _strlen.LIBCMT ref: 004019C2

Part of subcall function 00446890: __EH_prolog3.LIBCMT ref: 00446897

Strings

M, xrefs: 004705E5

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: lua_type.$H_prolog3$lua_remove.$H_prolog3_Sleep_strlenlua_getfield.lua_gettable.lua_gettop.lua_pcall.lua_pushstring.lua_tolstring.
String ID: M
API String ID: 3614587214-2059362058
Opcode ID: be471aeb53e839bf58b28c02aaabb37e928137aed570015a3240e1497b296c42
Instruction ID: 3728695d9d4962ceb0212351466967377c2e6ed9461044f03b86475cd974f2c3
Opcode Fuzzy Hash: be471aeb53e839bf58b28c02aaabb37e928137aed570015a3240e1497b296c42
Instruction Fuzzy Hash: C581D771801218EEDF14EBB5C842BEEB778AF11318F14415FF419B62C2DB786A48CB69

Uniqueness

Uniqueness Score: -1.00%

Function 004981EA Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 184COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004981F1

Part of subcall function 00401BAB: __EH_prolog3.LIBCMT ref: 00401BB2

Strings

Variable, xrefs: 004983D6
NumRadioButtons, xrefs: 00498229
Cols, xrefs: 004982E9
DefaultSelection, xrefs: 00498387
Distribute, xrefs: 00498338
Radio%d, xrefs: 00498276

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: H_prolog3
String ID: Cols$DefaultSelection$Distribute$NumRadioButtons$Radio%d$Variable
API String ID: 431132790-4095165351
Opcode ID: c2b6eddaed5b3fd182b27a59a6a3f0fc59147641230c457f8cfdbaeaee5fcdf1
Instruction ID: 85caaae517219542ab53a5fe66aa14c2fa75bc984cc2780cd67df8686c3d7064
Opcode Fuzzy Hash: c2b6eddaed5b3fd182b27a59a6a3f0fc59147641230c457f8cfdbaeaee5fcdf1
Instruction Fuzzy Hash: 0F615FB09007059FCB28EF69C4915AEBBF5BF09704700866FF45A97391DB38A984CF99

Uniqueness

Uniqueness Score: -1.00%

Function 004C8391 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 182COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 004C839B
_memset.LIBCMT ref: 004C8409
GetVersionExA.KERNEL32(?), ref: 004C841E
_malloc.LIBCMT ref: 004C845C
_memset.LIBCMT ref: 004C8479
__cftof.LIBCMT ref: 004C8549

Strings

X, xrefs: 004C844C

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: _memset$H_prolog3_Version__cftof_malloc
String ID: X
API String ID: 3881372888-3081909835
Opcode ID: 5c1f342bd38fab7305d6dd29c7af67285cbc6aa16d3a4a553cd85e6c80ce766c
Instruction ID: 3dddf3ba3365c053c1b5bd02feaf2b7d22c48abfa59a57b36f1d42efd80d5f59
Opcode Fuzzy Hash: 5c1f342bd38fab7305d6dd29c7af67285cbc6aa16d3a4a553cd85e6c80ce766c
Instruction Fuzzy Hash: 058156B4A007059FDB60DF64C980F9ABBE5BF49304F0048AEE69E97342DB74A941CF16

Uniqueness

Uniqueness Score: -1.00%

Function 0045A0A4 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 124windowtimeCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0045A0AB

Part of subcall function 00459443: lua_getfield.LUA5.1(?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459455
Part of subcall function 00459443: lua_pushstring.LUA5.1(?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459460
Part of subcall function 00459443: lua_gettable.LUA5.1(?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459468
Part of subcall function 00459443: lua_remove.LUA5.1(?,000000FE,?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459470
Part of subcall function 00459443: lua_type.LUA5.1(?,000000FF,?,000000FE,?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459478
Part of subcall function 00459443: lua_pcall.LUA5.1(?,00000000,00000000,00000000), ref: 0045948B
Part of subcall function 00459443: lua_remove.LUA5.1(?,000000FF), ref: 0045949A

Part of subcall function 004597A0: __EH_prolog3.LIBCMT ref: 004597A7
Part of subcall function 004597A0: lua_gettop.LUA5.1(?,00000000,00000000,00000008,004076D1,?,00000002,?), ref: 004597D3

timeGetTime.WINMM ref: 0045A0D9
PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 0045A0FB
TranslateMessage.USER32(?), ref: 0045A225
DispatchMessageA.USER32(?), ref: 0045A22F
timeGetTime.WINMM ref: 0045A246

Strings

MSG: %d, xrefs: 0045A210

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: Message$H_prolog3Timelua_remove.time$DispatchPeekTranslatelua_getfield.lua_gettable.lua_gettop.lua_pcall.lua_pushstring.lua_type.
String ID: MSG: %d
API String ID: 1650870568-2058940224
Opcode ID: 8377b9616bc8ecf7fb28a6b99add2d4c68e117aa9bb805eacfc2246317fdf117
Instruction ID: 5e28e8bea970431b4f222c984526150a1f58ec6e66eb35009a1e11399dbb2ab5
Opcode Fuzzy Hash: 8377b9616bc8ecf7fb28a6b99add2d4c68e117aa9bb805eacfc2246317fdf117
Instruction Fuzzy Hash: B841A93090530A96DF265B54C88A7AF3E74EB46301F1C4767F810E27A2CA3E8D68C64B

Uniqueness

Uniqueness Score: -1.00%

Function 00492382 Relevance: 12.3, APIs: 1, Strings: 6, Instructions: 83COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00492389

Strings

IDS_CTRL_BUTTON_%.2d, xrefs: 004923EB
IDS_CTRL_STATICTEXT_LABEL_%.2d, xrefs: 004923B0
%%EditVar%.2d%%, xrefs: 00492445
IDS_CTRL_EDIT_MASK_PLACE_HOLDER_%.2d, xrefs: 00492427
IDS_CTRL_EDIT_MASK_%.2d, xrefs: 00492409
IDS_CTRL_EDIT_%.2d, xrefs: 004923CE

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: H_prolog3
String ID: %%EditVar%.2d%%$IDS_CTRL_BUTTON_%.2d$IDS_CTRL_EDIT_%.2d$IDS_CTRL_EDIT_MASK_%.2d$IDS_CTRL_EDIT_MASK_PLACE_HOLDER_%.2d$IDS_CTRL_STATICTEXT_LABEL_%.2d
API String ID: 431132790-342798587
Opcode ID: ed74339dc557093fbc1c58841f77c1b7b47cad2cb26f3884eff4e7165c7ef69b
Instruction ID: b210f4999fd141844df9ad3d887634f0ebef1f13d69b89acee0fc50b7c318d34
Opcode Fuzzy Hash: ed74339dc557093fbc1c58841f77c1b7b47cad2cb26f3884eff4e7165c7ef69b
Instruction Fuzzy Hash: BA2125F2801119AAC710EBB1DD56DEF73BCBF54704B44492EB912F20D1EA746A04CA68

Uniqueness

Uniqueness Score: -1.00%

Function 0042423A Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 76registrystringCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00424244
_memset.LIBCMT ref: 00424285
lstrlen.KERNEL32(?,?,00000104), ref: 0042429A
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000), ref: 004242A4
LoadTypeLib.OLEAUT32(?,?), ref: 004242B8
RegisterTypeLib.OLEAUT32(?,?,00000000), ref: 004242E1

Part of subcall function 00423B3A: FormatMessageA.KERNEL32(00001300,00000000,?,00000400,?,00000000,00000000), ref: 00423B5D
Part of subcall function 00423B3A: lstrlen.KERNEL32(00000000), ref: 00423B6A

Part of subcall function 00423A80: LocalFree.KERNEL32(?), ref: 00423A9E

Strings

Error 0x%08x: %s, xrefs: 00424321

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: Typelstrlen$ByteCharFormatFreeH_prolog3_LoadLocalMessageMultiRegisterWide_memset
String ID: Error 0x%08x: %s
API String ID: 3982301635-3892005284
Opcode ID: 44c337775908e7dc423fff0d56c7b922ef8cffcc36339a877f08d69d126a9958
Instruction ID: b61ab12b42b790a9f86b86eaf4957fe074c00d48a3ddd94d2c91edb3d763ca65
Opcode Fuzzy Hash: 44c337775908e7dc423fff0d56c7b922ef8cffcc36339a877f08d69d126a9958
Instruction Fuzzy Hash: 90313AB1941229ABCB209F90EC8DADEBBB8EF18304F5405EAE409A2251D7745E84CF54

Uniqueness

Uniqueness Score: -1.00%

Function 004A61E6 Relevance: 12.2, APIs: 8, Instructions: 158windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(?), ref: 004A6205
SendMessageA.USER32(?,00000184,00000000,00000000), ref: 004A623B
SendMessageA.USER32(?,00000181,00000000,00000000), ref: 004A6294
SendMessageA.USER32(?,0000019A,00000000,?), ref: 004A62C9
SendMessageA.USER32(?,00000186,00000000,00000000), ref: 004A62E3
SendMessageA.USER32(?,00000181,0045F337,00000000), ref: 004A6328
SendMessageA.USER32(?,0000019A,0045F337,?), ref: 004A635D
SendMessageA.USER32(?,00000186,0045F337,00000000), ref: 004A6387

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: MessageSend$Window
String ID:
API String ID: 2326795674-0
Opcode ID: 274a9ee84c72baccb27ac6c9c238e4b32c94d44941ec9e085fade49059733933
Instruction ID: b0fe18b823ab303c5591bd89f0bc0afbe9f98c28baf84205656f86f8c2cd5308
Opcode Fuzzy Hash: 274a9ee84c72baccb27ac6c9c238e4b32c94d44941ec9e085fade49059733933
Instruction Fuzzy Hash: 9E519076500604EFCF11DF94C880DAABBB5FF29300B1984AEEA468B661C735ED42DF54

Uniqueness

Uniqueness Score: -1.00%

Function 004CA34D Relevance: 12.1, APIs: 8, Instructions: 96COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 004CA357
GlobalDeleteAtom.KERNEL32(?), ref: 004CA402
GlobalDeleteAtom.KERNEL32(?), ref: 004CA415
_free.LIBCMT ref: 004CA447
_free.LIBCMT ref: 004CA44F
_free.LIBCMT ref: 004CA457
_free.LIBCMT ref: 004CA45F
_free.LIBCMT ref: 004CA467

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: _free$AtomDeleteGlobal$H_prolog3_catch_
String ID:
API String ID: 1844215989-0
Opcode ID: 3b2f031b4351e73a8d5f33d45e904f7a1f5ab55102efb6eff2c15b7db513f175
Instruction ID: cb549522318e155badbb5dfcc42aad4166856f29494f6d212789417360852530
Opcode Fuzzy Hash: 3b2f031b4351e73a8d5f33d45e904f7a1f5ab55102efb6eff2c15b7db513f175
Instruction Fuzzy Hash: 75319134601745CFCB64EFA4C899F69BBE1BF00708F50846EE5868B7A2C774AC40CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00448396 Relevance: 12.1, APIs: 8, Instructions: 54COMMON

Download Yara Rule

APIs

DestroyCursor.USER32(?), ref: 004483B4
DestroyCursor.USER32(?), ref: 004483C1
DeleteObject.GDI32(?), ref: 004483D4
DeleteObject.GDI32(?), ref: 004483E1
DeleteObject.GDI32(?), ref: 004483EE
DeleteObject.GDI32(?), ref: 004483FB
_memset.LIBCMT ref: 00448409
_memset.LIBCMT ref: 00448419

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: DeleteObject$CursorDestroy_memset
String ID:
API String ID: 2159749563-0
Opcode ID: 1bb1de66b6d37195813c383603afc1c77882aafae92278e93ef9fd055431e131
Instruction ID: 4455f773275f34f58b88064a1529c11f0887643089591b20b5fafbf9d45d875a
Opcode Fuzzy Hash: 1bb1de66b6d37195813c383603afc1c77882aafae92278e93ef9fd055431e131
Instruction Fuzzy Hash: 51012571B1170557E730AE799C88F5BB3DC9F50B40F05441EBA48E7251DF79F8008AA8

Uniqueness

Uniqueness Score: -1.00%

Function 00496008 Relevance: 10.8, APIs: 1, Strings: 5, Instructions: 261COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0049600F

Part of subcall function 00401BAB: __EH_prolog3.LIBCMT ref: 00401BB2

Part of subcall function 0048BA06: __EH_prolog3.LIBCMT ref: 0048BA0D

Part of subcall function 004014A6: _memcpy_s.LIBCMT ref: 004014F6

Part of subcall function 0048B96F: __EH_prolog3.LIBCMT ref: 0048B976

Strings

On Back, xrefs: 0049610B
On Cancel, xrefs: 004961E3
On Next, xrefs: 0049603D
On Help, xrefs: 004962B4
%s > %s, xrefs: 0049601D, 0049607E, 0049614F, 00496220, 004962F1

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: H_prolog3$_memcpy_s
String ID: %s > %s$On Back$On Cancel$On Help$On Next
API String ID: 1663610674-3527549260
Opcode ID: ba143049ff5af49460881d440a0271e0fc8bc2a27808e443e547b7db3bc7ab0d
Instruction ID: 47a24a1f48d4ca565934e98a27982a5d4551e5fca717ae475fae92cff2397d4a
Opcode Fuzzy Hash: ba143049ff5af49460881d440a0271e0fc8bc2a27808e443e547b7db3bc7ab0d
Instruction Fuzzy Hash: 71A13170D00205DFCF05EFA9C946AAEBBF5AF45314F15815EF015B7292CB389A01CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 004201D2 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 215COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004201D9
GetFileAttributesA.KERNEL32(00000010,00000050), ref: 00420210
_strlen.LIBCMT ref: 0042028D

Strings

SUF70UninstallData, xrefs: 0042040F, 00420461
<?xml version="1.0" encoding="iso-8859-1"?>, xrefs: 00420276, 0042038A

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: AttributesFileH_prolog3_strlen
String ID: <?xml version="1.0" encoding="iso-8859-1"?>$SUF70UninstallData
API String ID: 1171970428-2376748235
Opcode ID: b8d63bfc34991b982de0a0c44c81630ce97c7cfdd553662d83f1e975649b7fff
Instruction ID: d2ce1658b384c1ef4d0bb94c9eb3cb7675d1d685cfd0ac3030ce9c46e2f8cf0a
Opcode Fuzzy Hash: b8d63bfc34991b982de0a0c44c81630ce97c7cfdd553662d83f1e975649b7fff
Instruction Fuzzy Hash: 19817E70D00215DFCF04EF99D982AAEBBB8AF15318F60415FF511BB292CB785A05CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00402091 Relevance: 10.7, APIs: 7, Instructions: 168windowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 004020D2
SetWindowLongA.USER32(?,000000F4,00000000), ref: 00402103
SendMessageA.USER32(?,00000030,?,00000001), ref: 0040214D
GetWindowRect.USER32(?,?), ref: 004021BA
GetWindowRect.USER32(?,?), ref: 004021D2
GetWindowRect.USER32(?,?), ref: 00402229
SendMessageA.USER32(?,0000014D,000000FF,?), ref: 004022BA

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: Window$Rect$MessageSend$Long
String ID:
API String ID: 697563133-0
Opcode ID: 08c74334025398f98fc756bc4da5b4ca972b68ec10d6d31942000fa0231e5e7a
Instruction ID: 0120dead2877fc41f7accc9b6d902dd8213874ad2ae073c59d5e88aabdc86e6d
Opcode Fuzzy Hash: 08c74334025398f98fc756bc4da5b4ca972b68ec10d6d31942000fa0231e5e7a
Instruction Fuzzy Hash: 69514E71900209AFDF11DFA5CD84EEEBBBAEF89304F14017EE905BB291CA785900CB65

Uniqueness

Uniqueness Score: -1.00%

Function 004100FF Relevance: 10.6, APIs: 7, Instructions: 148COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00410109

Part of subcall function 004B7D9A: __EH_prolog3.LIBCMT ref: 004B7DA1
Part of subcall function 004B7D9A: BeginPaint.USER32(?,?,00000004,0041011F,?,00000084), ref: 004B7DCD

GetClientRect.USER32(?,?), ref: 00410174
CreatePen.GDI32(00000000,00000001,00776F70), ref: 0041018A
CreateSolidBrush.GDI32(00776F70), ref: 0041019F
CreatePen.GDI32(00000000,00000001,3FE00000), ref: 004101B9
CreateSolidBrush.GDI32(3FE00000), ref: 004101CE

Part of subcall function 004025A1: __EH_prolog3_catch_GS.LIBCMT ref: 004025AB

Part of subcall function 004B7DEE: __EH_prolog3.LIBCMT ref: 004B7DF5
Part of subcall function 004B7DEE: EndPaint.USER32(?,?,00000004,0041030E), ref: 004B7E10

Rectangle.GDI32(?,?,?,?,?), ref: 00410212

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: Create$BrushH_prolog3PaintSolid$BeginClientH_prolog3_H_prolog3_catch_RectRectangle
String ID:
API String ID: 1340467278-0
Opcode ID: 2f970d49804d0f2d9b82e4f76802c049c79622c6e07c8134b58e82e836740fcd
Instruction ID: 9240ddd567951efe90ab1f9f67ca9fa23bed348a00c53c9715a8afbc30e7a201
Opcode Fuzzy Hash: 2f970d49804d0f2d9b82e4f76802c049c79622c6e07c8134b58e82e836740fcd
Instruction Fuzzy Hash: DA513971C00609EFCF25DFA1C985AEEBB79BF08304F10416EE546A3152DB796A84CF64

Uniqueness

Uniqueness Score: -1.00%

Function 00474261 Relevance: 10.6, APIs: 7, Instructions: 147COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00474268

Part of subcall function 004B3C8A: _malloc.LIBCMT ref: 004B3CA8

GetSystemMetrics.USER32(00000000), ref: 004742EB
GetSystemMetrics.USER32(00000001), ref: 004742F1
IsWindow.USER32(?), ref: 00474307
GetWindowRect.USER32(?,?), ref: 0047431D
IsWindow.USER32(?), ref: 004743D0
GetWindowRect.USER32(?,?), ref: 004743F8

Part of subcall function 004867EC: __EH_prolog3.LIBCMT ref: 004867F3

Part of subcall function 004B890D: MoveWindow.USER32(?,?,?,?,?,?), ref: 004B892A

Part of subcall function 00486A47: GetWindowRect.USER32(?,?), ref: 00486AF0
Part of subcall function 00486A47: GetWindowRect.USER32(?,?), ref: 00486AFC
Part of subcall function 00486A47: GetWindowRect.USER32(?,?), ref: 00486B60

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: Window$Rect$MetricsSystem$H_prolog3H_prolog3_Move_malloc
String ID:
API String ID: 2691773604-0
Opcode ID: 3ea4f64a5ff61e3f6450aa7714be0298217594152a65b21ce1af16fc8c65d8d0
Instruction ID: b289f60b02ab36f1928b2c7e43761c1ff051663f21ed5bb26d7733e51c099dae
Opcode Fuzzy Hash: 3ea4f64a5ff61e3f6450aa7714be0298217594152a65b21ce1af16fc8c65d8d0
Instruction Fuzzy Hash: FD515275A001168FCB04DFB9CE49AAD7BF9FF48314B05816AF409E7262CB78A900CB55

Uniqueness

Uniqueness Score: -1.00%

Function 00422531 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 147COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00422538

Strings

UninstallShortcuts, xrefs: 004225C1, 004226B3
UninstallFiles, xrefs: 0042259C, 0042268D
SessionVars, xrefs: 004225E3, 004226D5
UninstallSupportFiles, xrefs: 004225B0, 004226A2
UninstallFolders, xrefs: 004225D2, 004226C4

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: H_prolog3
String ID: SessionVars$UninstallFiles$UninstallFolders$UninstallShortcuts$UninstallSupportFiles
API String ID: 431132790-292530861
Opcode ID: d76fd0b77baf14a35d53ac08aaf1fa682d20ec9077a28fb0a54e9fef29abb02f
Instruction ID: 6d32717a054c24e4ef4673ecc6a00d520509ccbcb52cac7a29e747435e1278c8
Opcode Fuzzy Hash: d76fd0b77baf14a35d53ac08aaf1fa682d20ec9077a28fb0a54e9fef29abb02f
Instruction Fuzzy Hash: C151C630A00216DFCB14EFB6DE52ABE7764BF50314F80412FA456B76D2DBB89A04CB59

Uniqueness

Uniqueness Score: -1.00%

Function 004D24B7 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 139windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,0000019F,00000000,00000000), ref: 004D24DF
GetParent.USER32(?), ref: 004D24E6

Part of subcall function 004B87F6: GetWindowLongA.USER32(?,000000F0), ref: 004B8801

SendMessageA.USER32(?,00000187,00000000,00000000), ref: 004D2539
SendMessageA.USER32(?,00000111,?,00000020), ref: 004D2591
SendMessageA.USER32(?,00000185,00000000,00000000), ref: 004D25AA

Strings

, xrefs: 004D24BE

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: MessageSend$LongParentWindow
String ID:
API String ID: 779260966-3916222277
Opcode ID: 481990ea00b59ab6e7a87d96e3789037ce12d78297dd64b0d7abc94371ce46d7
Instruction ID: b4df82db4cceea64747491b60be2f090e90925a56d3d478974975c23d41f468c
Opcode Fuzzy Hash: 481990ea00b59ab6e7a87d96e3789037ce12d78297dd64b0d7abc94371ce46d7
Instruction Fuzzy Hash: EF41D170600314BBDB256B368DA6EAF3AA9FF44744F10441FF546D63A0DA78ED408BA8

Uniqueness

Uniqueness Score: -1.00%

Function 00484584 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 135COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0048458B

Part of subcall function 00401BAB: __EH_prolog3.LIBCMT ref: 00401BB2

Strings

Source ends with a slash, xrefs: 00484623
Source contains invalid character, xrefs: 004846EE
Source was less than 4 characters, xrefs: 004845DE
Source did not have drive specifier, xrefs: 0048467F
Source was empty, xrefs: 004845BB

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: H_prolog3
String ID: Source contains invalid character$Source did not have drive specifier$Source ends with a slash$Source was empty$Source was less than 4 characters
API String ID: 431132790-1937954483
Opcode ID: aa81d45f7b769ec40afb4cd3830f932018c7e4189e5f5c4d1cfffda82d519daf
Instruction ID: 0ec57f67d38fa25329bf7ceb843e8e42149d94793dc069b18d3ac5c1932bd0eb
Opcode Fuzzy Hash: aa81d45f7b769ec40afb4cd3830f932018c7e4189e5f5c4d1cfffda82d519daf
Instruction Fuzzy Hash: 4B41D770A01206ABCB04FB64C996A7EB7B4FF51318F10462EF121B72D1DB786E00C79A

Uniqueness

Uniqueness Score: -1.00%

Function 0042A0D2 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 107fileCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0042A0D9

Part of subcall function 00401BAB: __EH_prolog3.LIBCMT ref: 00401BB2

Part of subcall function 0040C578: lua_getfield.LUA5.1(0000C259,FFFFD8EE,?,80000000,?,?,00403F08,?), ref: 0040C58C
Part of subcall function 0040C578: lua_isnumber.LUA5.1(0000C259,000000FF,0000C259,FFFFD8EE,?,80000000,?,?,00403F08,?), ref: 0040C596
Part of subcall function 0040C578: lua_tonumber.LUA5.1(0000C259,000000FF), ref: 0040C5A7
Part of subcall function 0040C578: lua_remove.LUA5.1(0000C259,000000FF), ref: 0040C5BA

SetFileAttributesA.KERNEL32(00000010,00000080,?,00000020,0042D4B5,00000000,?,00000000,00000000,?,?,00000004,00000000,00000000,00000000,00000000), ref: 0042A150
DeleteFileA.KERNEL32(00000010,?,00000020,0042D4B5,00000000,?,00000000,00000000,?,?,00000004,00000000,00000000,00000000,00000000), ref: 0042A157

Part of subcall function 004B4C5C: __CxxThrowException@8.LIBCMT ref: 004B4C72
Part of subcall function 004B4C5C: __EH_prolog3.LIBCMT ref: 004B4C7F

Strings

Remove shortcut: , xrefs: 0042A163
UNINSTALL_STAGE_REMOVING_SHORTCUTS, xrefs: 0042A0F4

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: H_prolog3$File$AttributesDeleteException@8Throwlua_getfield.lua_isnumber.lua_remove.lua_tonumber.
String ID: Remove shortcut: $UNINSTALL_STAGE_REMOVING_SHORTCUTS
API String ID: 676444499-2030364576
Opcode ID: 2c96ed7e59a8f75f11db71ae13eeef63634ca29e69d73cebd492881230dfbde1
Instruction ID: a1811789827066c816a6d5269dffc9e828bb3a3098a0a3f492b5cf1cc4e27eab
Opcode Fuzzy Hash: 2c96ed7e59a8f75f11db71ae13eeef63634ca29e69d73cebd492881230dfbde1
Instruction Fuzzy Hash: 4A416171D002099FCB04EFA9DC85AAE7BB9FF48324F54416EF411B72A2CB385911CB69

Uniqueness

Uniqueness Score: -1.00%

Function 0046C461 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 102libraryloaderCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0046C468

Part of subcall function 00459443: lua_getfield.LUA5.1(?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459455
Part of subcall function 00459443: lua_pushstring.LUA5.1(?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459460
Part of subcall function 00459443: lua_gettable.LUA5.1(?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459468
Part of subcall function 00459443: lua_remove.LUA5.1(?,000000FE,?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459470
Part of subcall function 00459443: lua_type.LUA5.1(?,000000FF,?,000000FE,?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459478
Part of subcall function 00459443: lua_pcall.LUA5.1(?,00000000,00000000,00000000), ref: 0045948B
Part of subcall function 00459443: lua_remove.LUA5.1(?,000000FF), ref: 0045949A

Part of subcall function 004597A0: __EH_prolog3.LIBCMT ref: 004597A7
Part of subcall function 004597A0: lua_gettop.LUA5.1(?,00000000,00000000,00000008,004076D1,?,00000002,?), ref: 004597D3

Part of subcall function 00459852: __EH_prolog3.LIBCMT ref: 00459859
Part of subcall function 00459852: lua_tolstring.LUA5.1(?,?,00000000,00000000,00000000,0000000C,004082AF,?,00000002,?,00000001,?,00000002), ref: 0045988A

Part of subcall function 00401BAB: __EH_prolog3.LIBCMT ref: 00401BB2

lua_type.LUA5.1(?,00000004), ref: 0046C4D2
lua_type.LUA5.1(?,00000004), ref: 0046C4E1

Part of subcall function 004019B2: _strlen.LIBCMT ref: 004019C2

GetProcAddress.KERNEL32(00000000,MsiApplyPatchA), ref: 0046C50E
lua_pushboolean.LUA5.1(?,00000000,?,00001068), ref: 0046C54B

Strings

MsiApplyPatchA, xrefs: 0046C508

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: H_prolog3$lua_type.$lua_remove.$AddressProc_strlenlua_getfield.lua_gettable.lua_gettop.lua_pcall.lua_pushboolean.lua_pushstring.lua_tolstring.
String ID: MsiApplyPatchA
API String ID: 3635814031-3494550721
Opcode ID: be433b341d57405f4bce7879237927ec9266325ecbe3f55dcb0e7f705b9d498a
Instruction ID: 9f499f818e56ab2b3da4ab56a9930921714a315f96c1f37b0d1efb423f383925
Opcode Fuzzy Hash: be433b341d57405f4bce7879237927ec9266325ecbe3f55dcb0e7f705b9d498a
Instruction Fuzzy Hash: 8621F432900611AAEB14B7B58C53FBF32689F42329F10052FF521B61C3FE7CAA05816E

Uniqueness

Uniqueness Score: -1.00%

Function 0044A0DF Relevance: 10.6, APIs: 7, Instructions: 101stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004019B2: _strlen.LIBCMT ref: 004019C2

_memset.LIBCMT ref: 0044A110
lstrcpyn.KERNEL32(00000000,00000000,00000104,00000004,00000000,00000000,00000000,00000000,?,00000000,00000000,?,00000000,00000000,00000000), ref: 0044A11D
__mbsinc.LIBCMT ref: 0044A143
__mbsinc.LIBCMT ref: 0044A162
__mbsinc.LIBCMT ref: 0044A196
__mbsinc.LIBCMT ref: 0044A1A9
__mbsinc.LIBCMT ref: 0044A1C0

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: __mbsinc$_memset_strlenlstrcpyn
String ID:
API String ID: 1884050351-0
Opcode ID: bacd93511e44d4c105607c602db92835d72c969baff7d110de9fc2ade29ac56b
Instruction ID: 9d8ff5f63f7a13c67aff95a623033707d9f142286c7986f40109651ee299498f
Opcode Fuzzy Hash: bacd93511e44d4c105607c602db92835d72c969baff7d110de9fc2ade29ac56b
Instruction Fuzzy Hash: 1921B4526886C42FFB2A26649839BF73F9A4B43350F5C50A7E2854B3A3E41C4CB4935B

Uniqueness

Uniqueness Score: -1.00%

Function 0044C31E Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 98COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0044C325
wsprintfA.USER32 ref: 0044C393
_strlen.LIBCMT ref: 0044C399
wsprintfA.USER32 ref: 0044C3C2
_strlen.LIBCMT ref: 0044C3C8

Part of subcall function 0040181F: _memmove_s.LIBCMT ref: 00401866

Part of subcall function 00405B76: __EH_prolog3.LIBCMT ref: 00405B7D

Part of subcall function 00405B1F: __EH_prolog3.LIBCMT ref: 00405B26

Strings

%lu, xrefs: 0044C386, 0044C38E, 0044C3C0

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: H_prolog3_strlenwsprintf$H_prolog3__memmove_s
String ID: %lu
API String ID: 3513440924-685833217
Opcode ID: 913fceb6de5976f9ac2ea5b7b4929e5410d8277d11af5c7af936a03c416d1eba
Instruction ID: 81bd72addf644ded3dc7e7d748295b5c4a7a0cbe4fca25263a82ee9719c752f3
Opcode Fuzzy Hash: 913fceb6de5976f9ac2ea5b7b4929e5410d8277d11af5c7af936a03c416d1eba
Instruction Fuzzy Hash: 0C3110B2D0010CABCB05EBE4DC51AEDB77DAF58318F54416AF512F7292DA34AA04CB69

Uniqueness

Uniqueness Score: -1.00%

Function 004AC089 Relevance: 10.6, APIs: 7, Instructions: 95COMMON

Download Yara Rule

APIs

CreateSolidBrush.GDI32(?), ref: 004AC0BA
GetObjectA.GDI32(?,0000000C,?), ref: 004AC0D4
GetSysColor.USER32(0000000F), ref: 004AC0F0
GetSysColor.USER32(0000000F), ref: 004AC10A
CreateSolidBrush.GDI32(00000000), ref: 004AC10D
GetSysColor.USER32(0000000F), ref: 004AC125
CreateSolidBrush.GDI32(?), ref: 004AC158

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: BrushColorCreateSolid$Object
String ID:
API String ID: 2949401836-0
Opcode ID: c271f124851e0041232e2696dac5eba6e0f045dfed74334c77f08dcd11032c93
Instruction ID: fe9d0160852a57a7580b55063f9972611d9888a0d25ad92f03fd2fe067043f6f
Opcode Fuzzy Hash: c271f124851e0041232e2696dac5eba6e0f045dfed74334c77f08dcd11032c93
Instruction Fuzzy Hash: FB319C31B04615EFCB64EF64C885BBEB7A6BF49700F00001AE50697352CB38AD01CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00498421 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 93COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00498428

Part of subcall function 00496368: __EH_prolog3.LIBCMT ref: 0049636F

Part of subcall function 00401BAB: __EH_prolog3.LIBCMT ref: 00401BB2

Part of subcall function 0048CD71: __EH_prolog3.LIBCMT ref: 0048CD78

Part of subcall function 004014A6: _memcpy_s.LIBCMT ref: 004014F6

Strings

IDS_CTRL_RADIO_BUTTON_%.2d, xrefs: 004984C7
Please select one of the following options:, xrefs: 00498440
IDS_CTRL_STATICTEXT_BOTTOMINSTRUCTIONS, xrefs: 00498485
Option %.2d, xrefs: 004984DA
IDS_CTRL_STATICTEXT_TOPINSTRUCTIONS, xrefs: 00498454

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: H_prolog3$_memcpy_s
String ID: IDS_CTRL_RADIO_BUTTON_%.2d$IDS_CTRL_STATICTEXT_BOTTOMINSTRUCTIONS$IDS_CTRL_STATICTEXT_TOPINSTRUCTIONS$Option %.2d$Please select one of the following options:
API String ID: 1663610674-4264039920
Opcode ID: e65418ccec596460c4d17e3f410aff2345f219120555595c8fe5c0ee5dd8a50d
Instruction ID: 84d089c6dd6a3c0e98640f33581de87d6a8cece259c730cbec285c86a885420f
Opcode Fuzzy Hash: e65418ccec596460c4d17e3f410aff2345f219120555595c8fe5c0ee5dd8a50d
Instruction Fuzzy Hash: 2A316371D00209AFCF05FFA9C953AAE7A75AF55324F51421EF015772D1CB381B018BAA

Uniqueness

Uniqueness Score: -1.00%

Function 004064A6 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 87COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 004064AD
lua_getstack.LUA5.1(?,00000000,?,00000000), ref: 004064E3
lua_getinfo.LUA5.1(?,Snl,?), ref: 00406502

Part of subcall function 00401BAB: __EH_prolog3.LIBCMT ref: 00401BB2

Strings

Snl, xrefs: 004064F7
%s, Line %d: %s, xrefs: 0040659B
Unknown, xrefs: 0040650A

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: H_prolog3H_prolog3_lua_getinfo.lua_getstack.
String ID: %s, Line %d: %s$Snl$Unknown
API String ID: 1261931991-796661963
Opcode ID: 4d972366b980b5e3365b2f746acb6eedebbcfecf8baeb04511ca239b585e59bb
Instruction ID: 9c5c313a7c297e394b047f91307065fb3f6790cbdf70ba25fe7b6bdb75bcd3db
Opcode Fuzzy Hash: 4d972366b980b5e3365b2f746acb6eedebbcfecf8baeb04511ca239b585e59bb
Instruction Fuzzy Hash: C6318F31900104ABDB28EBB9CC51BEDBB78AF14318F10426EF525B71D2DB786A14CF69

Uniqueness

Uniqueness Score: -1.00%

Function 0043A00F Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 58COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0043A016

Strings

Notice%s, xrefs: 0043A052
Warning%s (%d), xrefs: 0043A06C
Skipped%s, xrefs: 0043A05F
Success%s, xrefs: 0043A092
Error%s (%d), xrefs: 0043A079

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: H_prolog3
String ID: Error%s (%d)$Notice%s$Skipped%s$Success%s$Warning%s (%d)
API String ID: 431132790-4104247451
Opcode ID: af30dd3758adcbb9be01334b73c58f5e292d62a27d0c20df3ce2a59319d7730c
Instruction ID: 2cafa5c473a8aadb3dc73f105463b86ae68b496e8c72180bf6514116c776b25e
Opcode Fuzzy Hash: af30dd3758adcbb9be01334b73c58f5e292d62a27d0c20df3ce2a59319d7730c
Instruction Fuzzy Hash: ED11C17248011EBBCF19DFA0CD01DEE7B76BB08344F44441BB940A2190C6799930DB9A

Uniqueness

Uniqueness Score: -1.00%

Function 0049E519 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 29COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0049E520
GetSysColor.USER32(00000014), ref: 0049E55D
GetSysColor.USER32(00000010), ref: 0049E567
GetSysColor.USER32(00000015), ref: 0049E571
GetSysColor.USER32(00000016), ref: 0049E57B

Strings

BUTTON, xrefs: 0049E538

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: Color$H_prolog3
String ID: BUTTON
API String ID: 131102112-3405671355
Opcode ID: 2fd38fa7de3b1bffc8d6d00bf6698deb6861f123c63f09cfd21e505b547a269d
Instruction ID: 6f19ee3100a2f8436581469bc571417320edf205dbff0f299390447a8fefb4ee
Opcode Fuzzy Hash: 2fd38fa7de3b1bffc8d6d00bf6698deb6861f123c63f09cfd21e505b547a269d
Instruction Fuzzy Hash: 7EF05470941B069BD725BF718D1AB9FBAE1AF84700F11082DE1955B1C1DBF46601CF45

Uniqueness

Uniqueness Score: -1.00%

Function 004544E4 Relevance: 10.2, APIs: 8, Instructions: 193stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,00000000), ref: 0045460A
GetLastError.KERNEL32(0000002B,?,00000001), ref: 0045461F
lstrlen.KERNEL32(?,00000000), ref: 00454642
GetLastError.KERNEL32(0000002C,?,00000001), ref: 00454657
lstrlen.KERNEL32(?,00000000), ref: 004546B2
GetLastError.KERNEL32(0000001C,?,00000001), ref: 004546C7
lstrlen.KERNEL32(?,00000000), ref: 004546EA
GetLastError.KERNEL32(0000001D,?,00000001), ref: 00454703

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: ErrorLastlstrlen
String ID:
API String ID: 8355439-0
Opcode ID: 4e58175465a5ce537dd4ba79136a53e4486892db5079a6eedeb95b85921b2457
Instruction ID: e9c10133a96086cffa29038db409d30afa1e2a2cd4de1380d40b9a8af837cf85
Opcode Fuzzy Hash: 4e58175465a5ce537dd4ba79136a53e4486892db5079a6eedeb95b85921b2457
Instruction Fuzzy Hash: 7761647020024AABEF119F658D45FAF3799AB8470EF00052FFE059A282D77CDD589A5A

Uniqueness

Uniqueness Score: -1.00%

Function 004681B6 Relevance: 9.1, APIs: 6, Instructions: 136COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004681BD

Part of subcall function 00459443: lua_getfield.LUA5.1(?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459455
Part of subcall function 00459443: lua_pushstring.LUA5.1(?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459460
Part of subcall function 00459443: lua_gettable.LUA5.1(?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459468
Part of subcall function 00459443: lua_remove.LUA5.1(?,000000FE,?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459470
Part of subcall function 00459443: lua_type.LUA5.1(?,000000FF,?,000000FE,?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459478
Part of subcall function 00459443: lua_pcall.LUA5.1(?,00000000,00000000,00000000), ref: 0045948B
Part of subcall function 00459443: lua_remove.LUA5.1(?,000000FF), ref: 0045949A

Part of subcall function 004597A0: __EH_prolog3.LIBCMT ref: 004597A7
Part of subcall function 004597A0: lua_gettop.LUA5.1(?,00000000,00000000,00000008,004076D1,?,00000002,?), ref: 004597D3

Part of subcall function 00459852: __EH_prolog3.LIBCMT ref: 00459859
Part of subcall function 00459852: lua_tolstring.LUA5.1(?,?,00000000,00000000,00000000,0000000C,004082AF,?,00000002,?,00000001,?,00000002), ref: 0045988A

Part of subcall function 00401BAB: __EH_prolog3.LIBCMT ref: 00401BB2

Part of subcall function 0045974C: __EH_prolog3.LIBCMT ref: 00459753

Part of subcall function 0044D91E: __EH_prolog3.LIBCMT ref: 0044D925

lua_pushnil.LUA5.1(?,?,00000001), ref: 004682F3

Part of subcall function 004014A6: _memcpy_s.LIBCMT ref: 004014F6

lua_createtable.LUA5.1(?,00000000,00000000,?,?,?,00000001,0000000A), ref: 00468291
lua_pushnumber.LUA5.1(?,?,?,?,?,?,00000001,0000000A), ref: 004682AC
lua_pushstring.LUA5.1(?,?,?,00000001,0000000A), ref: 004682C0
lua_settable.LUA5.1(?,000000FD,?,?,?,00000001,0000000A), ref: 004682C8

Part of subcall function 004B4C5C: __CxxThrowException@8.LIBCMT ref: 004B4C72
Part of subcall function 004B4C5C: __EH_prolog3.LIBCMT ref: 004B4C7F

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: H_prolog3$lua_pushstring.lua_remove.$Exception@8Throw_memcpy_slua_createtable.lua_getfield.lua_gettable.lua_gettop.lua_pcall.lua_pushnil.lua_pushnumber.lua_settable.lua_tolstring.lua_type.
String ID:
API String ID: 1908067791-0
Opcode ID: 1c2721e2ad41b260756b6d3f1d8ec878b88ec7d281683656ff0b5bb5371db19b
Instruction ID: c728cde074349f2ec9ec65883b5a21edc7bedbf011c1524498f9d439cc2c2949
Opcode Fuzzy Hash: 1c2721e2ad41b260756b6d3f1d8ec878b88ec7d281683656ff0b5bb5371db19b
Instruction Fuzzy Hash: FA419271C00105ABDB04EBA5C886AEEBB78AF15318F64415FF410722D3EF7D5A4587AA

Uniqueness

Uniqueness Score: -1.00%

Function 0046E462 Relevance: 9.1, APIs: 6, Instructions: 126COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0046E469

Part of subcall function 00459443: lua_getfield.LUA5.1(?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459455
Part of subcall function 00459443: lua_pushstring.LUA5.1(?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459460
Part of subcall function 00459443: lua_gettable.LUA5.1(?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459468
Part of subcall function 00459443: lua_remove.LUA5.1(?,000000FE,?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459470
Part of subcall function 00459443: lua_type.LUA5.1(?,000000FF,?,000000FE,?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459478
Part of subcall function 00459443: lua_pcall.LUA5.1(?,00000000,00000000,00000000), ref: 0045948B
Part of subcall function 00459443: lua_remove.LUA5.1(?,000000FF), ref: 0045949A

Part of subcall function 004597A0: __EH_prolog3.LIBCMT ref: 004597A7
Part of subcall function 004597A0: lua_gettop.LUA5.1(?,00000000,00000000,00000008,004076D1,?,00000002,?), ref: 004597D3

Part of subcall function 00459852: __EH_prolog3.LIBCMT ref: 00459859
Part of subcall function 00459852: lua_tolstring.LUA5.1(?,?,00000000,00000000,00000000,0000000C,004082AF,?,00000002,?,00000001,?,00000002), ref: 0045988A

Part of subcall function 00401BAB: __EH_prolog3.LIBCMT ref: 00401BB2

Part of subcall function 004515A4: __EH_prolog3.LIBCMT ref: 004515AB

lua_pushnil.LUA5.1(?,0000000A), ref: 0046E599

Part of subcall function 004014A6: _memcpy_s.LIBCMT ref: 004014F6

Part of subcall function 004517B0: __EH_prolog3.LIBCMT ref: 004517BA

lua_createtable.LUA5.1(?,00000000,00000000,0000000A), ref: 0046E52D

Part of subcall function 004B4C5C: __CxxThrowException@8.LIBCMT ref: 004B4C72
Part of subcall function 004B4C5C: __EH_prolog3.LIBCMT ref: 004B4C7F

lua_pushnumber.LUA5.1(?,?,?,0000000A), ref: 0046E548
lua_pushstring.LUA5.1(?,?,?,?,0000000A), ref: 0046E55C
lua_settable.LUA5.1(?,000000FD,?,?,?,?,0000000A), ref: 0046E564

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: H_prolog3$lua_pushstring.lua_remove.$Exception@8Throw_memcpy_slua_createtable.lua_getfield.lua_gettable.lua_gettop.lua_pcall.lua_pushnil.lua_pushnumber.lua_settable.lua_tolstring.lua_type.
String ID:
API String ID: 1908067791-0
Opcode ID: 01338515873f5e58a3b1175a45c372372f08662b5c7bce2376fcf9414fb44e8b
Instruction ID: a31827ddce6e01fec5d250f5be58295fe2646483db7bb2918da9684b2c2f1d94
Opcode Fuzzy Hash: 01338515873f5e58a3b1175a45c372372f08662b5c7bce2376fcf9414fb44e8b
Instruction Fuzzy Hash: 18418375800115AADB01ABE6CC46AEEBBB8AF54318F14001FF41177283FB7D5A0687BA

Uniqueness

Uniqueness Score: -1.00%

Function 0046E5CB Relevance: 9.1, APIs: 6, Instructions: 126COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0046E5D2

Part of subcall function 00459443: lua_getfield.LUA5.1(?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459455
Part of subcall function 00459443: lua_pushstring.LUA5.1(?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459460
Part of subcall function 00459443: lua_gettable.LUA5.1(?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459468
Part of subcall function 00459443: lua_remove.LUA5.1(?,000000FE,?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459470
Part of subcall function 00459443: lua_type.LUA5.1(?,000000FF,?,000000FE,?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459478
Part of subcall function 00459443: lua_pcall.LUA5.1(?,00000000,00000000,00000000), ref: 0045948B
Part of subcall function 00459443: lua_remove.LUA5.1(?,000000FF), ref: 0045949A

Part of subcall function 004597A0: __EH_prolog3.LIBCMT ref: 004597A7
Part of subcall function 004597A0: lua_gettop.LUA5.1(?,00000000,00000000,00000008,004076D1,?,00000002,?), ref: 004597D3

Part of subcall function 00459852: __EH_prolog3.LIBCMT ref: 00459859
Part of subcall function 00459852: lua_tolstring.LUA5.1(?,?,00000000,00000000,00000000,0000000C,004082AF,?,00000002,?,00000001,?,00000002), ref: 0045988A

Part of subcall function 00401BAB: __EH_prolog3.LIBCMT ref: 00401BB2

Part of subcall function 004515A4: __EH_prolog3.LIBCMT ref: 004515AB

lua_pushnil.LUA5.1(?,0000000A), ref: 0046E702

Part of subcall function 004014A6: _memcpy_s.LIBCMT ref: 004014F6

Part of subcall function 00451C6D: __EH_prolog3.LIBCMT ref: 00451C77

lua_createtable.LUA5.1(?,00000000,00000000,0000000A), ref: 0046E696

Part of subcall function 004B4C5C: __CxxThrowException@8.LIBCMT ref: 004B4C72
Part of subcall function 004B4C5C: __EH_prolog3.LIBCMT ref: 004B4C7F

lua_pushnumber.LUA5.1(?,?,?,0000000A), ref: 0046E6B1
lua_pushstring.LUA5.1(?,?,?,?,0000000A), ref: 0046E6C5
lua_settable.LUA5.1(?,000000FD,?,?,?,?,0000000A), ref: 0046E6CD

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: H_prolog3$lua_pushstring.lua_remove.$Exception@8Throw_memcpy_slua_createtable.lua_getfield.lua_gettable.lua_gettop.lua_pcall.lua_pushnil.lua_pushnumber.lua_settable.lua_tolstring.lua_type.
String ID:
API String ID: 1908067791-0
Opcode ID: fa22616630401b12e80c8301b3ce8014f5a1b419bd5a3221eb626190061ebd92
Instruction ID: 28d64e8631b9c7c422b4713f96e514c154c311040a02820bc5abe4971acb32e4
Opcode Fuzzy Hash: fa22616630401b12e80c8301b3ce8014f5a1b419bd5a3221eb626190061ebd92
Instruction Fuzzy Hash: E5419175800115ABDB01EFA6CC46AEEBBB8AF55318F54001FF81073283EB7D5A0587BA

Uniqueness

Uniqueness Score: -1.00%

Function 004AE66F Relevance: 9.1, APIs: 6, Instructions: 119windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 004AE69E
ClientToScreen.USER32(00000000,?), ref: 004AE74E
ScreenToClient.USER32(00000000,?), ref: 004AE75E
ClientToScreen.USER32(00000000,?), ref: 004AE7AC
ScreenToClient.USER32(?,?), ref: 004AE7BC
PostMessageA.USER32(?,?,?,?), ref: 004AE7D9

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: ClientScreen$MessageParentPost
String ID:
API String ID: 1061243768-0
Opcode ID: 237f283f83863944ae1e47a72efe981a6f76196846709a3ad9c7a0ac3b033829
Instruction ID: 5f2c81f1a464f8638bed0d9b77a76d4db9e9725f30e14e21403447c77e97b5ca
Opcode Fuzzy Hash: 237f283f83863944ae1e47a72efe981a6f76196846709a3ad9c7a0ac3b033829
Instruction Fuzzy Hash: 2C410439901215EBCF249F5AC8845BEB7B9FF25300F14482BF862D6AA1D338ED80D725

Uniqueness

Uniqueness Score: -1.00%

Function 004744A2 Relevance: 9.1, APIs: 6, Instructions: 115COMMON

Download Yara Rule

APIs

Part of subcall function 00474261: __EH_prolog3_GS.LIBCMT ref: 00474268
Part of subcall function 00474261: GetSystemMetrics.USER32(00000000), ref: 004742EB
Part of subcall function 00474261: GetSystemMetrics.USER32(00000001), ref: 004742F1
Part of subcall function 00474261: IsWindow.USER32(?), ref: 00474307
Part of subcall function 00474261: GetWindowRect.USER32(?,?), ref: 0047431D

Part of subcall function 004864E6: LoadIconA.USER32(00000000,00007F01), ref: 00486521
Part of subcall function 004864E6: SendMessageA.USER32(?,00000170,00000000,00000000), ref: 00486534

Part of subcall function 00486A47: GetWindowRect.USER32(?,?), ref: 00486AF0
Part of subcall function 00486A47: GetWindowRect.USER32(?,?), ref: 00486AFC
Part of subcall function 00486A47: GetWindowRect.USER32(?,?), ref: 00486B60

Part of subcall function 004B894D: ShowWindow.USER32(?,?,?,004B6C70,00000000,0000E146,00000000,?,?,00402098,0000002C,0000000A), ref: 004B895E

GetSystemMetrics.USER32(00000000), ref: 00474522
GetSystemMetrics.USER32(00000001), ref: 00474528
IsWindow.USER32(?), ref: 0047453B
GetWindowRect.USER32(?,?), ref: 0047454C
GetWindowRect.USER32(?,?), ref: 00474579
GetParent.USER32(?), ref: 004745AD

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: Window$Rect$MetricsSystem$H_prolog3_IconLoadMessageParentSendShow
String ID:
API String ID: 699161555-0
Opcode ID: b4c970440d18b6327fc8fc2a460da8d4e51a0d2d978237b34d648e33060d6c8a
Instruction ID: 46f3ce453aba954fdfed97019b9d01302a5f6d199d8bfe368f2f830ff47d873f
Opcode Fuzzy Hash: b4c970440d18b6327fc8fc2a460da8d4e51a0d2d978237b34d648e33060d6c8a
Instruction Fuzzy Hash: 80418D71A10219ABCB00EFBDCD899FEBBF9AF84700B15456EB905E7251DB74AD00CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00468077 Relevance: 9.1, APIs: 6, Instructions: 114COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0046807E

Part of subcall function 00459443: lua_getfield.LUA5.1(?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459455
Part of subcall function 00459443: lua_pushstring.LUA5.1(?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459460
Part of subcall function 00459443: lua_gettable.LUA5.1(?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459468
Part of subcall function 00459443: lua_remove.LUA5.1(?,000000FE,?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459470
Part of subcall function 00459443: lua_type.LUA5.1(?,000000FF,?,000000FE,?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459478
Part of subcall function 00459443: lua_pcall.LUA5.1(?,00000000,00000000,00000000), ref: 0045948B
Part of subcall function 00459443: lua_remove.LUA5.1(?,000000FF), ref: 0045949A

Part of subcall function 004597A0: __EH_prolog3.LIBCMT ref: 004597A7
Part of subcall function 004597A0: lua_gettop.LUA5.1(?,00000000,00000000,00000008,004076D1,?,00000002,?), ref: 004597D3

Part of subcall function 00459852: __EH_prolog3.LIBCMT ref: 00459859
Part of subcall function 00459852: lua_tolstring.LUA5.1(?,?,00000000,00000000,00000000,0000000C,004082AF,?,00000002,?,00000001,?,00000002), ref: 0045988A

Part of subcall function 00401BAB: __EH_prolog3.LIBCMT ref: 00401BB2

Part of subcall function 0045974C: __EH_prolog3.LIBCMT ref: 00459753

Part of subcall function 0044D91E: __EH_prolog3.LIBCMT ref: 0044D925

lua_pushnil.LUA5.1(?,?,00000001), ref: 00468185

Part of subcall function 0044D971: GetPrivateProfileSectionNamesA.KERNEL32(?,00007FFF,?), ref: 0044D9E2

lua_createtable.LUA5.1(?,00000000,00000000,?,00000001,0000000A), ref: 00468123
lua_pushnumber.LUA5.1(?,?,?,?,00000001,0000000A), ref: 0046813E
lua_pushstring.LUA5.1(?,?,?,00000001,0000000A), ref: 00468152
lua_settable.LUA5.1(?,000000FD,?,?,?,00000001,0000000A), ref: 0046815A

Part of subcall function 004B4C5C: __CxxThrowException@8.LIBCMT ref: 004B4C72
Part of subcall function 004B4C5C: __EH_prolog3.LIBCMT ref: 004B4C7F

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: H_prolog3$lua_pushstring.lua_remove.$Exception@8NamesPrivateProfileSectionThrowlua_createtable.lua_getfield.lua_gettable.lua_gettop.lua_pcall.lua_pushnil.lua_pushnumber.lua_settable.lua_tolstring.lua_type.
String ID:
API String ID: 2175084750-0
Opcode ID: 42e3bda7aa8934ff1565e83afbb5c2f0b266a28d89225e6a0498d7f092201661
Instruction ID: 964eb0b382dfc6881af28a0651297280a11ff364e87c9a980be2f3aef264cd65
Opcode Fuzzy Hash: 42e3bda7aa8934ff1565e83afbb5c2f0b266a28d89225e6a0498d7f092201661
Instruction Fuzzy Hash: E3316271C04205AADB05FBA5C8429EEBB78AF15319F54011FF41076282EF7D5B46C7AA

Uniqueness

Uniqueness Score: -1.00%

Function 004AC667 Relevance: 9.1, APIs: 6, Instructions: 114windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 004AC68A
ClientToScreen.USER32(?,?), ref: 004AC71F
ScreenToClient.USER32(?,?), ref: 004AC72C
ClientToScreen.USER32(?,?), ref: 004AC789
ScreenToClient.USER32(?,?), ref: 004AC799
PostMessageA.USER32(?,?,?,?), ref: 004AC7B6

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: ClientScreen$MessageParentPost
String ID:
API String ID: 1061243768-0
Opcode ID: d155d447339293dab207f08065233faf1ab0a9b68b13769f205704c713b29753
Instruction ID: 1064a73f65d73a5808c445d715e792a1cf236f9653b793605b97fe3e281e98e8
Opcode Fuzzy Hash: d155d447339293dab207f08065233faf1ab0a9b68b13769f205704c713b29753
Instruction Fuzzy Hash: 6441B279600606EFDB658F98C9C49BEBBB9FF15300F10442BE986D2660D738DD80DB55

Uniqueness

Uniqueness Score: -1.00%

Function 004A60EC Relevance: 9.1, APIs: 6, Instructions: 103windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004A5D14: IsWindow.USER32(00000000), ref: 004A5D2B

SendMessageA.USER32(?,0000018B,00000000,00000000), ref: 004A6127
SendMessageA.USER32(?,00000187,00000000,00000000), ref: 004A613D
SendMessageA.USER32(?,0000018B,00000000,00000000), ref: 004A6161
SendMessageA.USER32(?,0000018B,00000000,00000000), ref: 004A6175
SendMessageA.USER32(?,00000187,00000000,00000000), ref: 004A618B
SendMessageA.USER32(?,0000018B,00000000,00000000), ref: 004A61AF

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: MessageSend$Window
String ID:
API String ID: 2326795674-0
Opcode ID: dd0b02d2243b1b5b165e13baadc21d22c5f6a94c424495e22ec00f14025672ae
Instruction ID: dd2a6879cb5b7dddbf3b9eb783261300787931560575817acd186612409d7866
Opcode Fuzzy Hash: dd0b02d2243b1b5b165e13baadc21d22c5f6a94c424495e22ec00f14025672ae
Instruction Fuzzy Hash: 3431C135600610EFDB21CF59CD80E6BBBB4EF55744F26405AB9459B272C735ED01DB18

Uniqueness

Uniqueness Score: -1.00%

Function 0040A045 Relevance: 9.1, APIs: 6, Instructions: 80COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0040A04C
ConvertStringSidToSidA.ADVAPI32(?,?), ref: 0040A063
GetNamedSecurityInfoA.ADVAPI32(?,00000001,00000004,00000000,00000000,?,00000000,?), ref: 0040A0A3
LocalFree.KERNEL32(?), ref: 0040A0FA

Part of subcall function 00401437: _memcpy_s.LIBCMT ref: 00401484

GetLastError.KERNEL32(?,?,0000000C), ref: 0040A0FE
LocalFree.KERNEL32(?), ref: 0040A10E

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: FreeLocal$ConvertErrorH_prolog3InfoLastNamedSecurityString_memcpy_s
String ID:
API String ID: 3337624286-0
Opcode ID: 162259d2069366155a835b20fba6162220ea529449cf34c0f3c59800657dde39
Instruction ID: cf40d6f147ec1991fbeb4ca50f0f56657745493d72f687c83a63c04d0d7dcf0b
Opcode Fuzzy Hash: 162259d2069366155a835b20fba6162220ea529449cf34c0f3c59800657dde39
Instruction Fuzzy Hash: E121857180020AAFCF14DFA9CC45DEE7BB8FF44324F04461AF924AB2A1D7359A50CB55

Uniqueness

Uniqueness Score: -1.00%

Function 006543C0 Relevance: 9.1, APIs: 6, Instructions: 54threadsynchronizationCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(?,00000000,00000000,00000000,00000000,?,0063E375,\irsetup.skin,00698DAC,00000000,?,0042744E,00000000,00000000,\irsetup.skin,00000000), ref: 006543DB
GetExitCodeThread.KERNEL32(?,00000001,?,0063E375,\irsetup.skin,00698DAC,00000000,?,0042744E,00000000,00000000,\irsetup.skin,00000000,?,00000001), ref: 006543F2
WaitForSingleObject.KERNEL32(?,00000064,?,0063E375,\irsetup.skin,00698DAC,00000000,?,0042744E,00000000,00000000,\irsetup.skin,00000000,?,00000001), ref: 00654415
GetExitCodeThread.KERNEL32(?,00000103,?,0063E375,\irsetup.skin,00698DAC,00000000,?,0042744E,00000000,00000000,\irsetup.skin,00000000,?,00000001), ref: 00654423
TerminateThread.KERNEL32(?,00000000,?,0063E375,\irsetup.skin,00698DAC,00000000,?,0042744E,00000000,00000000,\irsetup.skin,00000000,?,00000001), ref: 0065442E
CloseHandle.KERNEL32(?,?,0063E375,\irsetup.skin,00698DAC,00000000,?,0042744E,00000000,00000000,\irsetup.skin,00000000,?,00000001), ref: 00654438

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: Thread$CodeExit$CloseEventHandleObjectSingleTerminateWait
String ID:
API String ID: 1721022855-0
Opcode ID: 77c75e342eea0d59735b2cc8f79a1722212ad2ed0b8b30936ab208ca3941d359
Instruction ID: 4b1024d96a560649203c44b235e15101fd3e489d754b4c9d70eef91ab3271da9
Opcode Fuzzy Hash: 77c75e342eea0d59735b2cc8f79a1722212ad2ed0b8b30936ab208ca3941d359
Instruction Fuzzy Hash: 0E01A171504701EFD720CF64DC88FABB7EEEB44719F10854AE84A83600DA74AD86DB60

Uniqueness

Uniqueness Score: -1.00%

Function 0045438E Relevance: 9.0, APIs: 6, Instructions: 29threadCOMMON

Download Yara Rule

APIs

IsWindow.USER32(?), ref: 00454398
GetWindowThreadProcessId.USER32(?,?), ref: 004543A9
OpenProcess.KERNEL32(00000001,00000000,?), ref: 004543B6
GetLastError.KERNEL32 ref: 004543BE
TerminateProcess.KERNEL32(00000000,00000000), ref: 004543CB
CloseHandle.KERNEL32(00000000), ref: 004543D2

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: Process$Window$CloseErrorHandleLastOpenTerminateThread
String ID:
API String ID: 1040422698-0
Opcode ID: a6936f529746508b28fdd4d360a103aed8b4509a23c4fc75794c3ba0296e1934
Instruction ID: 6c23a5e13b322d671da5d3c5dc172c218928bf465203741ac2e83f08e177bfd5
Opcode Fuzzy Hash: a6936f529746508b28fdd4d360a103aed8b4509a23c4fc75794c3ba0296e1934
Instruction Fuzzy Hash: A3F0E531514310BFD7215F60DD0DB9A7BAEEF04B51F011412FD02D2561DBB0AD00ABD8

Uniqueness

Uniqueness Score: -1.00%

Function 0044C602 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 136COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0044C609

Strings

Script, xrefs: 0044C760
Name, xrefs: 0044C6AF
Args, xrefs: 0044C70B
Event, xrefs: 0044C627, 0044C62C, 0044C666

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: H_prolog3
String ID: Args$Event$Name$Script
API String ID: 431132790-2529934338
Opcode ID: be2653ef5509429438ac60f4cbbb5fb1232baca02e6501835cca3ba6f15232e4
Instruction ID: 6dc0f1cac93f748457e8dad0270fd65e72f9037a4c3610a1faaf671d57d669ec
Opcode Fuzzy Hash: be2653ef5509429438ac60f4cbbb5fb1232baca02e6501835cca3ba6f15232e4
Instruction Fuzzy Hash: 0951A1B1900705DFCB14EFB5C4916AEBBF5BF08714F04862EA4AAA72D1C7349A44CF59

Uniqueness

Uniqueness Score: -1.00%

Function 004160D0 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 131COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004160D7
_memset.LIBCMT ref: 00416144

Part of subcall function 00405B76: __EH_prolog3.LIBCMT ref: 00405B7D

Part of subcall function 00405B1F: __EH_prolog3.LIBCMT ref: 00405B26

Strings

Root element has sibling, xrefs: 004161A4
No root element, xrefs: 004161AB
Empty document, xrefs: 004161B2

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: H_prolog3$_memset
String ID: Empty document$No root element$Root element has sibling
API String ID: 1193784468-3062692564
Opcode ID: eff45c9a208cd3107d426c45c7a5d0ada919c0eb57451a2c35473df95a81bb40
Instruction ID: bf27e4930bcd17e86714112474728f5fb655d26f63f0a8a0b559240779794816
Opcode Fuzzy Hash: eff45c9a208cd3107d426c45c7a5d0ada919c0eb57451a2c35473df95a81bb40
Instruction Fuzzy Hash: 22518FB0900A00DFC724DF6AC8419AAF7F9FF943007148A5FE096A77A2D774A945CF55

Uniqueness

Uniqueness Score: -1.00%

Function 0044C33B Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 94COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0044C393
_strlen.LIBCMT ref: 0044C399
wsprintfA.USER32 ref: 0044C3C2
_strlen.LIBCMT ref: 0044C3C8

Part of subcall function 0040181F: _memmove_s.LIBCMT ref: 00401866

Part of subcall function 00405B76: __EH_prolog3.LIBCMT ref: 00405B7D

Part of subcall function 00405B1F: __EH_prolog3.LIBCMT ref: 00405B26

Strings

%lu, xrefs: 0044C386, 0044C38E, 0044C3C0

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: H_prolog3_strlenwsprintf$_memmove_s
String ID: %lu
API String ID: 3440408245-685833217
Opcode ID: a250e0827594a57e3c3e479fad96e3a31cdc6af4533e4226bbf73eb7e655aa62
Instruction ID: 8140289437c539985019a4c164240a4a8fb33c8983e675549e547797f61c810d
Opcode Fuzzy Hash: a250e0827594a57e3c3e479fad96e3a31cdc6af4533e4226bbf73eb7e655aa62
Instruction Fuzzy Hash: 763130B2D0000CABCB05EBE4DC51AEEB76DAF48314F54426EF511F72D2DA34AA048B64

Uniqueness

Uniqueness Score: -1.00%

Function 00414144 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 90COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0041414B

Part of subcall function 004019B2: _strlen.LIBCMT ref: 004019C2

Part of subcall function 00403D53: _strlen.LIBCMT ref: 00403D63

Strings

<![CDATA[, xrefs: 00414190
<!--, xrefs: 00414242
]]>, xrefs: 00414175, 0041417A, 004141A5
-->, xrefs: 00414257

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: _strlen$H_prolog3
String ID: -->$<!--$<![CDATA[$]]>
API String ID: 2883720156-909480014
Opcode ID: e5029ee801d2ae18a695d8c6d27d9ee0a96e1d2bbaff1dd49afb9c8b026a98d8
Instruction ID: b4da90a62d22144e1056d03058bfb2b01c9016b99b40f8c2307bcf872ac66323
Opcode Fuzzy Hash: e5029ee801d2ae18a695d8c6d27d9ee0a96e1d2bbaff1dd49afb9c8b026a98d8
Instruction Fuzzy Hash: 5D31A974200209A7CF14AFA5C956DED3B16BFC4784F00856AFD156B2E1CA389ED1CB9E

Uniqueness

Uniqueness Score: -1.00%

Function 00452646 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 68fileCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0045264D

Part of subcall function 00405AB7: __mbsinc.LIBCMT ref: 00405AF2

Part of subcall function 005B5A3A: __waccess_s.LIBCMT ref: 005B5A45

DeleteFileA.KERNEL32(?), ref: 004526E8

Strings

%s\%s.pif, xrefs: 004526A6
%s\%s.url, xrefs: 004526CA
%s\%s.lnk, xrefs: 00452682

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: DeleteFileH_prolog3__mbsinc__waccess_s
String ID: %s\%s.lnk$%s\%s.pif$%s\%s.url
API String ID: 1891361267-1849461506
Opcode ID: cffea826a72ee0d22a7b657b2e9d553bb45e52888f4bb523f669c66ef7747a3b
Instruction ID: c8098d5293ea8231048928bc5c6c8e2caef9bd53507bfb8d0508bfb13e750363
Opcode Fuzzy Hash: cffea826a72ee0d22a7b657b2e9d553bb45e52888f4bb523f669c66ef7747a3b
Instruction Fuzzy Hash: 6A21C23190011ABBCF04BFA5CC45EEF7B3ABF51318F04461AF924B62D2DA7496149B58

Uniqueness

Uniqueness Score: -1.00%

Function 005D62A2 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 63COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 005D62B9

Part of subcall function 0063DF96: std::exception::exception.LIBCMT ref: 0063DFAB
Part of subcall function 0063DF96: __CxxThrowException@8.LIBCMT ref: 0063DFC0
Part of subcall function 0063DF96: std::exception::exception.LIBCMT ref: 0063DFD1

std::_Xinvalid_argument.LIBCPMT ref: 005D62DB
_memmove.LIBCMT ref: 005D6318

Strings

invalid string position, xrefs: 005D62B4
string too long, xrefs: 005D62D6

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: Xinvalid_argumentstd::_std::exception::exception$Exception@8Throw_memmove
String ID: invalid string position$string too long
API String ID: 3404309857-4289949731
Opcode ID: e11ea0d85beab975eb1149edff1131464f5a13fbffb034c71ff08f92789de56c
Instruction ID: 3fa1a7fbf32da4c74fee0e020a0cac3dd00f7cf3ce413fa8e02295307799f654
Opcode Fuzzy Hash: e11ea0d85beab975eb1149edff1131464f5a13fbffb034c71ff08f92789de56c
Instruction Fuzzy Hash: 211146717006049FDB34DF6CD881A6ABBE9FB44710B100D2FF9928B782C7B0E9468B94

Uniqueness

Uniqueness Score: -1.00%

Function 004A022F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 004A0236
_memset.LIBCMT ref: 004A028F
__cftof.LIBCMT ref: 004A02AD
CreateFontIndirectA.GDI32(?), ref: 004A02B9

Strings

Marlett, xrefs: 004A0253

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: CreateFontH_prolog3_Indirect__cftof_memset
String ID: Marlett
API String ID: 2128786630-3688754224
Opcode ID: 20f5717c141fd7cb3d82e0138df906b7d05abc300c7ca9ca1377d0302dbd4d1d
Instruction ID: 1835c9286c18a0aa3bf0e3c10dc126b099a6328de194ae9a51a789b30e85e1fa
Opcode Fuzzy Hash: 20f5717c141fd7cb3d82e0138df906b7d05abc300c7ca9ca1377d0302dbd4d1d
Instruction Fuzzy Hash: D41173B1D002189FDB14EFD4CC99BEDBB74BF48304F54056EF215AB282DB7469058B59

Uniqueness

Uniqueness Score: -1.00%

Function 00458416 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,0074DE40,?,0041B446,?,?,00000000,?,?,00000000,?,?,00000000,?,?,00000000), ref: 00458423
GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 00458434
GetCurrentProcess.KERNEL32(00000000,?,?,0041B446,?,?,00000000,?,?,00000000,?,?,00000000,?,?,00000000), ref: 00458444

Strings

kernel32.dll, xrefs: 0045841E
IsWow64Process, xrefs: 0045842E

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: AddressCurrentHandleModuleProcProcess
String ID: IsWow64Process$kernel32.dll
API String ID: 4190356694-3024904723
Opcode ID: b5d8cc11028e8811edd2eef216608145585a36bb643d185323ea980ec59e9bd4
Instruction ID: 13e03e53dfd61a4c41021413e91832a6ba6fa3f94253dbe169baf48d78082fdd
Opcode Fuzzy Hash: b5d8cc11028e8811edd2eef216608145585a36bb643d185323ea980ec59e9bd4
Instruction Fuzzy Hash: 43E04871910219F7CB10ABB4AD09A5F76ADAB01755B055056BC00E3550DE78DD049A94

Uniqueness

Uniqueness Score: -1.00%

Function 00452480 Relevance: 7.6, APIs: 5, Instructions: 126stringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004524AE
lstrcpy.KERNEL32(?,?), ref: 004524E4
_memset.LIBCMT ref: 0045258F
lstrlen.KERNEL32(?,?,00000104), ref: 004525AA
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000), ref: 004525BA

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: _memset$ByteCharMultiWidelstrcpylstrlen
String ID:
API String ID: 4173576495-0
Opcode ID: 4a7cb955d97413f53a084aaf797762d9521527b3df445ee9d0921ee09f83cdbc
Instruction ID: a7f2df4dba6ee50d02e5bc6a7b4ce97770c1a92cf0fccdad2477dd29f7926439
Opcode Fuzzy Hash: 4a7cb955d97413f53a084aaf797762d9521527b3df445ee9d0921ee09f83cdbc
Instruction Fuzzy Hash: 4F4109B5A00218AFCB15DFA4CC88EAAB7BDEF4C305F000499F946D7251DA75AE85CF60

Uniqueness

Uniqueness Score: -1.00%

Function 0045A43F Relevance: 7.6, APIs: 5, Instructions: 116COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0045A449

Part of subcall function 00459443: lua_getfield.LUA5.1(?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459455
Part of subcall function 00459443: lua_pushstring.LUA5.1(?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459460
Part of subcall function 00459443: lua_gettable.LUA5.1(?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459468
Part of subcall function 00459443: lua_remove.LUA5.1(?,000000FE,?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459470
Part of subcall function 00459443: lua_type.LUA5.1(?,000000FF,?,000000FE,?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459478
Part of subcall function 00459443: lua_pcall.LUA5.1(?,00000000,00000000,00000000), ref: 0045948B
Part of subcall function 00459443: lua_remove.LUA5.1(?,000000FF), ref: 0045949A

Part of subcall function 004597A0: __EH_prolog3.LIBCMT ref: 004597A7
Part of subcall function 004597A0: lua_gettop.LUA5.1(?,00000000,00000000,00000008,004076D1,?,00000002,?), ref: 004597D3

Part of subcall function 00459852: __EH_prolog3.LIBCMT ref: 00459859
Part of subcall function 00459852: lua_tolstring.LUA5.1(?,?,00000000,00000000,00000000,0000000C,004082AF,?,00000002,?,00000001,?,00000002), ref: 0045988A

Part of subcall function 00401BAB: __EH_prolog3.LIBCMT ref: 00401BB2

Part of subcall function 00459710: __EH_prolog3.LIBCMT ref: 00459717

GetFileAttributesA.KERNEL32(?), ref: 0045A4CE
__splitpath_s.LIBCMT ref: 0045A525
_strlen.LIBCMT ref: 0045A54A
_strlen.LIBCMT ref: 0045A56A

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: H_prolog3$_strlenlua_remove.$AttributesFileH_prolog3___splitpath_slua_getfield.lua_gettable.lua_gettop.lua_pcall.lua_pushstring.lua_tolstring.lua_type.
String ID:
API String ID: 2240342688-0
Opcode ID: 846c2f49d318e5d1e34ec0ec722065ed7ac176a6dfead1c9874bca287cfbc19c
Instruction ID: 9c326fb5b371cfbe702569be7433592812b90eaaed47a84b3d560e1d23403ade
Opcode Fuzzy Hash: 846c2f49d318e5d1e34ec0ec722065ed7ac176a6dfead1c9874bca287cfbc19c
Instruction Fuzzy Hash: 85415472800118ABD71AEB64CC86EDE777CAF18314F5402DEF115A21D2EE386F888B65

Uniqueness

Uniqueness Score: -1.00%

Function 0045415F Relevance: 7.6, APIs: 5, Instructions: 108threadCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00454169
GetWindow.USER32(?,00000004), ref: 0045417D
GetWindowLongA.USER32(?,000000F0), ref: 0045418D
GetWindowTextA.USER32(?,?,000001F4), ref: 004541B4
GetWindowThreadProcessId.USER32(?,?), ref: 0045420F

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: Window$H_prolog3_LongProcessTextThread
String ID:
API String ID: 2837326627-0
Opcode ID: 90c64c5048e886618278fcde7f650a74fe987fb865f7dce11a3908c320455e9e
Instruction ID: 58d4a6f727775820769da4ba1580a99c3ba89c1185597fcef965989e5b76594d
Opcode Fuzzy Hash: 90c64c5048e886618278fcde7f650a74fe987fb865f7dce11a3908c320455e9e
Instruction Fuzzy Hash: CF4177719002199BCB14DBA1CC49BEEB374AF50319F1042DEB515A61D2DB385FC5CF14

Uniqueness

Uniqueness Score: -1.00%

Function 0045C1AB Relevance: 7.6, APIs: 5, Instructions: 81stringCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0045C1B5

Part of subcall function 00459443: lua_getfield.LUA5.1(?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459455
Part of subcall function 00459443: lua_pushstring.LUA5.1(?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459460
Part of subcall function 00459443: lua_gettable.LUA5.1(?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459468
Part of subcall function 00459443: lua_remove.LUA5.1(?,000000FE,?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459470
Part of subcall function 00459443: lua_type.LUA5.1(?,000000FF,?,000000FE,?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459478
Part of subcall function 00459443: lua_pcall.LUA5.1(?,00000000,00000000,00000000), ref: 0045948B
Part of subcall function 00459443: lua_remove.LUA5.1(?,000000FF), ref: 0045949A

Part of subcall function 004597A0: __EH_prolog3.LIBCMT ref: 004597A7
Part of subcall function 004597A0: lua_gettop.LUA5.1(?,00000000,00000000,00000008,004076D1,?,00000002,?), ref: 004597D3

Part of subcall function 00459852: __EH_prolog3.LIBCMT ref: 00459859
Part of subcall function 00459852: lua_tolstring.LUA5.1(?,?,00000000,00000000,00000000,0000000C,004082AF,?,00000002,?,00000001,?,00000002), ref: 0045988A

Part of subcall function 00401BAB: __EH_prolog3.LIBCMT ref: 00401BB2

_memset.LIBCMT ref: 0045C224
lstrcpy.KERNEL32(?,?), ref: 0045C23F
_memset.LIBCMT ref: 0045C252
lstrcpy.KERNEL32(?,?), ref: 0045C267

Part of subcall function 00447EF0: __EH_prolog3.LIBCMT ref: 00447EF7
Part of subcall function 00447EF0: _strlen.LIBCMT ref: 00447F01

Part of subcall function 004593D3: lua_getfield.LUA5.1(?,FFFFD8EE,Application,?,?,00407717,?,00000000), ref: 004593E5
Part of subcall function 004593D3: lua_pushstring.LUA5.1(?,SetLastError,?,FFFFD8EE,Application,?,?,00407717,?,00000000), ref: 004593F0
Part of subcall function 004593D3: lua_gettable.LUA5.1(?,000000FE,?,SetLastError,?,FFFFD8EE,Application,?,?,00407717,?,00000000), ref: 004593F8
Part of subcall function 004593D3: lua_remove.LUA5.1(?,000000FE,?,000000FE,?,SetLastError,?,FFFFD8EE,Application,?,?,00407717,?,00000000), ref: 00459400
Part of subcall function 004593D3: lua_type.LUA5.1(?,000000FF,?,000000FE,?,000000FE,?,SetLastError,?,FFFFD8EE,Application,?,?,00407717,?,00000000), ref: 00459408
Part of subcall function 004593D3: lua_pushnumber.LUA5.1(?,?,?,?,?,?,?,?,?,?,?,00407717,?,00000000), ref: 0045941E
Part of subcall function 004593D3: lua_pcall.LUA5.1(?,00000001,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00407717), ref: 0045942A
Part of subcall function 004593D3: lua_remove.LUA5.1(?,000000FF,?,?,?,?,?,?,?,?,00407717,?,00000000), ref: 00459439

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: H_prolog3lua_remove.$_memsetlstrcpylua_getfield.lua_gettable.lua_pcall.lua_pushstring.lua_type.$H_prolog3__strlenlua_gettop.lua_pushnumber.lua_tolstring.
String ID:
API String ID: 3937928458-0
Opcode ID: 3bc4001ff84c6442614a8b3cdcd01590065ac73382d109098373f8ef9b4a37d3
Instruction ID: 5bf3a12a68cf43bff7a1dad2f7335fc9eeedb001f644d9ab985a88227d9b37cc
Opcode Fuzzy Hash: 3bc4001ff84c6442614a8b3cdcd01590065ac73382d109098373f8ef9b4a37d3
Instruction Fuzzy Hash: D031527184111CAADB25B7A4DC9ABDD7778AF15308F1001DAF119721C3DF782F858AA5

Uniqueness

Uniqueness Score: -1.00%

Function 0045C2D3 Relevance: 7.6, APIs: 5, Instructions: 81stringCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0045C2DD

Part of subcall function 00459443: lua_getfield.LUA5.1(?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459455
Part of subcall function 00459443: lua_pushstring.LUA5.1(?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459460
Part of subcall function 00459443: lua_gettable.LUA5.1(?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459468
Part of subcall function 00459443: lua_remove.LUA5.1(?,000000FE,?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459470
Part of subcall function 00459443: lua_type.LUA5.1(?,000000FF,?,000000FE,?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459478
Part of subcall function 00459443: lua_pcall.LUA5.1(?,00000000,00000000,00000000), ref: 0045948B
Part of subcall function 00459443: lua_remove.LUA5.1(?,000000FF), ref: 0045949A

Part of subcall function 004597A0: __EH_prolog3.LIBCMT ref: 004597A7
Part of subcall function 004597A0: lua_gettop.LUA5.1(?,00000000,00000000,00000008,004076D1,?,00000002,?), ref: 004597D3

Part of subcall function 00459852: __EH_prolog3.LIBCMT ref: 00459859
Part of subcall function 00459852: lua_tolstring.LUA5.1(?,?,00000000,00000000,00000000,0000000C,004082AF,?,00000002,?,00000001,?,00000002), ref: 0045988A

Part of subcall function 00401BAB: __EH_prolog3.LIBCMT ref: 00401BB2

_memset.LIBCMT ref: 0045C34C
lstrcpy.KERNEL32(?,?), ref: 0045C367
_memset.LIBCMT ref: 0045C37A
lstrcpy.KERNEL32(?,?), ref: 0045C38F

Part of subcall function 0044807D: __EH_prolog3.LIBCMT ref: 00448084
Part of subcall function 0044807D: _strlen.LIBCMT ref: 00448096

Part of subcall function 004593D3: lua_getfield.LUA5.1(?,FFFFD8EE,Application,?,?,00407717,?,00000000), ref: 004593E5
Part of subcall function 004593D3: lua_pushstring.LUA5.1(?,SetLastError,?,FFFFD8EE,Application,?,?,00407717,?,00000000), ref: 004593F0
Part of subcall function 004593D3: lua_gettable.LUA5.1(?,000000FE,?,SetLastError,?,FFFFD8EE,Application,?,?,00407717,?,00000000), ref: 004593F8
Part of subcall function 004593D3: lua_remove.LUA5.1(?,000000FE,?,000000FE,?,SetLastError,?,FFFFD8EE,Application,?,?,00407717,?,00000000), ref: 00459400
Part of subcall function 004593D3: lua_type.LUA5.1(?,000000FF,?,000000FE,?,000000FE,?,SetLastError,?,FFFFD8EE,Application,?,?,00407717,?,00000000), ref: 00459408
Part of subcall function 004593D3: lua_pushnumber.LUA5.1(?,?,?,?,?,?,?,?,?,?,?,00407717,?,00000000), ref: 0045941E
Part of subcall function 004593D3: lua_pcall.LUA5.1(?,00000001,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00407717), ref: 0045942A
Part of subcall function 004593D3: lua_remove.LUA5.1(?,000000FF,?,?,?,?,?,?,?,?,00407717,?,00000000), ref: 00459439

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: H_prolog3lua_remove.$_memsetlstrcpylua_getfield.lua_gettable.lua_pcall.lua_pushstring.lua_type.$H_prolog3__strlenlua_gettop.lua_pushnumber.lua_tolstring.
String ID:
API String ID: 3937928458-0
Opcode ID: a8a6ede6f421b4ec2bf5c54d69252d0b5f670909ea980f6be0c1785f5466cd6e
Instruction ID: 7954a0b3aaab49431f47d082f4a823743a3088eab8451d171cea81c101cbff50
Opcode Fuzzy Hash: a8a6ede6f421b4ec2bf5c54d69252d0b5f670909ea980f6be0c1785f5466cd6e
Instruction Fuzzy Hash: E631507180111CAADB25B7A4DC9AFDD7778AF15308F1001DAF519B21C3EE782F898AA5

Uniqueness

Uniqueness Score: -1.00%

Function 0047A03C Relevance: 7.6, APIs: 5, Instructions: 77COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0047A043

Part of subcall function 00459443: lua_getfield.LUA5.1(?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459455
Part of subcall function 00459443: lua_pushstring.LUA5.1(?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459460
Part of subcall function 00459443: lua_gettable.LUA5.1(?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459468
Part of subcall function 00459443: lua_remove.LUA5.1(?,000000FE,?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459470
Part of subcall function 00459443: lua_type.LUA5.1(?,000000FF,?,000000FE,?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459478
Part of subcall function 00459443: lua_pcall.LUA5.1(?,00000000,00000000,00000000), ref: 0045948B
Part of subcall function 00459443: lua_remove.LUA5.1(?,000000FF), ref: 0045949A

Part of subcall function 004597A0: __EH_prolog3.LIBCMT ref: 004597A7
Part of subcall function 004597A0: lua_gettop.LUA5.1(?,00000000,00000000,00000008,004076D1,?,00000002,?), ref: 004597D3

Part of subcall function 00459852: __EH_prolog3.LIBCMT ref: 00459859
Part of subcall function 00459852: lua_tolstring.LUA5.1(?,?,00000000,00000000,00000000,0000000C,004082AF,?,00000002,?,00000001,?,00000002), ref: 0045988A

Part of subcall function 00401BAB: __EH_prolog3.LIBCMT ref: 00401BB2

Part of subcall function 00477AD1: lua_getfield.LUA5.1(?,FFFFD8EE,System), ref: 00477AE4
Part of subcall function 00477AD1: lua_type.LUA5.1(?,000000FF,?,FFFFD8EE,System), ref: 00477AEC
Part of subcall function 00477AD1: lua_pushstring.LUA5.1(?,UserSIDError), ref: 00477AFF
Part of subcall function 00477AD1: lua_pushnumber.LUA5.1(?,?,UserSIDError), ref: 00477B18
Part of subcall function 00477AD1: lua_settable.LUA5.1(?,000000FD,?,?,UserSIDError), ref: 00477B20
Part of subcall function 00477AD1: lua_settop.LUA5.1(?,000000FE), ref: 00477B2B

ConvertSidToStringSidA.ADVAPI32(00000000,?), ref: 0047A0B0
GetLastError.KERNEL32 ref: 0047A0CF
LocalFree.KERNEL32(?), ref: 0047A0DB
lua_pushstring.LUA5.1(?,00000000,?,00000000,?,?,00000000), ref: 0047A0FE

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: H_prolog3$lua_pushstring.$lua_getfield.lua_remove.lua_type.$ConvertErrorFreeLastLocalStringlua_gettable.lua_gettop.lua_pcall.lua_pushnumber.lua_settable.lua_settop.lua_tolstring.
String ID:
API String ID: 2413815711-0
Opcode ID: d4e7eec4a9516925b4f7c10296ce8e1580c3defc767dd86ff62d9c6f3afe51d6
Instruction ID: 88765f4fcc436cf0771b062fd37eae9243fd452fba4b5f66a5f8979f63d892c3
Opcode Fuzzy Hash: d4e7eec4a9516925b4f7c10296ce8e1580c3defc767dd86ff62d9c6f3afe51d6
Instruction Fuzzy Hash: D4219571C0410AABDF01BFA5CC42BEE7B79EF15319F10441AF510B21D2EB7D5A158AAA

Uniqueness

Uniqueness Score: -1.00%

Function 004B401C Relevance: 7.6, APIs: 5, Instructions: 65windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004B4023

Part of subcall function 004B3C8A: _malloc.LIBCMT ref: 004B3CA8

__CxxThrowException@8.LIBCMT ref: 004B4068
FormatMessageA.KERNEL32(00001100,00000000,8007000E,00000800,?,00000000,00000000,?,?,8007000E,0072BA34,00000004,00401307,8007000E), ref: 004B4093
__cftof.LIBCMT ref: 004B40B1

Part of subcall function 005BB686: __mbsnbcpy_s_l.LIBCMT ref: 005BB699

Part of subcall function 004073BE: __CxxThrowException@8.LIBCMT ref: 004B4C72
Part of subcall function 004073BE: __EH_prolog3.LIBCMT ref: 004B4C7F

LocalFree.KERNEL32(?), ref: 004B40C2

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: Exception@8H_prolog3Throw$FormatFreeLocalMessage__cftof__mbsnbcpy_s_l_malloc
String ID:
API String ID: 2344462309-0
Opcode ID: 924acb030b0dd5709970d9ca210fc530f80b3592b620febc06fbb0cd3e6a15e0
Instruction ID: 8385308ff0b6711cd09086404dae78498f7e4cd3f0ba4cc3dfd4f0a57bcddeee
Opcode Fuzzy Hash: 924acb030b0dd5709970d9ca210fc530f80b3592b620febc06fbb0cd3e6a15e0
Instruction Fuzzy Hash: 33112672500209AFEB10EF94CC81AEE3BA8FF04750F20852AFA658A192D774DD008BA0

Uniqueness

Uniqueness Score: -1.00%

Function 0047A327 Relevance: 7.5, APIs: 5, Instructions: 44COMMON

Download Yara Rule

APIs

Part of subcall function 00459443: lua_getfield.LUA5.1(?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459455
Part of subcall function 00459443: lua_pushstring.LUA5.1(?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459460
Part of subcall function 00459443: lua_gettable.LUA5.1(?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459468
Part of subcall function 00459443: lua_remove.LUA5.1(?,000000FE,?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459470
Part of subcall function 00459443: lua_type.LUA5.1(?,000000FF,?,000000FE,?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459478
Part of subcall function 00459443: lua_pcall.LUA5.1(?,00000000,00000000,00000000), ref: 0045948B
Part of subcall function 00459443: lua_remove.LUA5.1(?,000000FF), ref: 0045949A

Part of subcall function 004597A0: __EH_prolog3.LIBCMT ref: 004597A7
Part of subcall function 004597A0: lua_gettop.LUA5.1(?,00000000,00000000,00000008,004076D1,?,00000002,?), ref: 004597D3

Part of subcall function 004599E0: __EH_prolog3.LIBCMT ref: 004599E7
Part of subcall function 004599E0: lua_type.LUA5.1(?,?,00000000,00000000,0000000C,004085AC,?,?,00000024), ref: 00459A16

lua_pushnil.LUA5.1(?,?,00000001,?,00000001,?), ref: 0047A34A
lua_next.LUA5.1(?,00000001,?,?,00000001,?,00000001,?), ref: 0047A352
lua_settop.LUA5.1(?,000000FE), ref: 0047A362
lua_next.LUA5.1(?,00000001,?,000000FE), ref: 0047A36A
lua_pushnumber.LUA5.1(?,?,00000000), ref: 0047A384

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: H_prolog3lua_next.lua_remove.lua_type.$lua_getfield.lua_gettable.lua_gettop.lua_pcall.lua_pushnil.lua_pushnumber.lua_pushstring.lua_settop.
String ID:
API String ID: 377322443-0
Opcode ID: 0128b5d3d4cde5198e8f1a01fb3d9ea2cea6d80a44ec2ae0b26fa119d3e878f9
Instruction ID: 2e8fff610f2c092369eccec324a390fcb3a8ac0456f987f3f66d148c2db4a6b4
Opcode Fuzzy Hash: 0128b5d3d4cde5198e8f1a01fb3d9ea2cea6d80a44ec2ae0b26fa119d3e878f9
Instruction Fuzzy Hash: AAF06D72919524B6DA113AA74C43FDF355C9F1231EF10004AFD04B1083EAAD9B0242BF

Uniqueness

Uniqueness Score: -1.00%

Function 00450298 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 212COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0045029F

Part of subcall function 00450222: __mbsinc.LIBCMT ref: 00450248

Part of subcall function 0040C75B: __EH_prolog3.LIBCMT ref: 0040C762

Part of subcall function 00401BAB: __EH_prolog3.LIBCMT ref: 00401BB2

Part of subcall function 0045198A: __EH_prolog3.LIBCMT ref: 00451991

Part of subcall function 004014A6: _memcpy_s.LIBCMT ref: 004014F6

Part of subcall function 0040C6E5: __mbsinc.LIBCMT ref: 0040C70E

Part of subcall function 005B5A3A: __waccess_s.LIBCMT ref: 005B5A45

Strings

.EXE, xrefs: 00450447
%s\shell\open\command, xrefs: 004503D1
NONE, xrefs: 00450375, 0045037A, 004503EB

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: H_prolog3$__mbsinc$__waccess_s_memcpy_s
String ID: %s\shell\open\command$.EXE$NONE
API String ID: 3389249389-1731575293
Opcode ID: df90cf1c473f11c74c0984262d09bed065412bc5df3f6e4dd4b453a3d6d12b7d
Instruction ID: a80df439b8a52fc51525319e28b154746fb3562db487d4f90617a527fd395898
Opcode Fuzzy Hash: df90cf1c473f11c74c0984262d09bed065412bc5df3f6e4dd4b453a3d6d12b7d
Instruction Fuzzy Hash: 06817171C00148EBCB04EBE5C852BEEBBB8AF15318F14415EF415B72D2DB785A04CB6A

Uniqueness

Uniqueness Score: -1.00%

Function 00456563 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 172COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0045656A

Part of subcall function 00401BAB: __EH_prolog3.LIBCMT ref: 00401BB2

Part of subcall function 004019B2: _strlen.LIBCMT ref: 004019C2

Strings

PROXY, xrefs: 004565D9
SOCKS, xrefs: 00456683
DIRECT, xrefs: 004565A5

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: H_prolog3$_strlen
String ID: DIRECT$PROXY$SOCKS
API String ID: 3239654323-4104639072
Opcode ID: a918144667e1fba5714fa05b721d1be282dde8a517ebb17c2f31dd819da233c5
Instruction ID: 966d4d5a08026b86b27771dd517caa850658ab183deabed4d714cb91f7a06f6a
Opcode Fuzzy Hash: a918144667e1fba5714fa05b721d1be282dde8a517ebb17c2f31dd819da233c5
Instruction Fuzzy Hash: 3951B571500149EBCF04EFB4C952ADE3B68AF14318F10426EBD55B73D2DB38AA54C7A5

Uniqueness

Uniqueness Score: -1.00%

Function 004AA50A Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 139COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 004AA511

Part of subcall function 004A912C: IsWindow.USER32(?), ref: 004A9143

Part of subcall function 0040C75B: __EH_prolog3.LIBCMT ref: 0040C762

Part of subcall function 00405B76: __EH_prolog3.LIBCMT ref: 00405B7D

Strings

<html>, xrefs: 004AA57B
<//html>, xrefs: 004AA586
<HTML, xrefs: 004AA565

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: H_prolog3$H_prolog3_catchWindow
String ID: <//html>$<HTML$<html>
API String ID: 1732688955-2422906094
Opcode ID: 3b6a04b0e3c77a2158de1d9c04cdb7b7f5441d205fb4c5ab9e3d5ba9402dbe37
Instruction ID: e3d4836bbeb1ca7a503d12168d8d734c6c43cf3d436befa448b46516d05d584e
Opcode Fuzzy Hash: 3b6a04b0e3c77a2158de1d9c04cdb7b7f5441d205fb4c5ab9e3d5ba9402dbe37
Instruction Fuzzy Hash: 2841A771800509AFDB04EFB4C891DFE77A9AF25318F14411EF156672D1DB386E09CB69

Uniqueness

Uniqueness Score: -1.00%

Function 005DA259 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 137COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 005DA260

Part of subcall function 005D31F9: __EH_prolog3_catch.LIBCMT ref: 005D3200
Part of subcall function 005D31F9: TlsGetValue.KERNEL32(00000000,0000000C,005D68EE,00000408,005D2578,00000011,is5_GetHBITMAPDimensions,00000000), ref: 005D3217
Part of subcall function 005D31F9: TlsSetValue.KERNEL32(?,00000000), ref: 005D324E
Part of subcall function 005D31F9: GetLastError.KERNEL32(?,00000000), ref: 005D3258
Part of subcall function 005D31F9: __CxxThrowException@8.LIBCMT ref: 005D326A
Part of subcall function 005D31F9: RtlEnterCriticalSection.NTDLL(?), ref: 005D3273
Part of subcall function 005D31F9: RtlLeaveCriticalSection.NTDLL(?), ref: 005D3289

Strings

\lv, xrefs: 005DA3B5
\lv, xrefs: 005DA26A
\lv, xrefs: 005DA304

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: CriticalSectionValue$EnterErrorException@8H_prolog3H_prolog3_catchLastLeaveThrow
String ID: \lv$\lv$\lv
API String ID: 3824262711-4218718864
Opcode ID: 56aa0ece9236ba82f7487c225eaf0c5477ed2cc403817d116b7db424502004bc
Instruction ID: 87ff6bdcbb7c18c9bf9d8aa3027a24873d70cadc41dfe628f9852fbdd59976fc
Opcode Fuzzy Hash: 56aa0ece9236ba82f7487c225eaf0c5477ed2cc403817d116b7db424502004bc
Instruction Fuzzy Hash: 5E41F3316002868FCB248F39C4942EE7FA2FF55311F14856FD8968B381D730CA55CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00422376 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 132COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0042237D

Part of subcall function 00420099: __EH_prolog3.LIBCMT ref: 004200A0

Strings

FolderPath, xrefs: 00422452
Removed! %d, xrefs: 004224C8
UninstallFolders, xrefs: 0042242A

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: H_prolog3
String ID: FolderPath$Removed! %d$UninstallFolders
API String ID: 431132790-11669486
Opcode ID: 216ef09120e3c3e10b2aed0a647c6dedcf0eb063ebf124e8d1f2b7b996ad4821
Instruction ID: 1f25a8f78b31a01330cedd8b0f878c44fc4b09969ae298907611d9b41c84de9b
Opcode Fuzzy Hash: 216ef09120e3c3e10b2aed0a647c6dedcf0eb063ebf124e8d1f2b7b996ad4821
Instruction Fuzzy Hash: 1D41E370900616AFCB04EFA9CD926AEBB74BF14318F50412FF515A72D2CB786A44CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00488164 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 123COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0048816B

Part of subcall function 00401BAB: __EH_prolog3.LIBCMT ref: 00401BB2

Part of subcall function 0048BA06: __EH_prolog3.LIBCMT ref: 0048BA0D

Part of subcall function 004014A6: _memcpy_s.LIBCMT ref: 004014F6

Part of subcall function 0048B96F: __EH_prolog3.LIBCMT ref: 0048B976

Strings

On Start, xrefs: 00488182
On Finish, xrefs: 00488241
%s > %s, xrefs: 00488197, 004881CA, 0048827B

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: H_prolog3$_memcpy_s
String ID: %s > %s$On Finish$On Start
API String ID: 1663610674-2316300774
Opcode ID: 129cba8ad970f4b1f6bcccfab5a3e43e6d706647ee7d6fcc26fa50d970f0c97e
Instruction ID: 646fa91338fe9db11bf972bf1dbc2578417da251673459d34939e2a263e9c43a
Opcode Fuzzy Hash: 129cba8ad970f4b1f6bcccfab5a3e43e6d706647ee7d6fcc26fa50d970f0c97e
Instruction Fuzzy Hash: 3241A271D006059FCB01EFA9C946AAEBBF4EF45314F14055EE150B73A2DB389D00CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 0044E295 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 123COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0044E29C

Part of subcall function 00401BAB: __EH_prolog3.LIBCMT ref: 00401BB2

Part of subcall function 00405B1F: __EH_prolog3.LIBCMT ref: 00405B26

Part of subcall function 0041E239: __mbsinc.LIBCMT ref: 0041E25A

_strlen.LIBCMT ref: 0044E301

Part of subcall function 00403C07: _strnlen.LIBCMT ref: 00403C37
Part of subcall function 00403C07: _memcpy_s.LIBCMT ref: 00403C6B

Part of subcall function 005B5A3A: __waccess_s.LIBCMT ref: 005B5A45

Strings

.bak, xrefs: 0044E2A6
.bak%d, xrefs: 0044E368

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: H_prolog3$__mbsinc__waccess_s_memcpy_s_strlen_strnlen
String ID: .bak$.bak%d
API String ID: 252054876-745829535
Opcode ID: f2798abd04e773b3f924161f2cbc9808147c7744cdd3c33be7328fcbd6f29a78
Instruction ID: a6629165de4a08371d3567a7239a9dfcf3a6bd31bf3181d3c83161df220a6890
Opcode Fuzzy Hash: f2798abd04e773b3f924161f2cbc9808147c7744cdd3c33be7328fcbd6f29a78
Instruction Fuzzy Hash: 7441707180014DDBDB05EBE5CC51AEEB778AF51328F14025EF625B62D2DA386A04CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00450571 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 122COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00450578

Part of subcall function 00405AB7: __mbsinc.LIBCMT ref: 00405AF2

Part of subcall function 0040C75B: __EH_prolog3.LIBCMT ref: 0040C762

Part of subcall function 00405B76: __EH_prolog3.LIBCMT ref: 00405B7D

_strlen.LIBCMT ref: 00450631

Part of subcall function 00403C07: _strnlen.LIBCMT ref: 00403C37
Part of subcall function 00403C07: _memcpy_s.LIBCMT ref: 00403C6B

Strings

LocalMachine, xrefs: 00450650
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 0045065D

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: H_prolog3$__mbsinc_memcpy_s_strlen_strnlen
String ID: LocalMachine$SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
API String ID: 1156756648-2878631348
Opcode ID: cb32c6c4199eddd9a5e64275ed53709d80e8604ef014715f5fb092e4c0a40a5f
Instruction ID: 728b704b949a38a5dc9944357a540339e8ac530d097af4ef2e0b4df00097c061
Opcode Fuzzy Hash: cb32c6c4199eddd9a5e64275ed53709d80e8604ef014715f5fb092e4c0a40a5f
Instruction Fuzzy Hash: 6B417271801048EBDB04EFE5CC55EEFBB78AF61318F10815EB516B72D2DA385A05CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 004D62B9 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 72windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004D62DE
GetSysColor.USER32(00000014), ref: 004D6328
CreateDIBitmap.GDI32(?,00000028,00000004,?,00000028,00000000), ref: 004D637B

Strings

(, xrefs: 004D630C

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: BitmapColorCreate_memset
String ID: (
API String ID: 3930187609-3887548279
Opcode ID: 216ce0dca380e9d8f3a7c483cf183c3586b77cb0e7f2202218da1c2f3407897c
Instruction ID: d3e4e40b265b3f4b0f2ce9cef43c4a227e7a8af8d986203458eb2ef81ac037a8
Opcode Fuzzy Hash: 216ce0dca380e9d8f3a7c483cf183c3586b77cb0e7f2202218da1c2f3407897c
Instruction Fuzzy Hash: C921F531A10258DFEB04CFB8CC16BEDBBF8AB95700F00846EE546E7281DA355A48CB65

Uniqueness

Uniqueness Score: -1.00%

Function 004A6553 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 56COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004A655A

Part of subcall function 004A1C10: __EH_prolog3.LIBCMT ref: 004A1C17

Part of subcall function 004150D3: __EH_prolog3.LIBCMT ref: 004150DA

Part of subcall function 004150D3: _strlen.LIBCMT ref: 00415183
Part of subcall function 004150D3: _strlen.LIBCMT ref: 00415210
Part of subcall function 004150D3: _strlen.LIBCMT ref: 00415231

Part of subcall function 004150D3: _strlen.LIBCMT ref: 00415255
Part of subcall function 004150D3: _strlen.LIBCMT ref: 00415275

Strings

Sorted, xrefs: 004A659F
MultiSelect, xrefs: 004A65E2
ListType, xrefs: 004A65C0

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: _strlen$H_prolog3
String ID: ListType$MultiSelect$Sorted
API String ID: 2883720156-1327083446
Opcode ID: 6cfd3cd8378ca744752cce5539f7a927869b5b290ab7c3d931e48ca329dcacba
Instruction ID: 3fa6e366d7b328a63d6a96c0a2a15c3577d2020135bf5bcc21d6a37d6ff21e8d
Opcode Fuzzy Hash: 6cfd3cd8378ca744752cce5539f7a927869b5b290ab7c3d931e48ca329dcacba
Instruction Fuzzy Hash: 60118A31900108BBCF15BFA1CC56EDF3F6AAF45318F008429BA186B192DB75DA14CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 004A8516 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 56COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004A851D

Part of subcall function 004A1C10: __EH_prolog3.LIBCMT ref: 004A1C17

Part of subcall function 004150D3: __EH_prolog3.LIBCMT ref: 004150DA

Part of subcall function 004150D3: _strlen.LIBCMT ref: 00415183
Part of subcall function 004150D3: _strlen.LIBCMT ref: 00415210
Part of subcall function 004150D3: _strlen.LIBCMT ref: 00415231

Part of subcall function 004150D3: _strlen.LIBCMT ref: 00415255
Part of subcall function 004150D3: _strlen.LIBCMT ref: 00415275

Strings

EndID, xrefs: 004A85A5
Group, xrefs: 004A8562
StartID, xrefs: 004A8583

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: _strlen$H_prolog3
String ID: EndID$Group$StartID
API String ID: 2883720156-2190418817
Opcode ID: 6ad35977dcf7acc4385a170120fef7c0afdfaa9875c5d78e63b3b08d17024b47
Instruction ID: 4f550db60bc2854704c601f39d4e7a7cf6bfdfa23b9dd1421b209e0b60aa2067
Opcode Fuzzy Hash: 6ad35977dcf7acc4385a170120fef7c0afdfaa9875c5d78e63b3b08d17024b47
Instruction Fuzzy Hash: 54113335500108BBCF15BFA1CC56ECE3F6AEF45318F408429BA186B192DB75DB55CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 0046C3CB Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0046C3D2

Part of subcall function 00459443: lua_getfield.LUA5.1(?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459455
Part of subcall function 00459443: lua_pushstring.LUA5.1(?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459460
Part of subcall function 00459443: lua_gettable.LUA5.1(?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459468
Part of subcall function 00459443: lua_remove.LUA5.1(?,000000FE,?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459470
Part of subcall function 00459443: lua_type.LUA5.1(?,000000FF,?,000000FE,?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459478
Part of subcall function 00459443: lua_pcall.LUA5.1(?,00000000,00000000,00000000), ref: 0045948B
Part of subcall function 00459443: lua_remove.LUA5.1(?,000000FF), ref: 0045949A

Part of subcall function 004597A0: __EH_prolog3.LIBCMT ref: 004597A7
Part of subcall function 004597A0: lua_gettop.LUA5.1(?,00000000,00000000,00000008,004076D1,?,00000002,?), ref: 004597D3

Part of subcall function 00459852: __EH_prolog3.LIBCMT ref: 00459859
Part of subcall function 00459852: lua_tolstring.LUA5.1(?,?,00000000,00000000,00000000,0000000C,004082AF,?,00000002,?,00000001,?,00000002), ref: 0045988A

Part of subcall function 00401BAB: __EH_prolog3.LIBCMT ref: 00401BB2

GetProcAddress.KERNEL32(00000000,MsiVerifyPackageA), ref: 0046C40F
lua_pushboolean.LUA5.1(?,00000000,?,00001068), ref: 0046C445

Strings

MsiVerifyPackageA, xrefs: 0046C409

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: H_prolog3$lua_remove.$AddressProclua_getfield.lua_gettable.lua_gettop.lua_pcall.lua_pushboolean.lua_pushstring.lua_tolstring.lua_type.
String ID: MsiVerifyPackageA
API String ID: 4118008204-617025837
Opcode ID: 95bcfcce48990d69094c7a7dd4128b17447598bf75a38b1478d8abdf22871c4c
Instruction ID: 05ac26b780cb0604726968fe31a00a0882ec082fafccb4a282dc66d30486d7ea
Opcode Fuzzy Hash: 95bcfcce48990d69094c7a7dd4128b17447598bf75a38b1478d8abdf22871c4c
Instruction Fuzzy Hash: 9B01F771A10610A7DB00BB728C56BBF31299F91309F44452AB815E72C3FE7DDE0282AF

Uniqueness

Uniqueness Score: -1.00%

Function 004A25B3 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

GetStockObject.GDI32(00000011), ref: 004A25F4
GetObjectA.GDI32(?,0000003C,z&J), ref: 004A2609
CreateFontIndirectA.GDI32(z&J), ref: 004A2613

Strings

z&J, xrefs: 004A2600, 004A260F, 004A2603, 004A2612

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: Object$CreateFontIndirectStock
String ID: z&J
API String ID: 3061784605-4092600126
Opcode ID: b1e28c541fa733d3290d139a2fc9233dc343d6ecbefe1a576e47b4319e408a91
Instruction ID: d492d361b471aba2dfbe452061f2eec14d66e9ddc0ec44344f4b0833b288f7a5
Opcode Fuzzy Hash: b1e28c541fa733d3290d139a2fc9233dc343d6ecbefe1a576e47b4319e408a91
Instruction Fuzzy Hash: A101D471901204EFDB14EFA4CD49FEE77A8BF15704F00406AB50297291EB789E01C798

Uniqueness

Uniqueness Score: -1.00%

Function 00458453 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll), ref: 00458469
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00458479

Strings

kernel32.dll, xrefs: 00458464
Wow64RevertWow64FsRedirection, xrefs: 00458473

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 1646373207-1355242751
Opcode ID: 809e379261778a22049dc7cd900d6a16dc9b88353652d0116b8e4f2c6b3020c2
Instruction ID: 1ff13905a51415e075afe50281d86705b5fc59e357cd74f0587d07b2c5f40283
Opcode Fuzzy Hash: 809e379261778a22049dc7cd900d6a16dc9b88353652d0116b8e4f2c6b3020c2
Instruction Fuzzy Hash: 0FF0A7302443136AEB30AB75AC05B6725995B02753F01C42FBD06F5581FF58C8849515

Uniqueness

Uniqueness Score: -1.00%

Function 004584C3 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 33libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll), ref: 004584D4
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 004584E4

Strings

Wow64DisableWow64FsRedirection, xrefs: 004584DE
kernel32.dll, xrefs: 004584CF

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 1646373207-3689287502
Opcode ID: 7dbde9df1455f64e515b17baf0241a023638ab90d69f93a19855e6eec9b483c7
Instruction ID: 1339a3e163044292a2d6352339026d89d749280eecb5ffce3570e7c95204ada9
Opcode Fuzzy Hash: 7dbde9df1455f64e515b17baf0241a023638ab90d69f93a19855e6eec9b483c7
Instruction Fuzzy Hash: 95E09272258312A6EB60AF757C05BE723CC9F01712B05442FBD01E2281FE68DE459558

Uniqueness

Uniqueness Score: -1.00%

Function 004CC5B9 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 31libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,0000000C,?,004CC6FC,00450998,00000000,0067C48C,0000002E,00450998,00000000,?,?,-00000010,0067C48C,000000FF), ref: 004CC5CB
GetProcAddress.KERNEL32(00000000,GetFileAttributesTransactedA), ref: 004CC5DB

Strings

kernel32.dll, xrefs: 004CC5C6
GetFileAttributesTransactedA, xrefs: 004CC5D5

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetFileAttributesTransactedA$kernel32.dll
API String ID: 1646373207-3426858862
Opcode ID: ca72214b1d173978ed10eca5fa06c6926e6a333da5d28cc2a4b38bbff4a888cd
Instruction ID: eff63673d26a5773e27f7028ad22434c107f854985b6ad7336fb4b345ecede4b
Opcode Fuzzy Hash: ca72214b1d173978ed10eca5fa06c6926e6a333da5d28cc2a4b38bbff4a888cd
Instruction Fuzzy Hash: 15F0A035208214FBCB601FA4DC08FA77B9EAF04761F04942FF808E2560CB75C850DA5C

Uniqueness

Uniqueness Score: -1.00%

Function 004CC609 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 30libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,?,?,004CCA39,?,?,?,?), ref: 004CC61B
GetProcAddress.KERNEL32(00000000,SetFileAttributesTransactedA), ref: 004CC62B

Strings

kernel32.dll, xrefs: 004CC616
SetFileAttributesTransactedA, xrefs: 004CC625

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: SetFileAttributesTransactedA$kernel32.dll
API String ID: 1646373207-2148319600
Opcode ID: 9c08c0872df6669f508016dbc777ecfb01d364b7acf23875c265820d3ef64a2a
Instruction ID: e6e7da15563c68cb6470ea20513956ac45543a69c34b78db2af607744c11e715
Opcode Fuzzy Hash: 9c08c0872df6669f508016dbc777ecfb01d364b7acf23875c265820d3ef64a2a
Instruction Fuzzy Hash: 7FF0E531304200EBCB619FA8ED08FA377DDAB04B51F04602FF808C1550C675C850EA59

Uniqueness

Uniqueness Score: -1.00%

Function 004741EB Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 27COMMON

Download Yara Rule

APIs

luaL_openlib.LUA5.1(00000005,DlgStaticText,00000005,00000000), ref: 0047422D

Strings

SetProperties, xrefs: 0047421F
DlgStaticText, xrefs: 0047420B
GetProperties, xrefs: 00474211

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: L_openlib.
String ID: DlgStaticText$GetProperties$SetProperties
API String ID: 3969157368-645260892
Opcode ID: a290a65a30caca169974793a87624b075e17a436115033dc1d64602be31e8c24
Instruction ID: b22a9d3b8687bd467980c7927fa641c4572775c43c47ab89fe9e9b867a45fb94
Opcode Fuzzy Hash: a290a65a30caca169974793a87624b075e17a436115033dc1d64602be31e8c24
Instruction Fuzzy Hash: 71F01970D00209AF8F04EFA9C54A5FE7FF8EB49744B50845EE015A7241D7B457098F99

Uniqueness

Uniqueness Score: -1.00%

Function 004602CF Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 27COMMON

Download Yara Rule

APIs

luaL_openlib.LUA5.1(00000005,DlgRadioButton,00000005,00000000), ref: 00460311

Strings

SetProperties, xrefs: 00460303
DlgRadioButton, xrefs: 004602EF
GetProperties, xrefs: 004602F5

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: L_openlib.
String ID: DlgRadioButton$GetProperties$SetProperties
API String ID: 3969157368-2764889335
Opcode ID: 2fbab99d4c9cca7a735fbd0945f9b550839291bacf8b3e0679bc07e771acef0f
Instruction ID: d0bef29211921e77e188d1a125ccf3f0f12cf8afbaee966386ff1e9962906c27
Opcode Fuzzy Hash: 2fbab99d4c9cca7a735fbd0945f9b550839291bacf8b3e0679bc07e771acef0f
Instruction Fuzzy Hash: 6FF01970D00209AF8F04EFA9C8465EE7FF4EB49304B50405EE415B7241E7B467098FA9

Uniqueness

Uniqueness Score: -1.00%

Function 00480551 Relevance: 6.1, APIs: 4, Instructions: 139COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 00480568
_strlen.LIBCMT ref: 0048058A

Part of subcall function 0040C40D: _memmove_s.LIBCMT ref: 0040C41C

Part of subcall function 0040A123: _memcpy_s.LIBCMT ref: 0040A132

_strlen.LIBCMT ref: 004805CA
_strlen.LIBCMT ref: 0048068B

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: _strlen$_memcpy_s_memmove_s
String ID:
API String ID: 113752263-0
Opcode ID: a6d2dd262cadd2bbc3807b2a38674347466c67b7b1e3e8040c06a36fcba0e8ab
Instruction ID: 7900f2dea71fa849a8ec511d31eff4f1f4b64b5e13e753643e85aa7c0b6b3f71
Opcode Fuzzy Hash: a6d2dd262cadd2bbc3807b2a38674347466c67b7b1e3e8040c06a36fcba0e8ab
Instruction Fuzzy Hash: 91418272D10229EFCF51EF98D8449AEBBB4FF44310F14481BE815B7201D7386A559F98

Uniqueness

Uniqueness Score: -1.00%

Function 005B85E5 Relevance: 6.1, APIs: 4, Instructions: 130COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 005B8680
__flush.LIBCMT ref: 005B869E
__write.LIBCMT ref: 005B86C5
__flsbuf.LIBCMT ref: 005B86F0

Part of subcall function 005B7892: __getptd_noexit.LIBCMT ref: 005B7892

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: __flsbuf__flush__getptd_noexit__write_memmove
String ID:
API String ID: 2782032738-0
Opcode ID: e30517e5eed2b78d5987cd9bcfbe1bcfaffbb4bb8e8c8801428c975d6827f4bc
Instruction ID: 5adb804a9426d1b3b2281c17dca9d19d36d4a8c09956aca643e959a9b1f86492
Opcode Fuzzy Hash: e30517e5eed2b78d5987cd9bcfbe1bcfaffbb4bb8e8c8801428c975d6827f4bc
Instruction Fuzzy Hash: D441AE31A006059BDB249FA9C8846FEBFB9FFA0364B38A529E41597240DF71FE41CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0045C3FB Relevance: 6.1, APIs: 4, Instructions: 119COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0045C402

Part of subcall function 00459443: lua_getfield.LUA5.1(?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459455
Part of subcall function 00459443: lua_pushstring.LUA5.1(?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459460
Part of subcall function 00459443: lua_gettable.LUA5.1(?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459468
Part of subcall function 00459443: lua_remove.LUA5.1(?,000000FE,?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459470
Part of subcall function 00459443: lua_type.LUA5.1(?,000000FF,?,000000FE,?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459478
Part of subcall function 00459443: lua_pcall.LUA5.1(?,00000000,00000000,00000000), ref: 0045948B
Part of subcall function 00459443: lua_remove.LUA5.1(?,000000FF), ref: 0045949A

Part of subcall function 004597A0: __EH_prolog3.LIBCMT ref: 004597A7
Part of subcall function 004597A0: lua_gettop.LUA5.1(?,00000000,00000000,00000008,004076D1,?,00000002,?), ref: 004597D3

Part of subcall function 00459852: __EH_prolog3.LIBCMT ref: 00459859
Part of subcall function 00459852: lua_tolstring.LUA5.1(?,?,00000000,00000000,00000000,0000000C,004082AF,?,00000002,?,00000001,?,00000002), ref: 0045988A

Part of subcall function 00401BAB: __EH_prolog3.LIBCMT ref: 00401BB2

lua_gettop.LUA5.1(?,?,00000002), ref: 0045C440
lua_isnumber.LUA5.1(?,00000003), ref: 0045C450
lua_pushstring.LUA5.1(?,?), ref: 0045C531

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: H_prolog3$lua_gettop.lua_pushstring.lua_remove.$lua_getfield.lua_gettable.lua_isnumber.lua_pcall.lua_tolstring.lua_type.
String ID:
API String ID: 2155798388-0
Opcode ID: 873ccb128f9632f23a3facc55d4f562449e0385c17cb1957501116e979423948
Instruction ID: 994a313eae519e7559076e8f90161cd1989d5b4ecc068049e11cdd8b5c91e6d7
Opcode Fuzzy Hash: 873ccb128f9632f23a3facc55d4f562449e0385c17cb1957501116e979423948
Instruction Fuzzy Hash: 26417E71D00209AADB05FBF5C992AEEBB74AF15308F10442EF511762D3EB785A09CB69

Uniqueness

Uniqueness Score: -1.00%

Function 0040A160 Relevance: 6.1, APIs: 4, Instructions: 112COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0040A16A
IntersectRect.USER32(?,?,?), ref: 0040A1FF
OffsetRect.USER32(?,?,?), ref: 0040A254
OffsetRect.USER32(?,?,?), ref: 0040A295

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: Rect$Offset$H_prolog3_Intersect
String ID:
API String ID: 356646339-0
Opcode ID: 7fe238366689dbe35e59c5b331e0044029d9fb2150e6b98c08adb5ee4964ff22
Instruction ID: 15408a9fb60d54da1a8cb47ae4eb9be6a8f75fe6670de7a4edd4f6701c09edab
Opcode Fuzzy Hash: 7fe238366689dbe35e59c5b331e0044029d9fb2150e6b98c08adb5ee4964ff22
Instruction Fuzzy Hash: 2441E571D106199FCF14DFA8C984AEEBBB9BF48304F04426EE51AB3250DB34AA45CF64

Uniqueness

Uniqueness Score: -1.00%

Function 004B02FF Relevance: 6.1, APIs: 4, Instructions: 98COMMON

Download Yara Rule

APIs

IsWindow.USER32(?), ref: 004B0327
GetClientRect.USER32(?,?), ref: 004B0363

Part of subcall function 004B871B: GetDlgItem.USER32(?,?), ref: 004B872C

GetWindowRect.USER32(?,?), ref: 004B037F

Part of subcall function 004B791F: ScreenToClient.USER32(?,?), ref: 004B7930
Part of subcall function 004B791F: ScreenToClient.USER32(?,?), ref: 004B793D

GetWindowRect.USER32(?,?), ref: 004B0396

Part of subcall function 004B890D: MoveWindow.USER32(?,?,?,?,?,?), ref: 004B892A

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: Window$ClientRect$Screen$ItemMove
String ID:
API String ID: 198861566-0
Opcode ID: b08d71743050f5cc22f8af101bcaccce2a847cfeb0194766bb56d51693f9ad9e
Instruction ID: 345ed08e0f9f4b7c531e0a2a9b45f16450f0634dd90b742dbe78580ebffb2026
Opcode Fuzzy Hash: b08d71743050f5cc22f8af101bcaccce2a847cfeb0194766bb56d51693f9ad9e
Instruction Fuzzy Hash: 8941C6B1D00219AFCF04DFB9C955AEEBBF9BF48304F10452EE516A3250EB756A10CB64

Uniqueness

Uniqueness Score: -1.00%

Function 004AC239 Relevance: 6.1, APIs: 4, Instructions: 79windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 004AC260
ClientToScreen.USER32(?,?), ref: 004AC2DB
ScreenToClient.USER32(?,?), ref: 004AC2E8
PostMessageA.USER32(?,?,?,?), ref: 004AC305

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: ClientScreen$MessageParentPost
String ID:
API String ID: 1061243768-0
Opcode ID: aeacedc40a1869bc83cf260dc0ebb8eb7ccbe6e07688114a6ca554fc2890f868
Instruction ID: 06363d9323e0d559d1244f2b1486fb16fc487abe3b3adec5bb0e7285aafd6f62
Opcode Fuzzy Hash: aeacedc40a1869bc83cf260dc0ebb8eb7ccbe6e07688114a6ca554fc2890f868
Instruction Fuzzy Hash: 5821F57B911600AFDF654B98C8C8ABB76B9EF26300F14486BE846D1661D73CDC40D729

Uniqueness

Uniqueness Score: -1.00%

Function 0049E675 Relevance: 6.1, APIs: 4, Instructions: 75windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 0049E698
ClientToScreen.USER32(?,?), ref: 0049E713
ScreenToClient.USER32(?,?), ref: 0049E720
PostMessageA.USER32(?,?,?,?), ref: 0049E73D

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: ClientScreen$MessageParentPost
String ID:
API String ID: 1061243768-0
Opcode ID: eab27d46aa6ad2ff844ee8ea324544f74d84520d5aa5dac851b688db8e48c040
Instruction ID: 4bf5e70ec8c75705513fa75a3a6835e4446892fcbcd13e6d91ae5b21b3cd688c
Opcode Fuzzy Hash: eab27d46aa6ad2ff844ee8ea324544f74d84520d5aa5dac851b688db8e48c040
Instruction Fuzzy Hash: 9F21D171511110ABEF298B9AC8889BF7EADEF18310F54083BF851D1671EA78DC50DB29

Uniqueness

Uniqueness Score: -1.00%

Function 00448517 Relevance: 6.1, APIs: 4, Instructions: 63COMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 00448531
WindowFromPoint.USER32(?,?), ref: 0044853D
GetActiveWindow.USER32 ref: 0044856B
InvalidateRect.USER32(?,00000000,00000001,00000000), ref: 0044859F

Part of subcall function 004484F2: InvalidateRect.USER32(00000000,00000000,00000001,00441A29), ref: 00448510

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: InvalidateRectWindow$ActiveClientFromPointScreen
String ID:
API String ID: 2221759807-0
Opcode ID: 005262f34e046df46182577cbae4920de490abcf23c28c87a279b96a4720d46a
Instruction ID: 971592695af4aa4a5c26c97fcb9972cac0caad2c20eb2311cf1197bcaa40fd2e
Opcode Fuzzy Hash: 005262f34e046df46182577cbae4920de490abcf23c28c87a279b96a4720d46a
Instruction Fuzzy Hash: 46215CB1800604EBEB219FA5C848AAFB7F9FF94305F10852FE48682250DF789D40DF69

Uniqueness

Uniqueness Score: -1.00%

Function 004CA253 Relevance: 6.1, APIs: 4, Instructions: 61threadCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004CA25A

Part of subcall function 004C188A: __EH_prolog3.LIBCMT ref: 004C1891

__strdup.LIBCMT ref: 004CA27C
GetCurrentThread.KERNEL32 ref: 004CA2A9
GetCurrentThreadId.KERNEL32 ref: 004CA2B2

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: CurrentH_prolog3Thread$__strdup
String ID:
API String ID: 4206445780-0
Opcode ID: c0329751fec8586060d734211a3b4b4d52b161ede445a0e91d394c00de02558f
Instruction ID: 9cd8d915c63df98dd955c826410fb9da4a31eeb8c51ae84d751a36a164e24194
Opcode Fuzzy Hash: c0329751fec8586060d734211a3b4b4d52b161ede445a0e91d394c00de02558f
Instruction Fuzzy Hash: 9631DDB4900B008ED7619F7AC04578AFBE9BFA4704F10890FD1EA87722DBB4A401CF46

Uniqueness

Uniqueness Score: -1.00%

Function 004B0575 Relevance: 6.0, APIs: 4, Instructions: 41windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004B057C
IsWindow.USER32(?), ref: 004B058B
SendMessageA.USER32(?,000000C5,00000000,00000000), ref: 004B05A8

Part of subcall function 004B8F6B: __EH_prolog3.LIBCMT ref: 004B8F72
Part of subcall function 004B8F6B: GetWindowTextLengthA.USER32(?), ref: 004B8F82

Part of subcall function 00442ADC: SendMessageA.USER32(?,000000B1,?,?), ref: 00442AF7
Part of subcall function 00442ADC: SendMessageA.USER32(?,000000B7,00000000,00000000), ref: 00442B0A

SendMessageA.USER32(?,000000C2,00000000,?), ref: 004B05D4

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: MessageSend$H_prolog3Window$LengthText
String ID:
API String ID: 1634938522-0
Opcode ID: f5706f71f95ab9cd4b7e1098afe1129a5b15131fe7e421ad1d3583af26d102f8
Instruction ID: 486be45daddcbfaa45da6146378adfa51eab473f8a37d5c0ca814d5b3a2eeef1
Opcode Fuzzy Hash: f5706f71f95ab9cd4b7e1098afe1129a5b15131fe7e421ad1d3583af26d102f8
Instruction Fuzzy Hash: AD01A271100601ABE734AF35CD06FEB7AAABF90300F00461EB65A665E1EE707A00DA54

Uniqueness

Uniqueness Score: -1.00%

Function 0040C578 Relevance: 6.0, APIs: 4, Instructions: 36COMMON

Download Yara Rule

APIs

lua_getfield.LUA5.1(0000C259,FFFFD8EE,?,80000000,?,?,00403F08,?), ref: 0040C58C
lua_isnumber.LUA5.1(0000C259,000000FF,0000C259,FFFFD8EE,?,80000000,?,?,00403F08,?), ref: 0040C596
lua_tonumber.LUA5.1(0000C259,000000FF), ref: 0040C5A7
lua_remove.LUA5.1(0000C259,000000FF), ref: 0040C5BA

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: lua_getfield.lua_isnumber.lua_remove.lua_tonumber.
String ID:
API String ID: 2047693980-0
Opcode ID: 6751d414c27cd720c12b7a4c1137f2ce4e9722f4823f3a350f3f74a90acb1605
Instruction ID: 34385ceb871f78d4ee620e2db635cec28b1108594c3489dbcedb0548f7da87a4
Opcode Fuzzy Hash: 6751d414c27cd720c12b7a4c1137f2ce4e9722f4823f3a350f3f74a90acb1605
Instruction Fuzzy Hash: 4AF0E23210821477CA252B6BDD03C6B3E92CE81734320433FF439612E2EE36F91095A8

Uniqueness

Uniqueness Score: -1.00%

Function 0040C5D4 Relevance: 6.0, APIs: 4, Instructions: 35COMMON

Download Yara Rule

APIs

lua_getfield.LUA5.1(0000C259,FFFFD8EE,00000001,?,?,?,00440D2C,?,?,?,00404344,00000000,00000000,00000000,00000000,000000B8), ref: 0040C5E8
lua_type.LUA5.1(0000C259,000000FF,0000C259,FFFFD8EE,00000001,?,?,?,00440D2C,?,?,?,00404344,00000000,00000000,00000000), ref: 0040C5F2
lua_toboolean.LUA5.1(0000C259,000000FF), ref: 0040C604
lua_remove.LUA5.1(0000C259,000000FF), ref: 0040C612

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: lua_getfield.lua_remove.lua_toboolean.lua_type.
String ID:
API String ID: 2181360-0
Opcode ID: 0a9e932b7bf75bf36c58b385ba5dce1262237980049fcf2d383cccddab73c46d
Instruction ID: 506db1f169f80a95bb247d8ae406d5bc8007ee0d7822be24c13746e78d8bbede
Opcode Fuzzy Hash: 0a9e932b7bf75bf36c58b385ba5dce1262237980049fcf2d383cccddab73c46d
Instruction Fuzzy Hash: 6CF08C3210C1147BCA252A5FED02C6B7B96DA92735320472FF539A12E6DE36B910A5A8

Uniqueness

Uniqueness Score: -1.00%

Function 005FA420 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 372COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 005FA427

Strings

\lv, xrefs: 005FA7D2
\lv, xrefs: 005FA5BE

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: H_prolog3
String ID: \lv$\lv
API String ID: 431132790-1248172524
Opcode ID: 2e51a2150feb385538aaae3566f0ab3492fbcb1a3a7e8d4b7917b51b832c5377
Instruction ID: 7801575469546bdde4255b3897a8a7e435586fe5db7334641d7060669f26387e
Opcode Fuzzy Hash: 2e51a2150feb385538aaae3566f0ab3492fbcb1a3a7e8d4b7917b51b832c5377
Instruction Fuzzy Hash: 24F16A71D0025ACFCB14DFA8C8915EDBBB1FF58310F14816EE959AB351E7389A42CB51

Uniqueness

Uniqueness Score: -1.00%

Function 004B2132 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 295COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004B2139

Strings

%K, xrefs: 004B2308, 004B230B
<%K, xrefs: 004B23CF, 004B23D2

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: H_prolog3
String ID: <%K$%K
API String ID: 431132790-1487158298
Opcode ID: 662d31808d6dccbb69c9eb0cce71acfc006ab44d4e00da3550eb790365284d98
Instruction ID: c679ab9cbe7489c915a3320d70f03a24783c85d2b4814257e70945c8ae3cc389
Opcode Fuzzy Hash: 662d31808d6dccbb69c9eb0cce71acfc006ab44d4e00da3550eb790365284d98
Instruction Fuzzy Hash: 7A913E7290011DAADF22DA95CE85EFFBBBCEB45700F104127F601F5180DAB89A45DBB6

Uniqueness

Uniqueness Score: -1.00%

Function 00442467 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 245COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0044246E
_strlen.LIBCMT ref: 004426A0

Part of subcall function 004B4C5C: __CxxThrowException@8.LIBCMT ref: 004B4C72
Part of subcall function 004B4C5C: __EH_prolog3.LIBCMT ref: 004B4C7F

Part of subcall function 00405B1F: __EH_prolog3.LIBCMT ref: 00405B26

Part of subcall function 00405B76: __EH_prolog3.LIBCMT ref: 00405B7D

Strings

NoName, xrefs: 0044269B, 004426A7

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: H_prolog3$Exception@8Throw_strlen
String ID: NoName
API String ID: 2154318092-1084695559
Opcode ID: 93774231e1de5c99e372f070e253fd5cdc666b3d2ba70f37669f898e7253d2f0
Instruction ID: b2e536e41ba0246a01a23077f7dde74dda685924ba56b07aaa4d3ba52b402951
Opcode Fuzzy Hash: 93774231e1de5c99e372f070e253fd5cdc666b3d2ba70f37669f898e7253d2f0
Instruction Fuzzy Hash: 8B91D371900A06DFDB24DFA6C69147EB3B1FF44328790062FF152A6AD1C7B8A981CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0048E172 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 236COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0048E179

Part of subcall function 00495D98: __EH_prolog3.LIBCMT ref: 00495D9F

Part of subcall function 0048E05E: __EH_prolog3.LIBCMT ref: 0048E065

Part of subcall function 004B3C8A: _malloc.LIBCMT ref: 004B3CA8

Strings

IDS_CTRL_STATICTEXT_BOTTOMINSTRUCTIONS, xrefs: 0048E412
IDS_CTRL_STATICTEXT_TOPINSTRUCTIONS, xrefs: 0048E1F4

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: H_prolog3$_malloc
String ID: IDS_CTRL_STATICTEXT_BOTTOMINSTRUCTIONS$IDS_CTRL_STATICTEXT_TOPINSTRUCTIONS
API String ID: 1683881009-824710809
Opcode ID: 6bcbede1c7713aaa10d2d132d8365fedd9982844dbc36baf65b30a92a9d1deab
Instruction ID: 2999f2324eeecc2a0eadd8b716597cb2d5a6676bb906e287740ee8e7becb54c9
Opcode Fuzzy Hash: 6bcbede1c7713aaa10d2d132d8365fedd9982844dbc36baf65b30a92a9d1deab
Instruction Fuzzy Hash: 59A15FB1D00606DFDB14DFBAC5416AEB7F4BF09314F10461EE169A32D1DB786A01CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 004245B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 157COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004245B7

Part of subcall function 00440C8A: __EH_prolog3.LIBCMT ref: 00440C91

_strlen.LIBCMT ref: 004246AC

Part of subcall function 00403C07: _strnlen.LIBCMT ref: 00403C37
Part of subcall function 00403C07: _memcpy_s.LIBCMT ref: 00403C6B

Strings

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: H_prolog3$_memcpy_s_strlen_strnlen
String ID: Register font: %s, %s
API String ID: 1892780499-1918436487
Opcode ID: 3031135e3dc7cb32d035659fa0f86f9abc91641544572cc412eb616cec5fd7f3
Instruction ID: 3be5a281e179cc889407efed01865bd8deb8d50b7fc2c557ad6e33542b7f63c8
Opcode Fuzzy Hash: 3031135e3dc7cb32d035659fa0f86f9abc91641544572cc412eb616cec5fd7f3
Instruction Fuzzy Hash: 8F519071D001499FCB04EBF5CC96AEEBB74AF51318F54416EF112B72D2DA386A04CB69

Uniqueness

Uniqueness Score: -1.00%

Function 004220BA Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 108COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004220C1

Part of subcall function 00420099: __EH_prolog3.LIBCMT ref: 004200A0

Strings

UninstallSupportFiles, xrefs: 00422170
Filename, xrefs: 0042218E

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: H_prolog3
String ID: Filename$UninstallSupportFiles
API String ID: 431132790-55940283
Opcode ID: 1277dcaa622907119764ad5e5faea075ac53874c9df902febed5b4e412c3f1a1
Instruction ID: 47b24c476e0377023b4d4f50175e69a259599bde5f67da7d036f474b1a809ac7
Opcode Fuzzy Hash: 1277dcaa622907119764ad5e5faea075ac53874c9df902febed5b4e412c3f1a1
Instruction Fuzzy Hash: EA41B670A006259BCF14EFA9D9116BE77F5BF54314F10421FE111A73D2CBBC5A418B9A

Uniqueness

Uniqueness Score: -1.00%

Function 00422218 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 108COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0042221F

Part of subcall function 00420099: __EH_prolog3.LIBCMT ref: 004200A0

Strings

UninstallShortcuts, xrefs: 004222CE
Filename, xrefs: 004222EC

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: H_prolog3
String ID: Filename$UninstallShortcuts
API String ID: 431132790-4021962188
Opcode ID: fc7b65e8f180523d8cff9d306d9e2f527034efedd4be07ab3745435a35caa7a6
Instruction ID: 42fc102d8ea62ab7d67fa21a25c247ed79968e0ed36cf2968324f5bd4d24e061
Opcode Fuzzy Hash: fc7b65e8f180523d8cff9d306d9e2f527034efedd4be07ab3745435a35caa7a6
Instruction Fuzzy Hash: DC41D470A00625DBCF14EFA9D9016AEBBE5AF54314F14024FE415A73D2CBBC5A40CBAE

Uniqueness

Uniqueness Score: -1.00%

Function 004264B1 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 103COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004264B8

Part of subcall function 0041955F: __EH_prolog3.LIBCMT ref: 00419566

Part of subcall function 0040C75B: __EH_prolog3.LIBCMT ref: 0040C762

Part of subcall function 0043A00F: __EH_prolog3.LIBCMT ref: 0043A016

Part of subcall function 00401BAB: __EH_prolog3.LIBCMT ref: 00401BB2

Part of subcall function 004014A6: _memcpy_s.LIBCMT ref: 004014F6

Part of subcall function 00405D33: __EH_prolog3.LIBCMT ref: 00405D3A

Part of subcall function 0040C75B: _strlen.LIBCMT ref: 0040C79F

Strings

Run project event: , xrefs: 0042659D
Start project event: , xrefs: 00426508

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: H_prolog3$_memcpy_s_strlen
String ID: Run project event: $Start project event:
API String ID: 4110081478-2638573925
Opcode ID: 9af03919ad98ea2ff44c1bdc72abefa017b8349485456150be635f3fb2498c9e
Instruction ID: 5cc4c3c62b65d79466555cef047e22551e79e3c5d189eaad7bd2e67f678267b0
Opcode Fuzzy Hash: 9af03919ad98ea2ff44c1bdc72abefa017b8349485456150be635f3fb2498c9e
Instruction Fuzzy Hash: AF31FAB2900149EFDB00DFACCC42AAE7BA8AF15334F05425FF114A73D2DB38594087AA

Uniqueness

Uniqueness Score: -1.00%

Function 004162F8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 76COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004162FF

Part of subcall function 005B5F48: __mbschr_l.LIBCMT ref: 005B5F55

Part of subcall function 00401614: _memcpy_s.LIBCMT ref: 00401664

Part of subcall function 004162A0: __EH_prolog3.LIBCMT ref: 004162A7

Part of subcall function 00414641: __EH_prolog3.LIBCMT ref: 00414648

Strings

encoding, xrefs: 0041639B
?, xrefs: 00416339

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: H_prolog3$__mbschr_l_memcpy_s
String ID: ?$encoding
API String ID: 1563950669-2818917450
Opcode ID: 198f5a37f27b20e401cef653bdcc962bb93af6b701c9a748b9e95fe7af228fd1
Instruction ID: 8beec658f47c173e54bf494b5a1f7cb827fbdb7c5fe12a14deec660935adfa82
Opcode Fuzzy Hash: 198f5a37f27b20e401cef653bdcc962bb93af6b701c9a748b9e95fe7af228fd1
Instruction Fuzzy Hash: 8521DE71D00218ABCB05EFE4C842AEEBBB8AF54714F50405EB415BB2D1DB786E44CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 004640DD Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 004640E4

Part of subcall function 00459443: lua_getfield.LUA5.1(?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459455
Part of subcall function 00459443: lua_pushstring.LUA5.1(?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459460
Part of subcall function 00459443: lua_gettable.LUA5.1(?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459468
Part of subcall function 00459443: lua_remove.LUA5.1(?,000000FE,?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459470
Part of subcall function 00459443: lua_type.LUA5.1(?,000000FF,?,000000FE,?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459478
Part of subcall function 00459443: lua_pcall.LUA5.1(?,00000000,00000000,00000000), ref: 0045948B
Part of subcall function 00459443: lua_remove.LUA5.1(?,000000FF), ref: 0045949A

Part of subcall function 004597A0: __EH_prolog3.LIBCMT ref: 004597A7
Part of subcall function 004597A0: lua_gettop.LUA5.1(?,00000000,00000000,00000008,004076D1,?,00000002,?), ref: 004597D3

Part of subcall function 00459852: __EH_prolog3.LIBCMT ref: 00459859
Part of subcall function 00459852: lua_tolstring.LUA5.1(?,?,00000000,00000000,00000000,0000000C,004082AF,?,00000002,?,00000001,?,00000002), ref: 0045988A

Part of subcall function 00401BAB: __EH_prolog3.LIBCMT ref: 00401BB2

Part of subcall function 0045974C: __EH_prolog3.LIBCMT ref: 00459753

ShellExecuteA.SHELL32(?,print,?,00000000,006985B8,00000001), ref: 00464165

Strings

print, xrefs: 0046415F

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: H_prolog3$lua_remove.$ExecuteH_prolog3_catchShelllua_getfield.lua_gettable.lua_gettop.lua_pcall.lua_pushstring.lua_tolstring.lua_type.
String ID: print
API String ID: 3443421824-366378086
Opcode ID: 15441bc6f606fc1d2fbb40ca625243c4ae6607939cf1c96797288d8a71100e37
Instruction ID: eba65f6731d70616b561b17330c5d0e9bf965a57260831191e73eadb3b29bd5b
Opcode Fuzzy Hash: 15441bc6f606fc1d2fbb40ca625243c4ae6607939cf1c96797288d8a71100e37
Instruction Fuzzy Hash: 6B21D072800204EFCF14ABA9CC46ADE7BB5AF55324F14415EF414B72E2DA784E418795

Uniqueness

Uniqueness Score: -1.00%

Function 005D638F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 005D63D4
_memmove.LIBCMT ref: 005D6404

Strings

string too long, xrefs: 005D63CF

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: Xinvalid_argument_memmovestd::_
String ID: string too long
API String ID: 256744135-2556327735
Opcode ID: 0629f4484b26a44fc1a56b01b1647ad36a0802f28c3f333f901848276b3a90bd
Instruction ID: 077f7d89b475d6e683ab414d4bce797751aafec1e2986c2e42f4a95046fee9f1
Opcode Fuzzy Hash: 0629f4484b26a44fc1a56b01b1647ad36a0802f28c3f333f901848276b3a90bd
Instruction Fuzzy Hash: 7A11BF313002509BDB349E2D989192ABFF9FF81750B100D2FF5928B382CBB1E8068795

Uniqueness

Uniqueness Score: -1.00%

Function 0048847B Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 63COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00488482

Part of subcall function 00401BAB: __EH_prolog3.LIBCMT ref: 00401BB2

Part of subcall function 0048BA06: __EH_prolog3.LIBCMT ref: 0048BA0D

Part of subcall function 004014A6: _memcpy_s.LIBCMT ref: 004014F6

Part of subcall function 0048B96F: __EH_prolog3.LIBCMT ref: 0048B976

Strings

On Cancel, xrefs: 00488499
%s > %s, xrefs: 004884D3

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: H_prolog3$_memcpy_s
String ID: %s > %s$On Cancel
API String ID: 1663610674-4107358699
Opcode ID: ae21eaec5ed2107657d045b7b07a1d06c283dbdacee6d3e73f929ce8cba5501b
Instruction ID: c8f999d9bd459b61b5cb77a64eb0f9c51b2f0f945836efb90cde309488d13f0d
Opcode Fuzzy Hash: ae21eaec5ed2107657d045b7b07a1d06c283dbdacee6d3e73f929ce8cba5501b
Instruction Fuzzy Hash: AA21A470900605AFCB05FFB9C942BAEBBB5AF44714F54091EF051B7292DB385A00CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 004883AF Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 62COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004883B6

Part of subcall function 00401BAB: __EH_prolog3.LIBCMT ref: 00401BB2

Part of subcall function 0048BA06: __EH_prolog3.LIBCMT ref: 0048BA0D

Part of subcall function 004014A6: _memcpy_s.LIBCMT ref: 004014F6

Part of subcall function 0048B96F: __EH_prolog3.LIBCMT ref: 0048B976

Strings

On Cancel, xrefs: 004883CD
%s > %s, xrefs: 00488407

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: H_prolog3$_memcpy_s
String ID: %s > %s$On Cancel
API String ID: 1663610674-4107358699
Opcode ID: ea2a26cc739851528c1b89963832d3021b83f2bffad37e885242eff9091fca3d
Instruction ID: c89c011d05bc630bf2a469a0269bd86a11688692109d5cb697d4e426d6be56fe
Opcode Fuzzy Hash: ea2a26cc739851528c1b89963832d3021b83f2bffad37e885242eff9091fca3d
Instruction Fuzzy Hash: 5421A170900605AFCB05FFA9C942BAEBBB5AF44714F54051EF0517B292DB386A008BA6

Uniqueness

Uniqueness Score: -1.00%

Function 004C6401 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004C6408
SetRectEmpty.USER32(?), ref: 004C64AA

Strings

]BL, xrefs: 004C6419

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: EmptyH_prolog3Rect
String ID: ]BL
API String ID: 1443337074-637551821
Opcode ID: d1314e7f394a8d5293840de06f1a2fc5423b55e0776975a8a518fd1489feb5d1
Instruction ID: af16234a0bd55b8f225354b7cc0055cc49a466b223a0746b518ddba455388b9e
Opcode Fuzzy Hash: d1314e7f394a8d5293840de06f1a2fc5423b55e0776975a8a518fd1489feb5d1
Instruction Fuzzy Hash: 9C31AEB0801B41CED365DF6AC58179AFAE8BFA0300F108A4FD1EA972A1DBB42144CF65

Uniqueness

Uniqueness Score: -1.00%

Function 00404384 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0040438B

Part of subcall function 00401BAB: __EH_prolog3.LIBCMT ref: 00401BB2

Part of subcall function 0043C227: __EH_prolog3.LIBCMT ref: 0043C22E

Part of subcall function 0043C227: __EH_prolog3.LIBCMT ref: 0043C2C6

Strings

MSG_CONFIRM, xrefs: 004043B7
MSG_CONFIRM_ABORT, xrefs: 004043E2

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: H_prolog3
String ID: MSG_CONFIRM$MSG_CONFIRM_ABORT
API String ID: 431132790-3415406682
Opcode ID: ed91f5e3794348906fb2e5210c6d6c2ece073984418fe557395350b6e4e5c49b
Instruction ID: b74d0410de679e83c8f4f0dc2158e86b29b409bd476c9e7865942af7c707a1c5
Opcode Fuzzy Hash: ed91f5e3794348906fb2e5210c6d6c2ece073984418fe557395350b6e4e5c49b
Instruction Fuzzy Hash: 5411A370A001469FCB04EBE9CD92BBD37B6AF56728F00016EF2157B2D2CB7C1900875A

Uniqueness

Uniqueness Score: -1.00%

Function 0046A4E1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00459443: lua_getfield.LUA5.1(?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459455
Part of subcall function 00459443: lua_pushstring.LUA5.1(?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459460
Part of subcall function 00459443: lua_gettable.LUA5.1(?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459468
Part of subcall function 00459443: lua_remove.LUA5.1(?,000000FE,?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459470
Part of subcall function 00459443: lua_type.LUA5.1(?,000000FF,?,000000FE,?,000000FE,?,ResetLastError,?,FFFFD8EE,Application,?,?,004076C5,?), ref: 00459478
Part of subcall function 00459443: lua_pcall.LUA5.1(?,00000000,00000000,00000000), ref: 0045948B
Part of subcall function 00459443: lua_remove.LUA5.1(?,000000FF), ref: 0045949A

Part of subcall function 004597A0: __EH_prolog3.LIBCMT ref: 004597A7
Part of subcall function 004597A0: lua_gettop.LUA5.1(?,00000000,00000000,00000008,004076D1,?,00000002,?), ref: 004597D3

GetProcAddress.KERNEL32(00000000,MsiCloseHandle), ref: 0046A518
lua_pushboolean.LUA5.1(?,00000000,?,00001068), ref: 0046A54C

Strings

MsiCloseHandle, xrefs: 0046A512

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: lua_remove.$AddressH_prolog3Proclua_getfield.lua_gettable.lua_gettop.lua_pcall.lua_pushboolean.lua_pushstring.lua_type.
String ID: MsiCloseHandle
API String ID: 4025865003-1311317158
Opcode ID: dc6e089bd59f491c7e3030d6111bb118c987abc4922721f1cfc76e1d38ede4fe
Instruction ID: f6ef1090552a6ac81d90a0435019368be0c30177b7b8bdcdcf99600fdd8487e9
Opcode Fuzzy Hash: dc6e089bd59f491c7e3030d6111bb118c987abc4922721f1cfc76e1d38ede4fe
Instruction Fuzzy Hash: A7F0FC32614B10B6D60076B65C06AAF204D8FC2799B440427BC05E7242FE6DDE2745BF

Uniqueness

Uniqueness Score: -1.00%

Function 0048E05E Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 43COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0048E065

Strings

IDS_CTRL_BUTTON_%.2d, xrefs: 0048E08C
IDS_CTRL_STATICTEXT_LABEL_%.2d, xrefs: 0048E0AA

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: H_prolog3
String ID: IDS_CTRL_BUTTON_%.2d$IDS_CTRL_STATICTEXT_LABEL_%.2d
API String ID: 431132790-4255241125
Opcode ID: 0f518fa13e8a4e84567f2e4f815177e42e85812197b579bbae6310d53bf1e8e2
Instruction ID: a1befac484598a0effb131b5ed7314aab088a99fb4c1e66d3219876346b61753
Opcode Fuzzy Hash: 0f518fa13e8a4e84567f2e4f815177e42e85812197b579bbae6310d53bf1e8e2
Instruction Fuzzy Hash: 3301A2B2C00119A7CB14FBA5CC56BEE73B8BF50714F94062EB562F71C2DE785A05C668

Uniqueness

Uniqueness Score: -1.00%

Function 0049866D Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 32COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00498674

Part of subcall function 00497EA3: __EH_prolog3.LIBCMT ref: 00497EAA

Part of subcall function 004019B2: _strlen.LIBCMT ref: 004019C2

Strings

%RadioSelection%, xrefs: 004986C7
r|I, xrefs: 00498687

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: H_prolog3$_strlen
String ID: %RadioSelection%$r|I
API String ID: 3239654323-1081963028
Opcode ID: d6fef407ab31b7f7d67ce250c08820895125bea95f8e71c364612086cc800022
Instruction ID: 405d4f114293bca0a1774b08168fef44fc3748a0c1cee4de86fc29faf36e4140
Opcode Fuzzy Hash: d6fef407ab31b7f7d67ce250c08820895125bea95f8e71c364612086cc800022
Instruction Fuzzy Hash: ECF0F4B0544B419ADB24FF74C8067CEBAA06F00704F10055EF1D9A71C2CBF83644CB69

Uniqueness

Uniqueness Score: -1.00%

Function 005D2668 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 005D2693
__CxxThrowException@8.LIBCMT ref: 005D26A8

Part of subcall function 004B3C8A: _malloc.LIBCMT ref: 004B3CA8

Strings

1], xrefs: 005D2690, 005D269D, 005D26A0

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: Exception@8Throw_mallocstd::exception::exception
String ID: 1]
API String ID: 4063778783-588761190
Opcode ID: 04b04c9d25932102da9d1af3aa80f28ac78f7461938b1118d20db1635030cb8e
Instruction ID: 4fc5dceb73d861248b0dee42824bbf973e929fa364b0b5bf0c6afa97740f0aef
Opcode Fuzzy Hash: 04b04c9d25932102da9d1af3aa80f28ac78f7461938b1118d20db1635030cb8e
Instruction Fuzzy Hash: 03E06575800309AADF10EF65C845ADD7FA8BF10395F10826BB42495180DB70D744CE91

Uniqueness

Uniqueness Score: -1.00%

Function 004B61E9 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004B61F0

Part of subcall function 004B3C8A: _malloc.LIBCMT ref: 004B3CA8

__CxxThrowException@8.LIBCMT ref: 004B6226

Part of subcall function 004B6173: __EH_prolog3.LIBCMT ref: 004B617A

Strings

0]t, xrefs: 004B622C

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: H_prolog3$Exception@8Throw_malloc
String ID: 0]t
API String ID: 623675022-2203560638
Opcode ID: 639bd072cb463862da0b7dd6141d8e887715f74e6b4cb4b030181cfcdd3a3864
Instruction ID: 00162f30cf395f21f0a3301171a36453b87edc4164beac87a5935079d9aacba4
Opcode Fuzzy Hash: 639bd072cb463862da0b7dd6141d8e887715f74e6b4cb4b030181cfcdd3a3864
Instruction Fuzzy Hash: FCE01275A4021AABDF18FFB88916AED7EB1BF04310F504A3EF118E61D1D7788B019B24

Uniqueness

Uniqueness Score: -1.00%

Function 004E45EF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24libraryloaderCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004E45F6
GetProcAddress.KERNEL32(00000000,?), ref: 004E462F

Part of subcall function 004BAEB1: ActivateActCtx.KERNEL32(?,00000000,0072C0F0,00000010,0050A8A2,UxTheme.dll,751F6910,?,0050A963,00000004,004E9366,00000000,00000004,0051D8CE), ref: 004BAED1

Strings

UxTheme.dll, xrefs: 004E460F

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: ActivateAddressH_prolog3Proc
String ID: UxTheme.dll
API String ID: 323876227-352951104
Opcode ID: 50166dbadba51d9da611f643c292a7bb31559f8e8c45418e29fcf56b6d0f071b
Instruction ID: c17a6f22cd64c0ccba68aed6b89f4e65371ec8b02ce3afa5d47a7adf6a93e671
Opcode Fuzzy Hash: 50166dbadba51d9da611f643c292a7bb31559f8e8c45418e29fcf56b6d0f071b
Instruction Fuzzy Hash: 36E03034A002805ADB149F35991539A3BE47B84756F848146F804D7291EB7C9D418B58

Uniqueness

Uniqueness Score: -1.00%

Function 00454035 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 18COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0045403C
GetCurrentProcessId.KERNEL32(00000004), ref: 0045404C

Strings

+DD, xrefs: 00454046

Memory Dump Source

Source File: 00000001.00000002.375221850.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.375133532.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000742000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000769000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.0000000000771000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.375221850.00000000007BE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378186034.00000000007C2000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.378190446.00000000007C3000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_irsetup.jbxd

Similarity

API ID: CurrentH_prolog3Process
String ID: +DD
API String ID: 2762645583-788365211
Opcode ID: 9a172b0e33e9eb09d29a16857f11ef45b246f56000493d4b499e655d0b0b8697
Instruction ID: e61632d9b028c084b646b49c2df976541f9aa02888915503c18666ccf01b4663
Opcode Fuzzy Hash: 9a172b0e33e9eb09d29a16857f11ef45b246f56000493d4b499e655d0b0b8697
Instruction Fuzzy Hash: 75E04FB45006118BDB18FFA8850638DBAF1AF84704F00885EE08557242EBB85E45CBA6

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry. Service configurations can be modified using utilities such as sc.exe and Reg .
Tactics:	Persistence, Privilege Escalation
Data Sources:	API monitoring, File monitoring, Process command-line parameters, Process monitoring, Windows Registry, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of accounts on a system or within an environment. This information can help adversaries determine which accounts exist to aid in follow-on behavior.
Tactics:	Discovery
Data Sources:	API monitoring, Azure activity logs, Office 365 account logs, Process command-line parameters, Process monitoring
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may try to get information about registered services. Commands that may obtain information about services using operating system utilities are "sc," "tasklist /svc" using Tasklist , and "net start" using Net , but adversaries may also use other tools as well. Adversaries may use the information from System Service Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report fNlAH8RgLk.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Microsoft\Media.xml

C:\Microsoft\iusb3mon.dat

C:\Microsoft\iusb3mon.exe

C:\Program Files (x86)\Your Product\360PayInsure.exe

C:\Program Files (x86)\Your Product\360RealPro.exe

C:\Program Files (x86)\Your Product\360SafeNotify.exe

C:\Program Files (x86)\Your Product\360netcfg.exe

C:\Program Files (x86)\Your Product\360sclog.exe

C:\Program Files (x86)\Your Product\InstallTMDB.exe

C:\Program Files (x86)\Your Product\SMLProxy64.exe

C:\Program Files (x86)\Your Product\SetupArpX64.exe

C:\Program Files (x86)\Your Product\WiFiHelper.exe

C:\ProgramData\Microsoft\Program\ziliao.jpg

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_iusb3mon.exe_533583c58edbecc1aec14ce6b8049d85f78a438_16713590_1d369ce7\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7F9B.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8152.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8191.tmp.xml

C:\ProgramData\data\UPX.rar

C:\ProgramData\data\rar.ini

C:\Users\user\AppData\Local\Temp\Xshell 6 Update Log.txt

Windows Analysis Report
fNlAH8RgLk.exe

Function 0036188B Relevance: 68.5, APIs: 30, Strings: 9, Instructions: 213
stringfileCOMMON

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer.Shutting down or rebooting systems may disrupt access to computer resources for legitimate users.
Tactics:	Impact
Data Sources:	Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre